CVE-2025-12916

CVE-2025-12916 affects Sangfor Operation and Maintenance Security Management System 3.0, specifically the Frontend component’s /fort/portal_login. The vulnerability arises from manipulating the loginUrl argument, enabling remote command injection. Public disclosures indicate exploitation is possi...

CVE-2025-12916 Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...

CVE-2025-12916 Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portallogin of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. T...

Malicious code in bf-purchases-frontend-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5dd380729ba06ecc83dd6bb54612311d4c2b15fc0b2eed47205416bf280f879 The package bf-purchases-frontend-web was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49398 Malicious code in bf-purchases-frontend-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5dd380729ba06ecc83dd6bb54612311d4c2b15fc0b2eed47205416bf280f879 The package bf-purchases-frontend-web was found to contain malicious code. Source: ossf-package-analysis...

PT-2025-45573

Name of the Vulnerable Software and Affected Versions Sangfor Operation and Maintenance Security Management System versions prior to 3.0.11 Description A command injection issue exists in the Sangfor Operation and Maintenance Security Management System. The issue is related to the manipulation of...

3rd-party-cpu-abuser (>=1.0.0, <=1.4.0), @2lkit/devtools (0.0.1-0) +163 more potentially affected by CVE-2025-12909 via chrome-devtools-frontend (>=1.0.377119-1, <=1.0.746710)

chrome-devtools-frontend NPM version =1.0.377119-1, =1.0.0, =1.2.2-beta, =0.1.0, =0.1.0, =0.0.1, =1.0.0, =1.3.0-1, =1.0.1, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-12909 Source advisory: SNYK:JS-CHROMEDEVTOOLSFRONTEND-13865282...

Access Control Bypass

Overview chrome-devtools-frontend is a Chrome DevTools UI Affected versions of this package are vulnerable to Access Control Bypass due to insufficient Content Security Policy enforcement in the Network.loadNetworkResource method of the DevTools protocol network handler. An attacker can exfiltrat...

Improper Neutralization

Overview chrome-devtools-frontend is a Chrome DevTools UI Affected versions of this package are vulnerable to Improper Neutralization due to insufficient sanitization of special whitespace characters in the escapeStringWin function. An attacker can execute arbitrary code by crafting malicious inp...

3rd-party-cpu-abuser (>=1.0.0, <=1.4.0), @2lkit/devtools (0.0.1-0) +163 more potentially affected by CVE-2025-12907 via chrome-devtools-frontend (>=1.0.377119-1, <=1.0.746710)

chrome-devtools-frontend NPM version =1.0.377119-1, =1.0.0, =1.2.2-beta, =0.1.0, =0.1.0, =0.0.1, =1.0.0, =1.3.0-1, =1.0.1, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-12907 Source advisory: SNYK:JS-CHROMEDEVTOOLSFRONTEND-13866859...

GHSA-CM35-V4VP-5XVX Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

Summary Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event SSE execute events. This leads to authentication token theft, comple...

CVE-2025-57244

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...

CVE-2025-57244

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...

CVE-2025-57244

OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989012)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989012 advisory. In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutexinit location Syzbot reported, that mxl111sfctrlmsg uses uninitializ...

CVE-2025-30188

Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available...

CVE-2025-30188

Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available...

CVE-2025-30188

Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available...

CVE-2025-30188

The CVE-2025-30188 entry describes a vulnerability in Open-Xchange OX App Suite where malicious or unintentional API requests can push large amounts of data into caches. This cache growth can evict information required for the web frontend to operate, potentially causing component unavailability....

CVE-2025-30188

Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available...