CVE-2025-57130

An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges. By sending a specially crafted HTTP request, a low-privilege user can access and modify the profile data of any other user,...

CVE-2025-57130

An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges. By sending a specially crafted HTTP request, a low-privilege user can access and modify the profile data of any other user,...

CVE-2025-62369 Xibo CMS: Remote Code Execution through module templates

Xibo is an open source digital signage platform with a web content management system CMS. Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System - Add/Edit custom modules and...

CVE-2025-62369

The CVE concerns Xibo CMS: versions 4.3.0 and earlier expose a Remote Code Execution flaw in the CMS Developer menu’s Module Templating functionality. Authentication with System -> Add/Edit custom modules and templates permissions allows manipulation of Twig filters and execution of arbitrary ...

CVE-2025-62369 Xibo CMS: Remote Code Execution through module templates

Xibo is an open source digital signage platform with a web content management system CMS. Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "System - Add/Edit custom modules and...

CVE-2025-63593

Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting XSS...

TencentOS Server 4: edk2 (TSSA-2025:0850)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0850 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-63593

Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting XSS...

CVE-2025-63593

Grav CMS 1.7.49.5 is reported as vulnerable to Cross-Site Scripting (XSS). The CNVD/Red Hat/NVD entries describe an XSS that arises from insufficient filtering/escaping of user-supplied data, enabling execution of arbitrary scripts in a user’s browser. The XSS affects Grav’s input handling and is...

CVE-2025-63593

Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting XSS...

PT-2025-44792

Name of the Vulnerable Software and Affected Versions Grav CMS version 1.7.49.5 Description Grav CMS version 1.7.49.5 is susceptible to Cross Site Scripting XSS. This allows for the injection of malicious scripts into web pages viewed by other users. Recommendations At the moment, there is no...

MAL-2025-49313 Malicious code in fec-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a74bf7ef4160cbd326cf0897bab905bbc059392581da57f6b10e99471e5c60c7 The package fec-cms was found to contain malicious code. Source: ossf-package-analysis 110aae9d904f5e4469a068418b8fe0f1fdf2094e4945829b8793584539f2a9...

Malicious code in fec-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a74bf7ef4160cbd326cf0897bab905bbc059392581da57f6b10e99471e5c60c7 The package fec-cms was found to contain malicious code. Source: ossf-package-analysis 110aae9d904f5e4469a068418b8fe0f1fdf2094e4945829b8793584539f2a9...

Astra Linux – Vulnerability in OpenSSL

Issue summary: An application attempting to decrypt messages encrypted using password-based encryption in CMS can trigger an out-of-bounds read and write attack. Impact summary: This out-of-bounds read attack may cause a system crash, leading to a denial of service for the application. The...

CVE-2025-63608

A SQL injection vulnerability exists in CSZ-CMS =1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form viewing feature, allowing authenticated administrators to execute arbitrary SQL queries...

CVE-2025-64112 Statmatic vulnerable to Stored Cross-Site Scripting

Statmatic is a Laravel and Git powered content management system CMS. Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fix...

EUVD-2025-37125

Malicious code in epic-node-cms npm...

Malicious code in epic-node-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd297874ba205aaf4c97faaf4912461c0dff63b90c1504a72fd8f692845da2e8 The package epic-node-cms was found to contain malicious code...

MAL-2025-49168 Malicious code in epic-node-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd297874ba205aaf4c97faaf4912461c0dff63b90c1504a72fd8f692845da2e8 The package epic-node-cms was found to contain malicious code...

CVE-2025-63608

A SQL injection vulnerability exists in CSZ-CMS =1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form viewing feature, allowing authenticated administrators to execute arbitrary SQL queries...