CVE-2025-45613

CVE-2025-45613 : Shiro-Action v0.6 has an improper access control in the component /user/list , allowing attackers to access sensitive information via a crafted payload. The CVSS v3.1 base score is 7.5 (HIGH) , with Confidentiality impact High and no impact on Availability/Integrity per the provi...

CVE-2025-45614

Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload...

CVE-2025-45608

Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload...

CVE-2025-45608

Summary : CVE-2025-45608 affects Xinguan v0.0.1-SNAPSHOT, where the /system/user/findUserList API has incorrect access control, enabling attackers to access sensitive information via a crafted payload. The vulnerability is described consistently across NVD/Red Hat/CVE/CNNVD-style records and thir...

CVE-2025-45618

CVE-2025-45618 affects jeeweb-mybatis-springboot v0.0.1.RELEASE, with an incorrect access control issue in the component /admin/sys/datasource/ajaxList. The vulnerability allows an attacker to access sensitive information via a crafted payload. The public documentation consistently states imprope...

CVE-2025-45609

CVE-2025-45609 affects the Kob project (latest v1.0.0-SNAPSHOT). The root cause is improper access control in the doFilter() function, enabling an attacker to access sensitive information via a crafted payload. The NVD entry lists a CVSSv3.1 base score of 7.5 (HIGH) with Network attack vector, Lo...

CVE-2025-45610

Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payload...

CVE-2025-45614

Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload...

CVE-2025-45613

Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload...

CVE-2025-45613

Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2025-09283)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from International Business Machines IBM. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for...

Regular Expression Denial of Service (ReDoS)

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the token2json function in the processingdonut module. An attacker can cause high CPU usage and potential...

Exploit for CVE-2025-43960

CVE-2025-43960 - PHP Object Injection in Adminer !2https:...

CVE-2025-29526

The CVE-2025-29526 entry affects Q4 Inc Investor Relations Platform v5.147.1.2, where an unfiltered input in the SearchTerm parameter of the search function enables Cross-Site Scripting (XSS), allowing arbitrary Javascript execution. Affected component: Search feature; root cause: insufficient in...

CVE-2024-53568

A stored cross-site scripting XSS vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the tag parameter...

CVE-2024-53569

Volmarg Personal Management System (PWM) v1.4.65 is affected by a stored XSS in the New Goal Creation feature. The vulnerability is triggered by injecting a crafted payload into the description field, allowing an authenticated attacker to execute arbitrary web scripts or HTML in the context of th...

CVE-2023-43378

A cross-site scripting XSS vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento11 parameter...

CVE-2024-53569

A stored cross-site scripting XSS vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the description parameter...

WorldCast Systems ECRESO FM/DAB/TV Transmitter 安全漏洞

The WorldCast Systems ECRESO FM/DAB/TV Transmitter is a series of all-digital transmitters for analog FM from WorldCast Systems. A security vulnerability exists in WorldCast Systems ECRESO FM/DAB/TV Transmitter version 1.10.1, which stems from a specially crafted JSON payload that could lead to...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content...