CVE-2024-55224

Vaultwarden (before 1.32.5) is affected by an HTML injection vulnerability that could allow an attacker to execute arbitrary code by injecting a crafted payload into the username field of an e‑mail message. The issue is described across multiple sources (including GHSA and OSV) as a Vaultwarden H...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API written in Rust by Daniel García Personal Developer. A security vulnerability exists in Vaultwarden versions prior to v1.32.5. An attacker exploiting this vulnerability could execute arbitrary code by injecting a specially...

Opencode Mobile Collect Call 安全漏洞

Opencode Mobile Collect Call is a mobile payphone solution from Opencode. A security vulnerability exists in Opencode Mobile Collect Call version v5.4.7. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a specially crafted payload injected into the opfunc...

kernel: net/sched: Fix UAF when resolving a clash

A use-after-free vulnerability was found in the net/sshd tcfctflowtableprocessconn of the Linux kernel. This flaw allows an attacker with a crafted payload to induce a system crash, resulting in a loss of system availability...

CVE-2024-46209

A stored cross-site scripting XSS vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter...

libreswan: remote DoS via crafted TS payload with an incorrect selector length

A flaw was found in the Libreswan package. A crafted TS payload with an incorrect selector length may allow a remote attacker to cause a denial of service...

Adobe Connect Cross-Site Scripting Vulnerability (CNVD-2025-02844)

Adobe Connect is a software for creating meeting environments from the American company Audobee Adobe. Adobe Connect suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an...

The vulnerability of the mobile device registration and mobile application deployment mechanism of Splunk Secure Gateway, a platform for operational analytics in Splunk Enterprise, arises from deficiencies in the deserialization mechanism. This allows attackers to execute arbitrary code.

The vulnerability of the mobile device registration and mobile application deployment mechanism of Splunk Secure Gateway, a platform for operational analytics in Splunk Enterprise, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to...

CVE-2024-50677

A cross-site scripting XSS vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...

CVE-2024-53470

Multiple stored cross-site scripting XSS vulnerabilities in the component /configuracao/gatewaypagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter...

CVE-2024-53470

CVE-2024-53470 involves multiple stored XSS vulnerabilities in WeGIA v3.2.0, specifically in the component /configuracao/gateway_pagamento.php. The issue allows injection of arbitrary web scripts or HTML via the id or name parameter, with the root cause identified as stored XSS. The provided docu...

CVE-2024-46624

An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users...

CVE-2024-46624

CVE-2024-46624 affects InfoDom Performa 365 v4.0.1. An authenticated attacker can elevate privileges to Administrator by sending a crafted payload to the endpoint /api/users . The available data confirm the vulnerability and impact (high, with access network, low complexity, low privileges requir...

CVE-2024-46624

An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users...

CVE-2024-53620

A cross-site scripting XSS vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Title parameter...

CVE-2024-53620

SPIP 4.3.3 Article module vulnerable to XSS: authenticated users can inject a payload into the Title parameter to trigger cross-site scripting. The issue affects SPIP v4.3.3 with the Article module; underlying cause is an XSS in Title handling. Exploitation is not described as active in the provi...

CVE-2024-53599

A cross-site scripting XSS vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-53599

A cross-site scripting XSS vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-53599

A cross-site scripting XSS vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

LafeLabs Chaos 安全漏洞

LafeLabs Chaos is an application from LafeLabs, Inc. A security vulnerability exists in LafeLabs Chaos version 0.0.1, which stems from the presence of a Cross-Site Scripting Attack XSS vulnerability that could allow an attacker to execute arbitrary Web script or Hypertext Markup Language via a...