EUVD-2025-27046

Malicious code in bioql PyPI...

EUVD-2025-30789

Malicious code in bioql PyPI...

EUVD-2025-32142

Malicious code in bioql PyPI...

EUVD-2022-4308

Malicious code in bioql PyPI...

CVE-2025-52656

HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields...

CVE-2025-52656 HCL MyXalytics product is affected by Mass Assignment vulnerability

HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields...

CVE-2025-52656 HCL MyXalytics product is affected by Mass Assignment vulnerability

HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields...

scsi: mpi3mr: Avoid memcpy field-spanning write WARNING

...

CVE-2025-61087

SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting XSS via the Customer Name field under Customer Management Section...

CVE-2025-56379

A stored cross-site scripting XSS vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field...

📄 ERPNext 15.67.0 / Frappe 15.72.4 Cross Site Scripting

ERPNext version 15.67.0 and Frappe version 15.72.4 suffer from a persistent cross site scripting vulnerability. CVE-2025-56379 — Stored Cross-Site Scripting XSS in ERPNext 15.67.0 / Frappe 15.72.4 📌 Summary A stored Cross‑Site Scripting XSS vulnerability exists in the Blog module of ERPNext...

Oracle E-Business Suite (July 2025 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory. - Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite component: Preferences. Supported versions that are...

CVE-2025-60782

PHP Education Manager v1.0 is vulnerable to Cross Site Scripting XSS stored Cross-Site Scripting XSS vulnerability in the topics management module topics.php. Attackers can inject malicious JavaScript payloads into the Titlefield during topic creation or updates...

CVE-2025-61087

SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting XSS via the Customer Name field under Customer Management Section...

CVE-2025-56379

A stored cross-site scripting XSS vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field...

CVE-2024-58260

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts...

CVE-2024-58260 Rancher update on users can deny the service to the admin

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the .username field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts...

CVE-2025-40989

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectmessage/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a speciall...

CVE-2025-40992 Stored XSS in Creativeitem Sociopro

Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/updateprofile', affecting to 'name' parameter via POST. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and...

CVE-2025-40991 Stored XSS in Creativeitem Ekushey CRM

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectfile/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a...