CVE-2025-10827 PHPJabbers Restaurant Menu Maker preview.php cross site scripting

A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. This manipulation of the argument theme causes cross site scripting. The attack may be initiated remotely. The exploit has been made availab...

CVE-2025-10827 PHPJabbers Restaurant Menu Maker preview.php cross site scripting

A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. This manipulation of the argument theme causes cross site scripting. The attack may be initiated remotely. The exploit has been made availab...

PT-2025-39095

Name of the Vulnerable Software and Affected Versions PHPJabbers Restaurant Menu Maker versions up to 1.1 Description A cross-site scripting issue exists in PHPJabbers Restaurant Menu Maker. The issue is related to the /preview.php file and manipulation of the theme parameter. This manipulation c...

PHPJABBERS Restaurant Menu Maker Project 代码注入漏洞

PHPJABBERS Restaurant Menu Maker Project is a PHPJABBERS open source menu maker project. A code injection vulnerability exists in PHPJABBERS Restaurant Menu Maker Project 1.1 and earlier versions, which stems from incorrect manipulation of the parameter theme in the file /preview.php, and could...

CVE-2025-58766

Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to execute arbitrary code on users' systems. The vulnerability affects the application's preview window functionality and can bypass Docker...

CVE-2025-58766

Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to execute arbitrary code on users' systems. The vulnerability affects the application's preview window functionality and can bypass Docker...

CVE-2025-58766 Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window

Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to execute arbitrary code on users' systems. The vulnerability affects the application's preview window functionality and can bypass Docker...

CVE-2025-58766

Dyad CVE-2025-58766 affects Dyad

CVE-2025-58766 Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window

Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to execute arbitrary code on users' systems. The vulnerability affects the application's preview window functionality and can bypass Docker...

CVE-2025-58766 Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window

Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to execute arbitrary code on users' systems. The vulnerability affects the application's preview window functionality and can bypass Docker...

Introducing Wiz Incident Response: Your Expert Partner for Cloud Security Incidents

Announcing the public preview of Wiz’s in-house Incident Response service—empowering customers to investigate, contain, and resolve cyber incidents with confidence...

PT-2025-38242

Name of the Vulnerable Software and Affected Versions: Dyad versions prior to 0.20.0 Description: Dyad is a local AI app builder susceptible to arbitrary code execution on users' systems. The issue affects the application’s preview window functionality and can bypass Docker container protections...

Dyad 代码注入漏洞

Dyad is an AI application builder open-sourced by Dyad. A code injection vulnerability exists in Dyad 0.19.0 and earlier versions, which stems from the Preview Window feature that can bypass Docker container protection and could lead to the execution of arbitrary code...

CVE-2025-9078 Weak cache keys lead to post IDOR and link preview poisoning

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.10.x = 10.10.1, 10.9.x = 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing...

CVE-2025-9078 Weak cache keys lead to post IDOR and link preview poisoning

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.10.x = 10.10.1, 10.9.x = 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing...

CVE-2025-57520

A Cross Site Scripting XSS vulnerability exists in Decap CMS thru 3.8.3. Input fields such as body, tags, title, and description are not properly sanitized before being rendered in the content preview pane. This enables an attacker to inject arbitrary JavaScript which executes whenever a user vie...

CVE-2025-58752

A path traversal / static-file serving bypass vulnerability has been identified in Vite’s static file server, where HTML files located outside the configured root or deny/allow lists may be served even when server.fs settings such as deny are used. An attacker can exploit this by requesting HTML...

Cross-site Scripting (XSS)

Overview decap-cms is an An extensible, open source, Git-based, React CMS for static sites. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of input fields such as body, tags, title, and description in the content preview pane. An attacker...

GHSA-XP8G-32QH-MV28 Decap CMS Cross Site Scripting (XSS) vulnerability

Decap CMS through 3.8.3 is vulnerable to stored Cross-Site Scripting XSS in the admin preview pane. User-controlled fields e.g., title, description, tags, and body are rendered in the preview without sufficient sanitization/escaping. An attacker with low-privilege author/contributor access can...

Decap CMS Cross Site Scripting (XSS) vulnerability

Decap CMS through 3.8.3 is vulnerable to stored Cross-Site Scripting XSS in the admin preview pane. User-controlled fields e.g., title, description, tags, and body are rendered in the preview without sufficient sanitization/escaping. An attacker with low-privilege author/contributor access can...