CVE-2025-1082

Mindskip xzs-mysql (3.9.0) has a Cross-Site Scripting (XSS) vulnerability in the Exam Edit Handler, specifically in /api/admin/question/edit. The issue arises from manipulating the title/content parameters of that API, allowing remote attackers to inject script. Public exploit information exists ...

CVE-2025-1082 Mindskip xzs-mysql 学之思开源考试系统 Exam Edit edit cross site scripting

A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to...

CVE-2025-1082 Mindskip xzs-mysql 学之思开源考试系统 Exam Edit edit cross site scripting

A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to...

WhoDB allows parameter injection in DB connection URIs leading to local file inclusion

Summary The application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. Details The application uses string concatenation to build database connection URIs which are then passed to...

CVE-2025-24787 Parameter injection in DB connection URIs leading to local file inclusion in WhoDB

WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build...

CVE-2025-24787 Parameter injection in DB connection URIs leading to local file inclusion in WhoDB

WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build...

CVE-2021-31581

The restricted shell provided by Akkadian Provisioning Manager Engine PME can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 and later,...

CVE-2025-24337

WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini...

xzs-mysql 安全漏洞

xzs-mysql is a front-end and back-end separated exam system open source by China Mindskip Technology mindskip. A security vulnerability exists in xzs-mysql version 3.9.0, which stems from the component CORS Handler that can lead to overly lax cross-domain policies for untrusted domains...

PT-2025-5884 · Mindskip · Mindskip Xzs-Mysql 学之思开源考试系统

Name of the Vulnerable Software and Affected Versions: Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0 Description: A problematic issue was found in the CORS Handler component, leading to a permissive cross-domain policy with untrusted domains. The attack can be launched remotely, but the complexity i...

CVE-2025-1082: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to...

Important Photon OS Security Update - PHSA-2025-4.0-0750

Updates of 'linux', 'mysql' packages of Photon OS have been released...

The vulnerability of the InnoDB component of the MySQL Database Server management system, which allows a hacker to cause a service failure.

The vulnerability of the InnoDB component in the MySQL Database Management System is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause downtime or service failures using the MySQL network protocol...

Vulnerability of the MySQL Server component: The Optimizer component of the MySQL database management system allows a hacker to gain unauthorized access to protected information and to modify, add, or delete data.

The vulnerability of the MySQL Server component involves unlimited distribution of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information and to modify, add, or delete data using the MySQL network protocol...

PT-2025-5895 · Mindskip · Mindskip Xzs-Mysql 学之思开源考试系统

Name of the Vulnerable Software and Affected Versions: Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0 Description: A problematic issue has been found, affecting some unknown functionality and leading to cross-site request forgery. The attack can be launched remotely and multiple endpoints are affecte...

CVE-2025-1083: Permissive Cross-domain Policy with Untrusted Domains

A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the component CORS Handler. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely...

CVE-2025-24787: Improper Neutralization of Special Elements in Data Query Logic

WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build...

The vulnerability of the Firewall component of the MySQL Enterprise Firewall software allows a hacker to induce a service failure.

The vulnerability of the MySQL Enterprise Firewall component is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause downtime or service failures using the MySQL network protocol...

Vulnerability of the Server component: Security: Privileges of the MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the MySQL Server component relates to the unlimited distribution of resources. Exploiting this vulnerability can allow an attacker to cause service interruptions...

Vulnerability of the MySQL Server component: The Optimizer component of the MySQL database management system allows a hacker to gain unauthorized access to protected information and to modify, add, or delete data.

The vulnerability of the MySQL Server component involves unlimited distribution of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information and to modify, add, or delete data using the MySQL network protocol...