CVE-2025-25036 Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25036 Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

CVE-2025-25036

Jalios JPlatform is affected by CVE-2025-25036 (XML External Entity Reference leading to XML Injection) in all versions prior to 10.0.8 (SP8). The issue is due to improper restriction of external entities, enabling XML injections under network access. Reported impact focuses on confidentiality ri...

CVE-2025-25036: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 SP8...

PT-2025-12441

Name of the Vulnerable Software and Affected Versions Jalios JPlatform versions prior to 10.0.8 SP8 Description The issue is related to an Improper Restriction of XML External Entity Reference vulnerability, which allows XML Injection. Recommendations For versions prior to 10.0.8 SP8, update to...

Jalios JPlatform 安全漏洞

Jalios JPlatform is a digital work platform from Jalios, Inc. A security vulnerability exists in Jalios JPlatform versions prior to 10.0.8, which stems from an improperly restricted XML external entity reference that could lead to XML injection...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

MAL-2025-2573 Malicious code in keypair-encryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1265d869c665e7bb42b4827bc9f51ad572b2ce181edebfc84eeb5698e0e39048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DRUPAL-CONTRIB-2025-024

This module adds a formatter for link fields that displays the current entity with another view mode inside the link. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal core has been released bu...

CVE-2025-2365

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

Malicious code in pendeck (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52144cad81187f6ac538b8ed921e0d500b9094449083bb6f7d408e5e7b6ba2d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tokesjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cf2bffbafed158e996b9fb6581994a5dda5f00137197ee10e3538b2e68eeb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0d7e92080b720d7d708537639734002025adb32846e183163eab64fed19c17e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

yimioa 安全漏洞

yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in versions prior to yimioa v2024.07.04, which stems from the presence of XML external entity injection in the XMLParse component, which allows an attacker to execute arbitrary co...

CVE-2025-25589

An XML external entity XXE injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file...

CVE-2025-25589

The yimioa (CloudNet OA) software, in versions prior to v2024.07.04 , contains an XML external entity (XXE) injection vulnerability within the /weixin/aes/XMLParse.java component. An attacker can exploit this by providing a specially crafted XML file to achieve arbitrary code execution . To remed...

CVE-2025-2365

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-2365 crmeb_java WeChatMessageController.java webHook xml external entity reference

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-2365 crmeb_java WeChatMessageController.java webHook xml external entity reference

A vulnerability, which was classified as problematic, has been found in crmebjava up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...