PT-2025-31197 · Dece · Dece Software Geodi

Name of the Vulnerable Software and Affected Versions: DECE Software Geodi versions prior to 9.0.146 Description: The software contains an Improper Neutralization of Input During Web Page Generation, which allows for Cross-Site Scripting XSS. This issue can potentially allow attackers to inject...

CVE-2025-6918

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025...

Improper Neutralization of Input Used for LLM Prompting

Overview @google/gemini-cli is a Gemini CLI Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting due to an improper implementation of the getCommandRoot and isCommandAllowed functions. An attacker can inject malicious commands by leveraging...

CVE-2025-4822

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL Injection. This issue affects ScadaWatt Otopilot: before 27.05.2025...

CVE-2025-5254

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Kron Technologies Kron PAM allows Stored XSS. This issue affects Kron PAM: before 3.7...

CVE-2025-5254

CVE-2025-5254 describes a Stored XSS flaw in Kron Technologies’ Kron PAM (pre-3.7) caused by improper neutralization of input during web page generation. Affected: Kron PAM versions before 3.7. Impact: potential execution of malicious scripts in a user’s browser when data is stored and later rend...

Kron PAM 跨站脚本漏洞

Kron PAM is a privileged access management platform from Kron Turkey. A cross-site scripting vulnerability exists in Kron PAM that stems from improper input neutralization and could lead to stored cross-site scripting...

MB CONNECT LINE mbNET.mini Cross-Site Scripting Vulnerability

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. A cross-site scripting vulnerability exists in MB CONNECT LINE mbNET.mini, which stems from improper neutralization of...

CVE-2025-4294

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in HotelRunner B2B allows Cross-Site Scripting XSS. This issue affects B2B: before 04.06.2025...

CVE-2025-4784

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Moderec Tourtella allows SQL Injection.This issue affects Tourtella: before 26.05.2025...

SMG Software Information Portal 代码问题漏洞

SMG Software Information Portal is an information portal product from SMG Software, Turkey. A code issue vulnerability exists in SMG Software Information Portal, which arises from the unrestricted upload of dangerous types of files and improper neutralization of special elements, which could lead...

Moderec Tourtella SQL注入漏洞

Moderec Tourtella is a software application from the Turkish company Moderec. Moderec Tourtella suffers from a SQL injection vulnerability that stems from improper neutralization of special elements, which could lead to a SQL injection attack...

CVE-2025-4700 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS...

CVE-2025-4700 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS...

CVE-2025-7716

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting XSS.This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0...

CVE-2025-41674

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...

GHSA-4J66-8F4R-3PJX bun vulnerable to OS Command Injection

All versions of the package bun are vulnerable to Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line...

CVE-2024-53288

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in NTP Region functionality in Synology Router Manager SRM before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified...

CVE-2024-53287

Synology Router Manager (SRM) is affected by CVE-2024-53287: an XSS in the VPN Setting functionality where improper input neutralization during web page generation allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. Affec...

CVE-2025-43488: Improper Neutralization of Input During Web Page Generation

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a bypass of the application's XSS filter by submitting untrusted characters. HP has addressed the issue in the latest software update...