CVE-2025-54541 Cross-Site Request Forgery in QuickCMS

QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article. The vendor was notified early about this vulnerability, but didn't respon...

CVE-2025-54540 Reflected XSS in QuickCMS

QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn...

CVE-2025-54540 Reflected XSS in QuickCMS

QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn...

PT-2025-34984

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS transmits passwords and login credentials via GET requests, potentially allowing a local attacker with access to a victim’s browser history to obtain credentials and log in as the user...

PT-2025-34987

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to Reflected Cross-Site Scripting XSS via the sLangEdit parameter within the admin panel functionality. An attacker can create a malicious URL that, when accessed, can execute arbitrar...

QuickCMS 跨站脚本漏洞

QuickCMS is an open source content management system from QuickCMS. A cross-site scripting vulnerability exists in QuickCMS version 6.8, which stems from improper handling of the sSort parameter and could lead to a reflective cross-site scripting attack...

PT-2025-34983

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to a Cross-Site Request Forgery CSRF issue in the page deletion functionality. A malicious actor can create a crafted website that, when visited by an administrator, automatically send...

Contao 安全漏洞

Contao is an open source Content Management System CMS developed in PHP by Contao Open Source. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in Contao version 5.3.38 and versions prior to 5.6.1, which stems from the possibility of...

QuickCMS 跨站脚本漏洞

QuickCMS is an open source content management system from QuickCMS. A cross-site scripting vulnerability exists in QuickCMS version 6.8, which stems from improper handling of the aDirFilesDescriptions parameter and could lead to a stored cross-site scripting attack...

August 28, 2025-KB5064401 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2 and Microsoft server operating system version 24H2

None None...

PT-2025-34982

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to Reflected Cross-Site Scripting XSS through the sSort parameter within the admin panel functionality. An attacker can leverage this to execute arbitrary JavaScript code in a victim’s...

PT-2025-34985

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 Description: QuickCMS is susceptible to a Stored Cross-Site Scripting XSS issue through the sDescriptionMeta parameter within the page editor's SEO functionality. An attacker possessing administrative privileges can injec...

A Bootiful Podcast: JobRunr founder Ronald Dehuysser on what's new in version 8

Hi, Spring fans! In this installment, fresh after an exciting and exhausting SpringOne 2025, I am thrilled to have talked with JobRunr founder Ronald Dehuysser on what's new in version 8.0.0. Learn more about JobRunr v8 here!...

QuickCMS 跨站请求伪造漏洞

QuickCMS is an open source content management system from QuickCMS. A cross-site request forgery vulnerability exists in QuickCMS version 6.8, which stems from vulnerability to cross-site request forgery attacks...

WordPress Uncanny Automator Plugin <= 6.7.0.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Uncanny Automator versions = 6.7.0.1...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in axios-1.6.1.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of axios-1.6.1.tgz Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to...

WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by 0xd4rk5id3 in WordPress Plugin SUMO Memberships for WooCommerce versions 7.8.0...

Oracle Linux 8 : fence-agents (ELSA-2025-14750)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-14750 advisory. - bundled requests: fix CVE-2024-47081 Resolves: RHEL-104741 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Linux Distros Unpatched Vulnerability : CVE-2022-43602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput...

Linux Distros Unpatched Vulnerability : CVE-2022-31086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 incorrect...