CVE-2025-1088

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher. Mitigation To mitigate this flaw limit dashboar...

VulnCheck KEV: CVE-2025-49132

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it...

Pterodactyl Panel CVE-2025-49132 Remote Code Execution

This module exploits a vulnerability in Pterodactyl Panel before version 1.11.11 that allows unauthenticated remote code execution through improper handling of locale file operations. The vulnerability exists in the locale.json endpoint which allows path traversal and arbitrary file creation. Cod...

UBUNTU-CVE-2025-1088

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher...

CVE-2025-1088: Improper Input Validation

In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher...

Restaurant Table Booking System manage-subadmins.php file cross-site scripting vulnerability

Restaurant Table Booking System is a restaurant table reservation system. Restaurant Table Booking System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter fullname in the file...

MAL-2025-4999 Malicious code in eslint-plugin-panel-ops (npm)

Malware: Executes code on install, exfiltrates data via DNS to a suspicious domain. Contains a preinstall script and phone-home behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc1ea7508e63005e73356cfdb457f0050ebb7ae1f04cb319592c30a140c4e2f2 Any computer th...

PT-2025-35234

Уязвимость компонента интерфейса сервера программного обеспечения для видеоконференций Vinteo, существует из-за недостаточной проверки входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код в панели администратора...

Vinteo video conference software Code Execution

The vulnerability of the Vinteo video conference software’s interface component exists due to insufficient verification of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the administrator panel...

WordPress plugin WP Sliding Login/Dashboard Panel 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-5928: Cross-Site Request Forgery (CSRF)

The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...

Rail Pass Management System /admin/pass-bwdates-reports-details.php File SQL Injection Vulnerability

Rail Pass Management System is a rail pass management system. Rail Pass Management System suffers from a SQL injection vulnerability, which originates from improper handling of the parameter fromdate/todate in the file /admin/pass-bwdates-reports-details.php, resulting in SQL injection. An attack...

Inside LockBit's Admin Panel Leak

Inside the LockBit's Admin Panel Leak: Affiliates, Victims and Millions in Crypto By Jambul Tologonov · June 12, 2025 Introduction On May 7, 2025, the LockBit admin panel was hacked by an anonymous actor who replaced their TOR website with the text ‘ Don’t do crime CRIME IS BAD xoxo from Prague ’...

Complaint Management System /admin/manage-users.php File SQL Injection Vulnerability

Complaint Management System is a complaint management system. Complaint Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter uid in the /admin/manage-users.php file. An attacker can exploit...

Teacher Subject Allocation Management System /edit-teacher-info.php File SQL Injection Vulnerability

Teacher Subject Allocation Management System a teacher subject allocation management system. The Teacher Subject Allocation Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter editid in fi...

CVE-2025-46612

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-46612

The Airleader Master (air compressor management device) and Airleader Easy (air compressor device) products, in versions prior to 6.36 , are vulnerable to arbitrary command execution . The root cause is an unrestricted file upload vulnerability in the Panel Designer dashboard via the wizard/works...

Airleader Master和Airleader Easy 安全漏洞

Airleader Master and Airleader Easy are both products of Airleader, Inc.Airleader Master is a management device for managing air compressors.Airleader Easy is an air compressor device. A security vulnerability exists in Airleader Master and Airleader Easy versions prior to 6.36 that stems from a...

CVE-2025-46612: Unrestricted Upload of File with Dangerous Type

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-5544

A vulnerability was found in aaluoxiang oasystem up to 5b445a6227b51cee287bd0c7c33ed94b801a82a5. It has been rated as problematic. Affected by this issue is the function image of the file src/main/java/cn/gson/oasys/controller/user/UserpanelController.java. The manipulation leads to path traversa...