CVE-2025-66834

A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name...

CVE-2025-66834

TrueConf Server version 5.5.2.10813 is susceptible to a CSV Formula Injection vulnerability (CWE-1236). A normal user can inject malicious spreadsheet formulas into exported chat logs by providing a specially crafted Display Name . While some reports suggest this lack of neutralization could allo...

CVE-2025-66834

A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992296)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992296 advisory. In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+: display: Fix refcount leak bug In omapdssinitfbdev, offindnodebyname will return a...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992617)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992617 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: clear optc underflow before turn off odm clock Why After ODM clock off, optc...

TrueConf Server 安全漏洞

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. A security vulnerability exists in TrueConf Server version 5.5.2.10813, which stems from a vulnerability that allows injection of malicious spreadsheet formulas via specially crafted displa...

PT-2025-54212

Name of the Vulnerable Software and Affected Versions TrueConf Server version 5.5.2.10813 Description A CSV Formula Injection issue exists in TrueConf Server. A standard user can inject harmful spreadsheet formulas into exported chat logs by using a specially crafted Display Name. The vulnerabili...

CVE-2025-66834: Improper Neutralization of Formula Elements in a CSV File

A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via crafted Display Name...

phpMyFAQ has Stored XSS in user list via admin-managed display_name

Summary A stored cross-site scripting XSS vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities e.g., img .... When an administrator views the admin user list, the payload is decoded server-si...

GHSA-JV8R-HV7Q-P6VC phpMyFAQ has Stored XSS in user list via admin-managed display_name

Summary A stored cross-site scripting XSS vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities e.g., img .... When an administrator views the admin user list, the payload is decoded server-si...

CVE-2025-68951

phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an...

CVE-2025-68951 phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw

phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an...

CVE-2025-68951 phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw

phpMyFAQ is an open source FAQ web application. Versions 4.0.14 and 4.0.15 have a stored cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities. When an...

CVE-2025-68951

CVE-2025-68951 affects phpMyFAQ. Versions 4.0.14 and 4.0.15 contain a stored XSS vulnerability where an attacker’s HTML entities in a display_name are decoded server-side and rendered unescaped in the admin user list (Twig |raw), enabling script execution in an administrator’s context. A patch ex...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Shenzhou Vision Han Technology Co., Ltd (CNVD-C-2025-1206330)

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

PT-2025-54711

Summary A stored cross-site scripting XSS vulnerability allows an attacker to execute arbitrary JavaScript in an administrator’s browser by registering a user whose display name contains HTML entities e.g., img .... When an administrator views the admin user list, the payload is decoded server-si...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Shenzhou Vision Han Technology Co., Ltd (CNVD-C-2025-1203509)

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

The vulnerability of the Downloads Panel component of the Mozilla Firefox browser and the Thunderbird email client allows attackers to perform spear-phishing attacks.

The vulnerability of the Downloads Panel component in the Mozilla Firefox browser and the Thunderbird email client is related to deficiencies in the authentication process, resulting from incorrect display of the domain name in the address bar. Exploiting this vulnerability allows a malicious act...

CVE-2023-54010

In the Linux kernel, the following vulnerability has been resolved: ACPICA: ACPICA: check null return of ACPIALLOCATEZEROED in acpidbdisplayobjects ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4 ACPIALLOCATEZEROED may fails, objectinfo might be null and will cause null pointer dereference...

SUSE CVE-2022-50718

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix pci device refcount leak As comment of pcigetdomainbusandslot says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pcidevput. So...