19034 matches found
Missing Origin Validation in WebSockets
Overview Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets. When using a terminal interpreter i.e. %sh.terminal in an Apache Zeppelin notebook, a WebSocket server is spawned on a random port. This server does not implement an origin check and as such is...
CVE-2025-50866
CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting XSS vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading t...
CVE-2025-43260
This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to hijack entitlements granted to other privileged apps...
Student Result Management System /elms/emp-changepassword.php Component Session Hijacking Vulnerability
Student Result Management System is a student result management system. Student Result Management System suffers from a session hijacking vulnerability that stems from an improperly disabled session in component /elms/emp-changepassword.php, no details of the vulnerability are available at this...
Unspecified vulnerability in Online Library Management System
Online Library Management System is an online library management system. A security vulnerability exists in Online Library Management System, which originates from an improperly disabled session in the component /library/change-password.php, and can be exploited by an attacker to cause a session...
Student Result Management System /srms/change-password.php Component Session Hijacking Vulnerability
Student Result Management System is a student result management system. Student Result Management System suffers from a session hijacking vulnerability that stems from improper session invalidation of the component /srms/change-password.php, no details of the vulnerability are available at this...
Car Washing Management System Session Hijacking Vulnerability
Car Washing Management System is a car wash management system. Car Washing Management System suffers from a session hijacking vulnerability that stems from improper session invalidation of the component /doctor/change-password.php, no details of the vulnerability are provided at this time...
CVE-2025-50866
CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting XSS vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading t...
PT-2025-31560 · Unknown · Cloudclassroom-Php Project
Name of the Vulnerable Software and Affected Versions: CloudClassroom-PHP-Project version 1.0 Description: The software contains a reflected Cross-site Scripting XSS vulnerability in the email parameter of the /postquerypublic API endpoint. Improper sanitization allows an attacker to inject...
CVE-2025-50866
CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting XSS vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading t...
CloudClassroom-PHP-Project 安全漏洞
CloudClassroom-PHP-Project is a cloud classroom website by the individual developer Vishal Mathur. A security vulnerability exists in CloudClassroom-PHP-Project version 1.0, which stems from a reflective cross-site scripting vulnerability that could lead to session hijacking or phishing attacks...
CVE-2025-50866
CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting XSS vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading t...
CVE-2025-50866
CVE-2025-50866 concerns CloudClassroom-PHP-Project 1.0, which contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the /postquerypublic endpoint. The vulnerability arises from improper sanitization of user-supplied input, allowing an attacker to inject JavaScrip...
CVE-2025-7676
DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be...
Critical Dahua Camera Flaws Enable Remote Hijack via ONVIF and File Upload Exploits
Cybersecurity researchers have disclosed now-patched critical security flaws in the firmware of Dahua smart cameras that, if left unaddressed, could allow attackers to hijack control of susceptible devices. "The flaws, affecting the device's ONVIF protocol and file upload handlers, allow...
CVE-2025-50487
Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a session hijacking attack...
CVE-2025-50493
Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack...
CVE-2025-50494
Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System v1.0 allows attackers to execute a session hijacking attack...