uri: userinfo leakage in URI#join, URI#merge and URI#+

A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URIjoin, URImerge, and URI+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using...

CVE-2025-28169

BYD QIN PLUS DM-i Dilink OS v3.013.1.7.2204050.1 to v3.013.1.7.2312290.10 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack...

CVE-2025-28169

BYD QIN PLUS DM-i Dilink OS v3.013.1.7.2204050.1 to v3.013.1.7.2312290.10 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack...

CVE-2025-28169: Improper Certificate Validation

BYD QIN PLUS DM-i Dilink OS v3.013.1.7.2204050.1 to v3.013.1.7.2312290.10 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack...

BYD QIN PLUS DM-i with Dilink OS has a security vulnerability

BYD QIN PLUS DM-i with Dilink OS is a plug-in hybrid electric sedan with Dilink OS from BYD China. A security vulnerability exists in BYD QIN PLUS DM-i with Dilink OS versions v3.013.1.7.2204050.1 through v3.013.1.7.2312290.10, which originates from an unencrypted send broadcast and could lead to...

PT-2025-17668 · Byd · Byd Qin Plus Dm-I Dilink Os

Name of the Vulnerable Software and Affected Versions: BYD QIN PLUS DM-i Dilink OS versions v3.0 13.1.7.2204050.1 through v3.0 13.1.7.2312290.1 0 Description: The issue allows attackers to execute a man-in-the-middle attack because the affected software sends broadcasts to the manufacturer's clou...

CVE-2025-28169

The BYD QIN PLUS DM-i vehicle, running Dilink OS versions v3.0_13.1.7.2204050.1 through v3.0_13.1.7.2312290.1_0 , is vulnerable to a man-in-the-middle attack. The root cause is that the software sends broadcasts to the manufacturer's cloud server unencrypted . This vulnerability is categorized un...

CVE-2025-3856

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3856

CVE-2025-3856 affects xxyopen Novel-Plus 5.1.0. The vulnerability is in the /book/searchByPage function, where the sort parameter is manipulated to trigger a SQL injection. It can be exploited remotely, and public disclosure exists. Connected documents consistently identify the vulnerable endpoin...

CVE-2025-3856 xxyopen Novel-Plus searchByPage sql injection

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3856 xxyopen Novel-Plus searchByPage sql injection

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3856 xxyopen Novel-Plus searchByPage sql injection

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3856: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been classified as critical. This affects the function searchByPage of the file /book/searchByPage. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2025-17478 · Unknown · Xxyopen Novel-Plus

Name of the Vulnerable Software and Affected Versions: xxyopen Novel-Plus version 5.1.0 Description: A critical issue affects the searchByPage function of the /book/searchByPage file. The manipulation of the sort argument leads to SQL injection. It is possible to initiate the attack remotely. The...

PT-2025-17532 · Pluggabl Llc · Booster Plus For Woocommerce

Name of the Vulnerable Software and Affected Versions: Booster Plus for WooCommerce versions through 7.2.4 Description: The issue affects the Booster Plus for WooCommerce plugin, allowing for Reflected XSS due to improper neutralization of input during web page generation. This can lead to...

Novel-Plus injection vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. An injection vulnerability exists in Novel-Plus version 5.1.0, which stems from the improper handling of the parameter sort by the function searchByPage in the file /book/searchByPage, resulting in SQL injection...

[SECURITY] Fedora 41 Update: rust-adblock-0.9.6-1.fc41

Native Rust module for Adblock Plus syntax e.g. EasyList, EasyPrivacy filter parsing and matching...

[SECURITY] Fedora 40 Update: rust-adblock-0.9.6-1.fc40

Native Rust module for Adblock Plus syntax e.g. EasyList, EasyPrivacy filter parsing and matching...

[SECURITY] Fedora 42 Update: rust-adblock-0.9.6-1.fc42

Native Rust module for Adblock Plus syntax e.g. EasyList, EasyPrivacy filter parsing and matching...

DEBIAN-CVE-2025-38152

In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear tablesz when rprocshutdown There is case as below could trigger kernel dump: Use U-Boot to start remote processorrproc with resource table published to a fixed address by rproc. After Kernel boots up, stop...