GHSA-5FF5-9FCW-VG88 Astro's `X-Forwarded-Host` is reflected without validation

Summary When running Astro in on-demand rendering mode using a adapter such as the node adapter it is possible to maliciously send an X-Forwarded-Host header that is reflected when using the recommended Astro.url property as there is no validation that the value is safe. Details Astro reflects th...

CVE-2025-11589

CodeAstro Gym Management System 1.0 has a SQL injection in /admin/user-payment.php triggered by manipulating the plan parameter. The vulnerability is exploitable remotely and an exploit has been released publicly. The exact root cause is an insecure handling of the plan argument leading to SQL in...

CVE-2025-61925 Astro's `X-Forwarded-Host` is reflected with no validation

Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in X-Forwarded-Host in output when using Astro.url without any validation. It is common for web servers such as nginx to route requests via the Host header, and forward on other request headers. As such as malicious reque...

CVE-2025-61925 Astro's `X-Forwarded-Host` is reflected with no validation

Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in X-Forwarded-Host in output when using Astro.url without any validation. It is common for web servers such as nginx to route requests via the Host header, and forward on other request headers. As such as malicious reque...

Improper Validation of Unsafe Equivalence in Input

Overview alt-design/alt-redirect is an Alt Redirect addon, add Redirects to your site Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input via handling of query string parameters when the "Query String Strip" feature is enabled. An attacker can...

CVE-2025-8887

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs...

CVE-2025-8887 IDOR in Usta Information Systems' Aybs Interaktif

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs...

CVE-2025-8887 IDOR in Usta Information Systems' Aybs Interaktif

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs...

CVE-2025-8887

The CVE-2025-8887 issue concerns Usta Information Systems Inc. Aybs Interaktif. Affects Aybs Interaktif versions from 2024 through 28082025 and arises from an authorization bypass via user-controlled keys, leading to missing authorization and exposure of sensitive information to an unauthorized a...

EUVD-2025-33726

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation.This issue affects Aybs...

CVE-2025-8887

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs...

BIT-EJBCA-2025-3027 Open Redirect vulnerability in EJBCA

The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server fails to find the requested file and redirects to an external page. This vulnerability could allow users to be redirected to potentially...

RLSA-2025:16086 Moderate: mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. Security Fixes: mysql: mysqldump unspecified vulnerability CPU Apr 2025 CVE-2025-30722 mysql: Optimizer unspecified vulnerability CPU Apr 2025...

CVE-2025-11514

A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and...

NVIDIA Display Driver 代码问题漏洞

NVIDIA Display Driver is a graphics card driver from NVIDIA. A security vulnerability exists in NVIDIA Display Driver, which can be exploited by attackers to cause denial of service, elevation of privilege, code execution, and data manipulation...

The vulnerability of AndSoft e-TMS software management system for transportation operations lies in the lack of protective measures for the SQL query structure, allowing attackers to gain access to create, update, and delete data in the database.

The vulnerability of the AndSoft e-TMS transportation management software lies in the lack of measures taken to protect the SQL query structure during the processing of the SessionID parameter. Exploiting this vulnerability allows an attacker to gain access to create, update, and delete databases...

PT-2025-41566

Name of the Vulnerable Software and Affected Versions Usta Information Systems Inc. Aybs Interaktif versions 2024 through 28082025 Description An authorization bypass exists in Usta Information Systems Inc. Aybs Interaktif due to user-controlled keys, missing authorization checks, and exposure of...

The vulnerability of microprogrammed software in Cisco Nexus 3000 Series and Cisco Nexus 9000 Series virtual switches, related to the swapping of indicators, allows a intruder to trigger a service failure.

The vulnerability of microprogrammed software in Cisco Nexus 3000 Series and Cisco Nexus 9000 Series virtual switches is related to the manipulation of indicators. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Usta Aybs Interaktif 安全漏洞

Usta Aybs Interaktif is an Enterprise Resource Planning ERP management platform from Usta Turkey. A security vulnerability exists in Usta Aybs Interaktif versions 2024 through 28082025, which stems from authorization bypass and missing authorization, and could lead to forceful browsing, parameter...

CVE-2025-59968

A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface. Tampering with this metadata can result in managed SRX Series devices permitting network traffic that...