CVE-2025-32373 DNN allows a registered user to enumerate and access files they should not have access to

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8...

CVE-2025-32372 Server-Side Request Forgery (SSRF) in DotNetNuke.Core

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including...

PT-2025-15705 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions prior to 9.13.8 Description: The issue affects DNN, an open-source web content management platform in the Microsoft ecosystem. In certain configurations, registered users may be able to craft a request to...

Drupal security vulnerabilities

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal that stems from vulnerability to cross-site request forgery attacks...

Microsoft Identity Web log information leakage vulnerability

Microsoft Identity Web is an Azure Active Directory open source to help create protected web applications and web APIs using the Microsoft Identity Platform and Azure AD B2C. A log information disclosure vulnerability exists in Microsoft Identity Web, which stems from the fact that sensitive...

Flowise security vulnerabilities

Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise 2.2.3 and earlier versions that stems from an SQL injection in the tableName parameter of PostgresVectorStores...

Tiki security vulnerabilities

Tiki is a suite of open source content management and portal applications from the Tiki community that can be used to create web applications, portals, corporate intranets, extranets, and more. A security vulnerability exists in versions of Tiki prior to 28.3 that stems from improper handling of...

Verydows security vulnerabilities

Verydows is a lightweight open source e-commerce management system developed using the PHP language. A security vulnerability exists in version 2.0 of verydows, which stems from an improper privilege setting that could allow a remote attacker to execute arbitrary code...

CVE-2025-32036 DNN allows the possibility of bypassing Captcha

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. The algorithm used to generate the captcha image shows the least complexity of the desired image. For this reason, the created image can be easily read by OCR tools, and the intruder can send...

security-research

Security Research This project hosts security advisories and...

Malicious code in @n37scancp/highlight.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 944af106fc0b2a334ed1ab4fb6784a0b2cc01e5f795b1de3449b8deaf6560b50 The OpenSSF Package Analysis project identified '@n37scancp/highlight.js' @ 11.11.12 npm as malicious. It is considered malicious because: - The...

Apache Kylin code issue vulnerability (CNVD-2025-10036)

Apache Kylin is the United States Apache Apache Foundation of an open source distributed analytical data warehouse . The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Apache Kylin suffers from a code issue...

Apache Seata Code Issue Vulnerability

Apache Seata is the United States Apache Apache Foundation of a microservices architecture in the United States to provide high-performance and easy to use distributed transaction services in the open source project . Apache Seata suffers from a code issue vulnerability that stems from...

Umbraco security vulnerabilities

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco version 14+ that stems from path traversal and allows files to be uploaded to the wrong location...

APSB25-26 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves important and moderate vulnerabilities. Successful exploitation could lead to security feature bypass, privilege escalation and application denial-of-service...

MAL-2025-3169 Malicious code in @hyattcorp/design-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58f37a41edefebdd744efb01380e035aad567082e7fa96361effc44e4e9f1b49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this update as...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PCMan FTP Server security vulnerabilities

PCMan FTP Server is PCMan open source set of FTP software. PCMan FTP Server suffers from a buffer overflow vulnerability, which originates from the EPRT Command Handler, that can be exploited by an attacker to submit a special request resulting in a denial of service...

Langflow security vulnerabilities

Langflow is Langflow open source a visualization framework for building multi-agent and RAG applications . A remote code execution vulnerability exists in Langflow that can be exploited by an attacker to send a crafted HTTP request to execute arbitrary code...