2021 matches found
EUVD-2025-29910
Malicious code in bioql PyPI...
EUVD-2025-21176
Malicious code in bioql PyPI...
EUVD-2025-32091
Malicious code in bioql PyPI...
EUVD-2025-24930
Malicious code in bioql PyPI...
EUVD-2025-23454
Malicious code in bioql PyPI...
EUVD-2025-5567
Malicious code in bioql PyPI...
EUVD-2022-5105
Malicious code in bioql PyPI...
EUVD-2025-10989
Malicious code in bioql PyPI...
CVE-2025-9209
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated...
CVE-2025-40646
Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload...
CVE-2025-40646 Multiple vulnerabilities in Energy CRM by Status Tracker
Stored Cross-Site Scripting XSS vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/createjobsubmit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote...
CVE-2025-40646
CVE-2025-40646 describes a Stored Cross-Site Scripting (XSS) in Energy CRM v2025 by Status Tracker Ltd. The vulnerability arises from insufficient validation of user input in a POST to /crm/create_job_submit.php, using the JobCreatedBy parameter. An attacker could craft a request that, when viewe...
CVE-2025-40646 Exposure of sensitive information in Viday
Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload...
CVE-2025-59685
Kazaar 1.25.12 allows a JWT with none in the alg field...
ViDay Cross-site Scripting Vulnerabilities
ViDay is a business management platform from the Spanish company ViDay. ViDay suffers from a cross-site scripting vulnerability that originates from a JWT containing sensitive user information in an HTTP request, which could lead to information disclosure...
PT-2025-41596
Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.5 Description Authlib, a Python library for building OAuth and OpenID Connect servers, has an issue in its JOSE implementation. It accepts JWS/JWT header and signature segments without size limits. An attacker can...
PT-2025-40330
Name of the Vulnerable Software and Affected Versions Viday affected versions not specified Description The software exhibits a flaw that could allow an attacker to obtain sensitive customer information. This is achieved by intercepting HTTP requests and locating JWTs within the request payload...
CVE-2025-59685
Kazaar 1.25.12 allows a JWT with none in the alg field...
PT-2025-40251
Name of the Vulnerable Software and Affected Versions Kazaar version 1.25.12 Description The software allows a JSON Web Token JWT with 'none' specified in the 'alg' field. This can potentially compromise the integrity of the authentication process. Recommendations At the moment, there is no...