Malicious code in @zalastax/nolb-_pic (npm)

The package @zalastax/nolb-pic was found to contain malicious code...

MAL-2025-13148 Malicious code in @zalastax/nolb-pic (npm)

The package @zalastax/nolb-pic was found to contain malicious code...

Malicious code in @zalastax/nolb-pic (npm)

The package @zalastax/nolb-pic was found to contain malicious code...

MAL-2025-10324 Malicious code in @zalastax/nolb-_pic (npm)

The package @zalastax/nolb-pic was found to contain malicious code...

CVE-2025-50234

MCCMS v2.7.0 has an SSRF vulnerability located in the index method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sysauth$pic, 1 function, which utilizes a hard-coded key McEncryptionKey bD2voYwPpNuJ7B8, defined in the...

CVE-2025-50234

MCCMS v2.7.0 has an SSRF vulnerability located in the index method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sysauth$pic, 1 function, which utilizes a hard-coded key McEncryptionKey bD2voYwPpNuJ7B8, defined in the...

PT-2025-32179 · Mccms · Mccms

Name of the Vulnerable Software and Affected Versions: MCCMS version 2.7.0 Description: MCCMS v2.7.0 contains a Server-Side Request Forgery SSRF vulnerability located in the index method of the sysappscontrollersapiGf.php file. The vulnerability occurs when processing the pic parameter. The pic...

mccms 安全漏洞

mccms Man City CMS is a rapid website builder system for individual developers of China Smokey River South chshcms. A security vulnerability exists in mccms version v2.7.0, which originates from improper handling of the pic parameter in the sysappscontrollersapiGf.php file, which may lead to SSRF...

CVE-2025-20331: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based managemen...

Vulnerabilities fixed in Cisco ISE and ISE-PIC

Cisco has fixed vulnerabilities in Cisco ISE and ISE-PIC. The vulnerabilities are in the way Cisco ISE and ISE-PIC process files through APIs and validate user input. Unauthenticated attackers with access to the API interface can exploit these vulnerabilities to upload and execute arbitrary files...

[SECURITY] Fedora 41 Update: transfig-3.2.9a^20250619.ee3f4d8-1.fc41

The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...

[SECURITY] Fedora 42 Update: transfig-3.2.9a^20250619.ee3f4d8-2.fc42

The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Install transfig...

Cisco ISE and ISE-PIC Injection Vulnerabilities (CNVD-2025-17186)

Cisco ISE and Cisco ISE-PIC are both products of the U.S. Cisco Cisco.Cisco ISE is the identity services engine introduced by Cisco, mainly used for network access control and security management.Cisco ISE-PIC is the passive identity connector of the Cisco Identity Services Engine, which is mainl...

CVE-2025-20283: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials coul...

CVE-2025-20337: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to...

Cisco ISE和Cisco ISE-PIC 注入漏洞

Cisco ISE and Cisco ISE-PIC are both products of Cisco, Inc.Cisco ISE is a NAC solution. It is used to manage access to network resources by endpoints, users, and devices in a zero-trust architecture.Cisco ISE-PIC is a component ... An injection vulnerability exists in Cisco ISE and Cisco ISE-PIC...

CVE-2025-20285: Authentication Bypass by Assumed-Immutable Data

A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address. This vulnerability is due to improper enforcement of access controls...

CVE-2025-20284: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system as root. This vulnerability is due to insufficient validation of user-supplied input. An attacker with valid credentials coul...

VulnCheck KEV: CVE-2025-20281

Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an...

Pre-School Enrollment System Project update-teacher-pic.php File Directory Traversal Vulnerability

The Pre-School Enrollment System Project is a preschool enrollment system project. A directory traversal vulnerability exists in Pre-School Enrollment System Project, which stems from a lack of validity checking of paths in the file update-teacher-pic.php when processing directory requests, and c...