CVE-2025-53934

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the control.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

XWiki < 15.10.16, 16.0.0-rc-1 < 16.4.7, 16.5.0-rc-1 < 16.10.2 Multiple Vulnerabilities

Xwiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.9.0.25.07 (July 2025 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Java Delivery Netty...

PT-2025-29815 · Unknown · Ezihosting Tennis Court Bookings

Name of the Vulnerable Software and Affected Versions: EZiHosting Tennis Court Bookings versions through 1.2.7 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows an attacker to inject...

GHSA-6QJF-G333-PV38 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

Impact There is an arbitrary code execution vulnerability in the CsvEnumerator class of the job-iteration repository. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the application is running, potentially leading to unauthorized access, data...

Why AppSec and CloudSec Belong Together in the Age of AI

AI accelerates development— and risk shouldn't be a blocker to innovation. Bridging AppSec and CloudSec with shared context and workflows is key to keeping up...

CVE-2025-6514

creationtimestamp| type| source ---|---|--- 2025-07-09 14:30:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltjzp6d32j2y 2025-07-09 19:28:16+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3ltkke2mlwl2j 2025-07-09 19:30:45+00:00| seen|...

CVE-2025-7102

A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can be initiated remotely. The exploit has...

CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...

CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...

CVE-2025-53185

creationtimestamp| type| source ---|---|--- 2025-07-07 07:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltebwmgksm2s...

CVE-2025-53170

Null pointer dereference vulnerability in the application exit cause module Impact: Successful exploitation of this vulnerability may affect function stability...

CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-52805

creationtimestamp| type| source ---|---|--- 2025-07-04 13:38:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt5ehosfut2a...

Bridging the Security Knowledge Gap: Introducing AI ExplAIn for Imperva Cloud WAF

The challenge of maintaining robust web application security often comes down to communication. Security teams frequently spend countless hours explaining WAF blocking decisions to application developers who may lack security expertise. This communication gap not only creates friction between tea...

CVE-2025-49005

creationtimestamp| type| source ---|---|--- 2025-07-03 23:12:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt3u3a3mqo2a 2025-07-04 09:00:05+00:00| seen| https://bsky.app/profile/rss.y-u-e.workers.dev/post/3lt4uw734il2l 2025-07-04 17:14:04+00:00| seen|...

CVE-2025-6071

creationtimestamp| type| source ---|---|--- 2025-07-03 19:38:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt3i4pxddn2p 2025-07-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-02 2025-08-06 13:54:19+00:00| seen|...

CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-27455 CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-27455

CVE-2025-27455 is linked to a clickjacking vulnerability in Endress+Hauser MEAC300-FNADE4 web interface (end-user frame embedding allowed). Connected sources confirm the affected product and vulnerability class but do not provide a confirmed patch/version fix; one PT-SEC source notes no available...