14163 matches found
CVE-2025-6925 Dromara RuoYi-Vue-Plus Mail MailController.java path traversal
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath...
CVE-2025-6925
The CVE-2025-6925 entry affects Dromara RuoYi-Vue-Plus 5.4.0. The Mail Handler’s MailController.java exposes a vulnerability via manipulation of the filePath argument, causing path traversal. The issue is exploitable remotely and has publicly disclosed proof-of-concept information; vendor respons...
CVE-2025-6925
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath...
CVE-2025-6899
A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file mspinfo.htm. The manipulation of the argument flag/cmd/iface leads to os command injection. It is possible to initiate the attack remotely...
RuoYi-Vue-Plus security vulnerabilities
RuoYi-Vue-Plus is a development framework from the Chinese organization dromara. A security vulnerability exists in RuoYi-Vue-Plus version 5.4.0, which stems from an incorrect manipulation of the parameter filePath in the file MailController.java, resulting in path traversal...
PT-2025-27469 · Dromara · Dromara Ruoyi-Vue-Plus
Name of the Vulnerable Software and Affected Versions: Dromara RuoYi-Vue-Plus version 5.4.0 Description: A critical issue has been discovered, affecting an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The...
CVE-2025-6925: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath...
Malicious code in typing-extensions-plus (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 78c15498f688e49c1d6a8b369eae95e0e77016cd05d74f89a72fa9e845c71da5 Importing the module starts code responsible of exfiltrating crypto tokens and API keys. Package imitates typing-extensions --- Category: MALICIOUS - The...
MAL-2025-191914 Malicious code in typing-extensions-plus (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 78c15498f688e49c1d6a8b369eae95e0e77016cd05d74f89a72fa9e845c71da5 Importing the module starts code responsible of exfiltrating crypto tokens and API keys. Package imitates typing-extensions --- Category: MALICIOUS - The...
CVE-2025-5966
Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report...
CVE-2025-5366
Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report...
PT-2025-27206 · Unknown · Gopi Plus Image Slider With Description
Name of the Vulnerable Software and Affected Versions: gopi plus Image Slider With Description versions n/a through 9.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions n/a through 9.2, update to a version that include...
Security Bulletin: IBM App Connect Enterprise is vulnerable to Remote Code Execution and improper preservation of permissions due to jsonpath-plus & snowflake-sdk (CVE-2025-1302 & CVE-2025-24791)
Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Remote Code Execution RCE and improper preservation of permissions due to jsonpath-plus & snowflake-sdk. Vulnerabilit...
CVE-2025-5966
Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report...
CVE-2025-5366
Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report...
CVE-2025-5966 Stored XSS
Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report...
CVE-2025-5966 Stored XSS
Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report...
CVE-2025-5366
CVE-2025-5366 affects Zohocorp ManageEngine Exchange Reporter Plus 5722 and earlier. The flaw is a Stored XSS in the Folder-wise read mails feature (subject is report). The CVSSv3.1 base score is 8.1 (HIGH); attack vector NETWORK, attack complexity LOW, privileges None, user interaction REQUIRED,...
