CVE-2025-63420

CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions...

CrushFTP 安全漏洞

CrushFTP is a file transfer server from CrushFTP, Inc. A security vulnerability exists in CrushFTP version 11.3.750, which stems from the Reports/Who Created Folder feature in the Admin Panel not handling input correctly, which could lead to a stored cross-site scripting attack...

CVE-2025-63420

CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions...

PT-2025-45509

Name of the Vulnerable Software and Affected Versions CrushFTP version 11.3.7 50 Description A stored cross-site scripting XSS issue exists in the CrushFTP Admin Panel, specifically within the Reports / 'Who Created Folder' section. Authenticated attackers who have folder creation permissions can...

CVE-2025-63420: Improper Neutralization of Input During Web Page Generation

CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions...

CVE-2025-63420

CrushFTP version 11.3.7 before 11.3.7_57 is vulnerable to a stored HTML injection (CWE-79) in the Admin Panel under the Reports / "Who Created Folder" section. This flaw allows authenticated attackers with folder creation permissions to inject and persistently execute malicious HTML or JavaScript...

CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active Exploitation Evidence

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added two security flaws impacting Gladinet and Control Web Panel CWP to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The vulnerabilities in question are listed below ...

CVE-2025-12403

The Associados Amazon Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on the brzonadminpanel function. This makes it possible for unauthenticated attackers to update settings an...

PocketVJ CP 安全漏洞

PocketVJ CP is a control panel software by magdesign individual developers. A security vulnerability exists in PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1, which stems from the submitopacity.php component failing to clean up user input for the capacityValue POST parameter, which could allow a...

CVE-2025-63334

PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 is vulnerable to an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The root cause is a failure to sanitize user input provided in the opacityValue POST parameter before it is passed to a shell command. This all...

Linanto Control Web Panel (CWP) < 0.9.8.1205 Command Injection (CVE-2025-48703)

The version of Linanto Control Web Panel CWP, a web based control panel application, installed on the remote host is prior to 0.9.8.1205. It is, therefore, affected by a remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. Note that Nessus ha...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989423)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989423 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference In tpg110getmodes, the return...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989783)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989783 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference In tpg110getmodes, the return...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989873)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989873 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/panel: fix a possible null pointer dereference In versatilepanelgetmodes, the return value of...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988853)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988853 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/panel: fix a possible null pointer dereference In versatilepanelgetmodes, the return value of...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988965)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988965 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: populate connector of struct dppanel DP CTS test case 4.2.2.6 has valid edid with bad...

CVE-2025-61945 Missing Authentication for Critical Function in Radiometrics VizAir

Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weathe...

CVE-2025-61945

Radiometrics VizAir is affected by a missing authentication for critical functions vulnerability: an unauthenticated remote attacker can access the admin panel and modify key weather parameters (wind shear alerts, inversion depth, CAPE) and potentially disable alerts or alter runway settings. Mul...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-11371link is external Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability CVE-2025-48703link is external CWP...

CVE-2025-12403

The Associados Amazon Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on the brzonadminpanel function. This makes it possible for unauthenticated attackers to update settings an...