CVE-2025-7523

CVE-2025-7523 affects Jinher OA 1.0. The vulnerability is an XML External Entity (XXE) reference issue in the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx that can be triggered remotely. Multiple sources confirm the flaw and public disclosure of the exploit. No concrete fix/version is provide...

CVE-2025-7523 Jinher OA DelTemp.aspx xml external entity reference

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

Jinher OA 代码问题漏洞

Jinher OA is a collaborative management software from Jinher, China. A code issue vulnerability exists in Jinher OA version 1.0, which originates from an incorrect operation of file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx resulting in an XML external entity reference...

The vulnerability of the ColdFusion software platform lies in the improper limitation on XML references to external objects, which allows attackers to circumvent security restrictions.

The vulnerability of the ColdFusion software platform is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

CVE-2025-6438

Schneider Electric EcoStruxure IT Data Center Expert (prior to 9.0; affected versions 8.3 and earlier) is affected by CVE-2025-6438: XML External Entity (XXE) injection via the DataExchange SOAP route, enabling unauthenticated or low-privilege exploitation to read local files and potentially caus...

CVE-2025-6438

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account...

Malicious code in grallama (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a320b2690b732632ebf0fc3d95fb5e7b73a3da0fa8a36714880645805464c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dradis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7954d52cb9efed1e6bca698b7419519943e5bfd49e00332c59356fef7afe6cf0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-49535

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service b...

CVE-2025-49544

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or...

Malicious code in dt-internal-linter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5c720ae7505ae2c4d74c0ce8cea7fdb4961f4de5c0fddc8c485c7b66c87097d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dt-automation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6eeff9a72134c244b969bcd674f473359fea30bfe4423298194db75e255a238 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 XML Injection

Schneider Electric EcoStruxure IT Data Center Expert versions 8.3 and below has a DataExchange route that allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhel...

Adobe ColdFusion < 2021.x < 2021u21 / 2023.x < 2023u15 / 2025.x < 2025u3 Multiple Vulnerabilities (APSB25-69)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2021.x update 21, 2023.x update 15, or 2025.x update 3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-69 advisory. - ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are...

Vulnerabilities fixed in Adobe ColdFusion

Adobe has fixed vulnerabilities in ColdFusion Specifically for versions 25.2, 23.14, 21.20 and earlier. The vulnerabilities in ColdFusion include a significant vulnerability related to improper restriction of XML External Entity Reference XXE, hard-coded credentials, improper authorization, XML...

Malicious code in oneapi-environment-configurator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b59cc2d584cc83aeb72d1b1e463e2f4423a81b86d2fa4b7a2bdcf7867bba348 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in soundcast (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 379b1dd8b190afa55771e449b6c9e079ab30456e18816ffc30f20d8252a07932 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-49544

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or...