23785 matches found
Path traversal in Time Machine functionality in Guardian/CMC before 25.2.0
Summary A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. Impact An authenticated user with limited privileges, by issuing a specifically-crafted request, can potentially alter the structure and content of files in t...
CVE-2025-40989
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectmessage/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a speciall...
CVE-2025-61769
Emlog is an open source website building system. A cross-site scripting XSS vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload...
CVE-2025-36355
CVE-2025-36355 affects IBM Security Verify Access and IBM Security Verify Access Docker. A locally authenticated user could execute malicious scripts from outside the software’s control sphere in versions 10.0.0.0–10.0.9.0 and 11.0.0.0–11.0.1.0. IBM’s bulletin notes remediation via updates: IBM S...
CVE-2025-61769 Emlog vulnerable to stored XSS in file upload functionality in emlog
Emlog is an open source website building system. A cross-site scripting XSS vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload...
CVE-2025-61769
CVE-2025-61769 concerns Emlog, an open source PHP/MySQL CMS. The issue is a cross-site scripting (XSS) vulnerability present in Emlog up to and including version 2.5.22, exploitable via the file upload function where an authenticated user can upload an SVG containing JavaScript that is later exec...
CVE-2025-61687 FlowiseAI/Flosise has File Upload vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web...
CVE-2025-61687 FlowiseAI/Flosise has File Upload vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web...
CVE-2025-56382
A stored Cross-site scripting XSS vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticated attacker can inject arbitrary web script or HTML via the 'Customer Name' parameter when creating or editing customer profiles. This malicious input is...
CVE-2025-56382
A stored Cross-site scripting XSS vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticated attacker can inject arbitrary web script or HTML via the 'Customer Name' parameter when creating or editing customer profiles. This malicious input is...
SUSE CVE-2025-46818
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions o...
FreeBSD : redis,valkey -- Lua Use-After-Free may lead to remote code execution (17e85cae-a115-11f0-9446-f02f7497ecda)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 17e85cae-a115-11f0-9446-f02f7497ecda advisory. redis reports: An authenticated user may use a specially crafted Lua script to manipulate the garbage...
FreeBSD : redis,valkey -- Lua library commands may lead to integer overflow and potential RCE (f6b8de04-a116-11f0-9446-f02f7497ecda)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f6b8de04-a116-11f0-9446-f02f7497ecda advisory. redis reports: An authenticated user may use a specially crafted Lua script to cause an integer overflo...
AZL-68426 CVE-2025-49844 affecting package valkey for versions less than 8.0.6-1
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all...
EUVD-2022-3498
Malicious code in bioql PyPI...
EUVD-2022-4545
Malicious code in bioql PyPI...
EUVD-2022-5287
Malicious code in bioql PyPI...
EUVD-2022-2847
Malicious code in bioql PyPI...