PT-2025-37269

Name of the Vulnerable Software and Affected Versions: erjinzhi 10OA version 1.0 Description: A security flaw exists in erjinzhi 10OA version 1.0. The issue is related to some unknown functionality within the file /trial/mvc/item. Manipulation of the Name argument can lead to cross-site scripting...

Erjinzhi 10OA security vulnerability

erjinzhi 10OA is an enterprise automation system from China Binary erjinzhi. A security vulnerability exists in erjinzhi 10OA version 1.0, which stems from an incorrect manipulation of the parameter Name in the file /trial/mvc/item, which could lead to a cross-site scripting attack...

CVE-2025-10271

CVE-2025-10271 affects erjinzhi 10OA 1.0. The vulnerability is in the server-side processing of the Name argument within the file /trial/mvc/finder, where improper handling enables cross-site scripting (XSS). The issue appears to be exploitable remotely and publicly disclosed, with exploitation d...

CVE-2025-10271 erjinzhi 10OA finder cross site scripting

A vulnerability was found in erjinzhi 10OA 1.0. This impacts an unknown function of the file /trial/mvc/finder. The manipulation of the argument Name results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was...

CVE-2025-10272: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in erjinzhi 10OA 1.0. Affected is an unknown function of the file /trial/mvc/catalogue. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor...

CVE-2025-10271: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in erjinzhi 10OA 1.0. This impacts an unknown function of the file /trial/mvc/finder. The manipulation of the argument Name results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was...

Path Traversal

org.springframework, spring-webmvc is vulnerable to Path Traversal Vulnerability. The vulnerability is due to improper URI path canonicalization in non-compliant Servlet containers when serving static resources, which allows an attacker to bypass security restrictions and access unauthorized file...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2025-55201 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

CVE-2025-41242

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

MAL-2025-26926 Malicious code in mvc-seneca (npm)

The package mvc-seneca was found to contain malicious code...

Malicious code in mvc-seneca (npm)

The package mvc-seneca was found to contain malicious code...

Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not...

Progress: Multiple products have cross-site scripting vulnerabilities

Progress Telerik UI for ASP.NET Core and others are products of Progress, Inc.Progress Telerik UI for ASP.NET Core is a set of UI component libraries for building cross-platform responsive web applications.Progress Telerik UI for Progress Telerik UI for ASP.NET MVC is a library of UI components f...

MAL-2025-4923 Malicious code in ac-mvc-cid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 110e255563acbb72629ba03afd504713dfd8fbbdcd576258dde5d481975ac5ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ac-mvc-data-provider

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ac-mvc-cid

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in ac-mvc-cid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 110e255563acbb72629ba03afd504713dfd8fbbdcd576258dde5d481975ac5ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...