CVE-2025-59491

CVE-2025-59491 is a Cross Site Scripting vulnerability affecting CentralSquare Community Development v19.5.7, reported across multiple feeds. Descriptions consistently state XSS via form fields, but the provided documents do not specify the underlying code path, affected modules, or root cause. P...

CentralSquare Community Development 安全漏洞

CentralSquare Community Development is a public affairs department software system for local governments from CentralSquare USA. A security vulnerability exists in CentralSquare Community Development version 19.5.7 that originates from cross-site scripting in form fields...

CVE-2025-59491

Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields...

Malicious code in little_sturgeon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e37244ad4fca6504fb294b38a50b355d3319e1056b4d498fc659ef3bf92f8727 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

Malicious code in sexual_goat-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c0b585b9fd26311047a831cdcd81aa690bd0124d75e80256c822a517e3cb61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-97077 Malicious code in ugly_mosquito_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52a50c4d94992a22b5fae49ea5a8ecdfe56291494e03c31842a78f47872d7fd9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-87736 Malicious code in laila-semur73-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 521449b0842d83cab3375531d22ab0e871aa5e0f6f1f425d9e9003bbbcfdb9b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in erick-kembang92-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41b1fdf6df91abe3de51f966e36a500972e6e994a5eee1256a080ec4d4ab8f53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-klipo87-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2fb702017fc7d9001414030fd38799636ab2655cc5e71a91bb8a3f23a1628ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-48065

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content...

CVE-2025-48065

CVE-2025-48065 affects Combodo iTop (web-based ITSM). Affected versions: before 2.7.13 and before 3.2.2 are vulnerable to cross-site scripting when an error field contains malicious content; versions 2.7.13 and 3.2.2 are protected from this. Root cause concerns reflected XSS via error-field rende...

WordPress Custom Fields Account Registration For Woocommerce plugin <= 1.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Denver Jackson in WordPress Plugin Custom Fields Account Registration For Woocommerce versions = 1.2...

Malicious code in qori-empal47-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bad20da48e39bb4f2f84b27b85ff888502158ccd83a8be7ec33a56fc8affc104 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

SUSE CVE-2016-11068

An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...

SUSE CVE-2016-11078

An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information credential fields within config.json via the System Console UI...

CVE-2025-12808

Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure. This issue affects the following versions : Devolutions Server 2025.3.2.0 through 2025.3.5.0 Devolutions Server...

CVE-2025-60207

Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through = 2.1.2...