CVE-2025-52335

EyouCMS 1.7.3 is vulnerale to Cross Site Scripting XSS in index.php, which can be exploited to obtain sensitive information...

PT-2025-33350 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.7.3 Description: EyouCMS version 1.7.3 is susceptible to a Cross-Site Scripting XSS issue in the index.php file. This flaw allows attackers to potentially obtain sensitive information. Recommendations: At the moment, there i...

CVE-2025-52335

EyouCMS 1.7.3 is vulnerale to Cross Site Scripting XSS in index.php, which can be exploited to obtain sensitive information...

Campcodes Online Recruitment Management System 注入漏洞

CampCodes Online Recruitment Management System is a recruitment management system from CampCodes Philippines. An injection vulnerability exists in Campcodes Online Recruitment Management System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter ID in...

(Pwn2Own) Microsoft Windows 11 vhdmp Improper Validation of Array Index Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Virtual Hard...

CVE-2025-55198 Helm May Panic Due To Incorrect YAML Content

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expect...

CVE-2025-55198

CVE-2025-55198 affects Helm (Charts for Kubernetes). Prior to 3.18.5, parsing Chart.yaml and index.yaml could panic due to improper type validation. Helm 3.18.5 fixes the issue; a workaround is to ensure YAML files are formatted as Helm expects before processing. The IBM/Converged IBM bulletins l...

CVE-2011-10009

S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending...

CVE-2011-10009 S40 CMS 0.4.2 Path Traversal

S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending...

CVE-2011-10009 S40 CMS 0.4.2 Path Traversal

S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending...

CVE-2011-10009

Affected software: S40 CMS v0.4.2. Vulnerability: path traversal via the index.php page handler; the p parameter is not properly sanitized, enabling traversal of the file system and access to arbitrary files outside the web root. Impact: remote, unauthenticated exploitation leading to potential e...

Malicious code in st-py-de-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a0110859887f6cd8d6e81ff1c6715dd4a5d2a1c84c28b71cb09320e33e10cce5 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-41768 Malicious code in st-py-de-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a0110859887f6cd8d6e81ff1c6715dd4a5d2a1c84c28b71cb09320e33e10cce5 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

PT-2025-33103

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.18.5 Description: Helm is a package manager for Charts for Kubernetes. An improper validation of type error when parsing Chart.yaml and index.yaml files can lead to a panic. This issue impacts YAML validation where a...

📄 PivotX 3.0.0 RC 3 Remote Code Execution

This Metasploit module gains remote code execution in PivotX management system version 3.0.0 RC 3. The PivotX allows admin user to directly edit files on the webserver, including PHP files. The module exploits this by writing a malicious payload into index.php file, gaining remote code execution...

CVE-2025-8815

A vulnerability was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. It has been classified as critical. Affected is an unknown function of the file /index of the component Shiro Configuration. The manipulation leads to path traversal. It is possible to launch the attack...

CVE-2025-8813

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attac...

Malicious code in iamenumer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2281f18809744cd511d94170c1ce172994a633aa0b8b5bc9fa9b892629b5d674 Before creating the boto3 client, package exfiltrates user's credentials. Packages from the campaign are used as dependency in a GitHub project promising...

MAL-2025-41687 Malicious code in iamenumer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2281f18809744cd511d94170c1ce172994a633aa0b8b5bc9fa9b892629b5d674 Before creating the boto3 client, package exfiltrates user's credentials. Packages from the campaign are used as dependency in a GitHub project promising...

Malicious code in aws-enumerate (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 82e411db1ea78935340bd950942b13579b400264ddef042aa0b07d6952401c45 Package for enumeratin IAM --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-08-aws-enumerate Reasons base...