CVE-2025-24353

Directus prior to version 11.2.0 is vulnerable to privilege escalation via the share feature. A user can specify an arbitrary role when sharing an item, enabling access to fields that should be restricted for their role. Affected instances are those using the share feature with a role hierarchy a...

CVE-2025-24353

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instanc...

Cross-site Scripting (XSS)

Overview phpmyadmin/phpmyadmin is a web interface for MySQL and MariaDB. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the check tables feature due to improper user input sanitization in the getIndexesProblems function. An attacker can inject malicious scrip...

phpMyAdmin XSS when checking tables

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS...

CVE-2025-24530

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS...

CVE-2025-24530

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS...

DEBIAN-CVE-2025-24530

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS...

UBUNTU-CVE-2025-24530

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS...

CVE-2025-24353: Improper Privilege Management

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instanc...

PT-2025-5383

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 5.x prior to 5.2.2 Description An issue has been discovered in the check tables feature of phpMyAdmin, where a crafted table or database name could be used for XSS. This allows for potential exploitation of the XSS weakness...

CVE-2025-24530

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS...

PT-2025-3436 · Wallos · Wallos

Name of the Vulnerable Software and Affected Versions: Wallos version 2.41.0 Description: The issue allows a remote attacker to execute arbitrary code via the profile picture function. This is a result of a Cross Site Scripting vulnerability. Recommendations: For Wallos version 2.41.0, consider...

PT-2025-5336

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.2.0 Description The issue allows a typical user to specify an arbitrary role when sharing an item, enabling them to use a higher-privileged role to view fields they should not be able to see. This affects instance...

CVE-2025-24530

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS...

CVE-2025-24530

PHPMyAdmin 5.x prior to 5.2.2 is affected by an XSS vulnerability in the check tables feature. A crafted table or database name could be used to trigger XSS. Mitigation: upgrade to 5.2.2 or newer as indicated by multiple advisories (e.g., Debian openSUSE/Security advisories).

PT-2025-1511 · Kwhotel · Kwhotel

Name of the Vulnerable Software and Affected Versions: KWHotel version 0.47 Description: The issue concerns CSV Formula Injection in the invoice adding function. This allows for potential exploitation through malicious formula injection in CSV files. Recommendations: For KWHotel version 0.47,...

KWHotel security vulnerabilities

KWHotel is a hotel software for desktop, web and mobile devices from KWHotel, Inc. A security vulnerability exists in KWHotel version 0.47, which stems from a CSV formula injection in the Add Invoice feature...

CVE-2025-23758 WordPress pootle button plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pootlepress Pootle button pootle-button allows Reflected XSS.This issue affects Pootle button: from n/a through = 1.2.0...

7-Zip bug could allow a bypass of a Windows security feature. Update now

A patch is available for a vulnerability in 7-Zip that could have allowed attackers to bypass the Mark-of-the-Web MotW security feature in Windows. The MotW is an attribute added to files by Windows when they have been sourced from an untrusted location, like the internet or a restricted zone. Th...

PT-2025-5087 · Unknown · Wm Options Import Export

Name of the Vulnerable Software and Affected Versions: WM Options Import Export versions 1.0.1 and earlier Description: The issue allows for the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. This can potentially expose confidential information...