CVE-2024-6690

WP Content Copy Protection & No Right Click (premium) plugin before version 15.3 has an open-redirect vulnerability via the referrer parameter in no-js.php, allowing redirection to external sites. Root cause: open-redirect in referrer handling. Affected: wccp-pro WordPress plugin

CVE-2025-47789 Horilla Open Redirect Vulnerability in Login

Horilla is a free and open source Human Resource Management System HRMS. In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any...

CVE-2025-47789 Horilla Open Redirect Vulnerability in Login

Horilla is a free and open source Human Resource Management System HRMS. In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any...

CVE-2025-47789

Horilla is an open-source HRMS affected in versions up to 1.3 where a crafted URL can redirect users to an external domain after login, enabling open redirection to arbitrary sites (e.g., phishing). The issue is tied to commit 1c72404df6888bb23af73c767fdaee5e6679ebd6, which fixes the vulnerabilit...

Sulu vulnerable to XXE in SVG File upload Inspector

Impact A admin user can upload SVG which may load external data via XML DOM library, specially this can be used for eventually reference none secure XML External Entity References. Patches The problem has not been patched yet. Users should upgrade to patched versions once they become available...

External Control Of File Name Or Path

Microsoft.Build.Tasks.Core are vulnerable to External Control of File Name or Path. The vulnerability is due to external control of file name or path due to improper validation of input that allows an authorized attacker to manipulate file paths over a network...

CVE-2025-31947 Repeated LDAP login failures can lock an LDAP account

Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost...

CVE-2024-51445

A vulnerability has been identified in Polarion V2310 All versions, Polarion V2404 All versions V2404.4. The affected application contains a XML External Entity Injection XXE vulnerability in the docx import feature. This could allow an authenticated remote attacker to read arbitrary data from th...

Malicious code in baby-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598fa750ced56976e16940829f016c95ce72e423a41d8875aef222ea1b85e54b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AutoPentest: Enhancing Vulnerability Management with Autonomous LLM Agents

A recent area of increasing research is the use of Large Language Models LLMs in penetration testing, which promises to reduce costs and thus allow for higher frequency. We conduct a review of related work, identifying best practices and common evaluation issues. We then present AutoPentest, an...

ROS-20250515-08

A vulnerability in the Thunderbird email client is related to the presence of multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, when hovering over any attachment, only the the last link. Exploiting this vulnerability allows remote attackers, perform a...

Hitachi JP1/IT Desktop Management 2 安全漏洞

Hitachi JP1/IT Desktop Management 2 is an automatic collection of various types of information from Hitachi, Ltd. of Japan Hitachi, allowing you to manage it in one place. A security vulnerability exists in Hitachi JP1/IT Desktop Management 2 versions prior to 12-00 to 12-00-08, 11-10 to 11-10-08...

PT-2025-22326

Name of the Vulnerable Software and Affected Versions Eclipse JGit versions 7.2.0.202503040940-r and older Description The ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol are vulnerable to XML External Entity...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from a failure to lock out an LDAP user, which can be exploited by an attacker to lock out an external LDAP account through repeated failed...

The vulnerability of the UrlMon component in Windows operating systems allows attackers to circumvent existing security restrictions.

The vulnerability of the UrlMon component in Windows operating systems relates to the loading of unreliable external data alongside reliable data. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager on Windows, MacOS, Linux XML parsing components modules allows Data Serialization External Entities Blowup. This vulnerability is associated with program files...

GHSA-PWM3-776C-8Q7Q BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager on Windows, MacOS, Linux XML parsing components modules allows Data Serialization External Entities Blowup. This vulnerability is associated with program files...

CVE-2025-4641

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux XML parsing components modules allows Data Serialization External Entities Blowup. This vulnerability is associated with program files...

CVE-2025-4641

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux XML parsing components modules allows Data Serialization External Entities Blowup. This vulnerability is associated with program files...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection. An attacker can cause denial of service or access sensitive information by sending specially crafted XML data. Details XXE Injection is a type of attack against an application that parses XML input. XM...