CVE-2025-53639 Metersphere has SQL Injection Vulnerability in Sorting Field

MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. Th...

chinese-poetry 安全漏洞

chinese-poetry is chinese-poetry open source a database of ancient Chinese poems. A security vulnerability exists in chinese-poetry version 0.1, which stems from an insufficient regular expression complexity due to a misbehavior in the file rank/server.js...

SEMCMS 安全漏洞

SEMCMS is SEMCMS open source content management system CMS for foreign trade websites that support multi-language. A security vulnerability exists in SEMCMS v5.0, which originates from SQL injection of the pid parameter in SEMCMSct.php...

SEMCMS 安全漏洞

SEMCMS is SEMCMS open source content management system CMS for foreign trade websites that supports multiple languages. A security vulnerability exists in SEMCMS v5.0, which originates from SQL injection of the lgid parameter in SEMCMSProducts.php...

MeterSphere SQL注入漏洞

MeterSphere is MeterSphere's open source one-stop open source continuous testing platform. A SQL injection vulnerability exists in MeterSphere versions prior to 3.6.5-lts, which stems from insufficient validation of the sortField parameter and could lead to SQL injection...

Code-Projects Modern Bag 注入漏洞

Code-Projects Modern Bag is an online management system from Code-Projects open source. An injection vulnerability exists in Code-Projects Modern Bag version 1.0, which originates from SQL injection due to incorrect manipulation of the parameter idSlide in the file /admin/slide.php...

CVE-2025-53637

Meshtastic is an open source mesh networking solution. The mainmatrix.yml GitHub Action is triggered by the pullrequesttarget event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part,...

1000 Projects ABC Courier Management Security Breach

1000 Projects ABC Courier Management is an open source courier management system from 1000 Projects. 1000 Projects ABC Courier Management version 1.0 has a security vulnerability , the vulnerability stems from the wrong operation of the parameter Name in the file /adddealerrequest.php leads to SQ...

HAXcms with nodejs backend 代码问题漏洞

HAXcms with nodejs backend is an open source backend management system from HAX The Web. A code issue vulnerability exists in HAXcms with nodejs backend that stems from improper session termination, which could lead to unauthorized access...

PT-2025-29861 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open-source web manager designed for Portuguese-speaking users and charitable organizations. A Reflected Cross-Site Scripting XSS vulnerability exists in the cadastro adotante.php endpoin...

PT-2025-29839 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager. A Stored Cross-Site Scripting XSS vulnerability exists in the adicionar cor.php endpoint, allowing attackers to inject malicious scripts into the cor parameter...

Gitroom Postiz 代码问题漏洞

Gitroom Postiz is a social media scheduling tool from Gitroom open source. A code issue vulnerability exists in Gitroom Postiz versions 1.45.1 through 1.62.3, which stems from HTTP header injection and could lead to server-side request forgery...

GIGABYTE Chipsets 安全漏洞

GIGABYTE Chipsets is a series of open source chipsets from GIGABYTE of Taiwan, China. A security vulnerability exists in GIGABYTE Chipsets that originates from an unverified pointer and could lead to arbitrary read/write access and elevation of privilege...

CVE-2025-24798

Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains wantresponse==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This...

CVE-2025-53637 Meshtastic allows Command Injection in GitHub Action

Meshtastic is an open source mesh networking solution. The mainmatrix.yml GitHub Action is triggered by the pullrequesttarget event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part,...

CVE-2025-53637 Meshtastic allows Command Injection in GitHub Action

Meshtastic is an open source mesh networking solution. The mainmatrix.yml GitHub Action is triggered by the pullrequesttarget event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part,...

Critical mcp-remote Vulnerability Enables Remote Code Execution, Impacting 437,000+ Downloads

Cybersecurity researchers have discovered a critical vulnerability in the open-source mcp-remote project that could result in the execution of arbitrary operating system OS commands. The vulnerability, tracked as CVE-2025-6514 , carries a CVSS score of 9.6 out of 10.0. "The vulnerability allows...

Malicious code in nbastatsleftnav (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 514ea2a983874eb46d5517a63e127b2503b1f9a0dc1ffa0a726e5f1dbd7559b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 42 Update: chromium-138.0.7204.92-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

Code highlighting with Cursor AI for $500,000

Attacks that leverage malicious open-source packages are becoming a major and growing threat. This type of attacks currently seems commonplace, with reports of infected packages in repositories like PyPI or npm appearing almost daily. It would seem that increased scrutiny from researchers on thes...