CVE-2025-54800 Hydra persistent XSS in build metrics

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

CVE-2025-8809

A vulnerability classified as critical has been found in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /addelidetails.php. The manipulation of the argument del leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclos...

CVE-2025-40759

CVE-2025-40759 affects a broad set of Siemens products (e.g., SIMATIC STEP 7, SIMATIC S7-PLCSIM, WinCC, SIMOCODE ES, SINAMICS Startdrive, SIRIUS Safety ES, TIA Portal Cloud, SIMOTION SCOUT, etc.). The vulnerability arises from improper sanitization of stored security properties when parsing proje...

CVE-2025-8791

A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/listprojects. The manipulation of the argument role leads to improper authorization. The attack may be initiated remotely. The exploit has been...

PT-2025-32681 · Hydra · Hydra

Name of the Vulnerable Software and Affected Versions: Hydra versions prior to commit dea1e16 Description: Hydra, a continuous integration service for Nix based projects, is susceptible to arbitrary JavaScript code injection into its database. A malicious package can introduce this code, which is...

CVE-2025-8859 code-projects eBlog Site File Upload save-slider.php unrestricted upload

A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit...

CVE-2025-8859

CVE-2025-8859 affects code-projects’ eBlog Site 1.0, specifically the File Upload Module function in the file /native/admin/save-slider.php. The vulnerability involves unrestricted file upload, reported as exploitable remotely. Public disclosure exists, and multiple sources reinforce that an atta...

CVE-2025-8859 code-projects eBlog Site File Upload save-slider.php unrestricted upload

A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit...

Code-Projects eBlog Site 代码问题漏洞

Code-Projects eBlog Site is an open source blog site by Code-Projects. A code issue vulnerability exists in code-projects eBlog Site version 1.0, which stems from an unrestricted upload function in file /native/admin/save-slider.php...

CVE-2025-8811 code-projects Simple Art Gallery registration.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Simple Art Gallery 1.0. Affected by this issue is some unknown functionality of the file /Admin/registration.php. The manipulation of the argument fname leads to sql injection. The attack may be launched remotely...

CVE-2025-8811 code-projects Simple Art Gallery registration.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Simple Art Gallery 1.0. Affected by this issue is some unknown functionality of the file /Admin/registration.php. The manipulation of the argument fname leads to sql injection. The attack may be launched remotely...

CVE-2025-8809 code-projects Online Medicine Guide addelidetails.php sql injection

A vulnerability classified as critical has been found in code-projects Online Medicine Guide 1.0. Affected is an unknown function of the file /addelidetails.php. The manipulation of the argument del leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclos...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization over the /auth/listprojects endpoint. A user can perform unauthorized actions beyond their intended permissions by changing the role argument from Viewer to Owner. Remediation There is no fixed version for...

CVE-2025-8791

A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/listprojects. The manipulation of the argument role leads to improper authorization. The attack may be initiated remotely. The exploit has been...

CVE-2025-8791

A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/listprojects. The manipulation of the argument role leads to improper authorization. The attack may be initiated remotely. The exploit has been...

CVE-2025-8791 LitmusChaos Litmus list_projects improper authorization

A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/listprojects. The manipulation of the argument role leads to improper authorization. The attack may be initiated remotely. The exploit has been...

CVE-2025-8791

CVE-2025-8791 affects LitmusChaos up to version 3.19.0. The vulnerability is an improper authorization flaw in the /auth/list_projects endpoint caused by manipulating the role parameter, enabling remote, unauthenticated-like actions with low privileges. Exploitation is possible and the exploit ha...

CVE-2025-8791 LitmusChaos Litmus list_projects improper authorization

A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/listprojects. The manipulation of the argument role leads to improper authorization. The attack may be initiated remotely. The exploit has been...

PT-2025-32465 · Unknown · Litmuschaos

Name of the Vulnerable Software and Affected Versions: LitmusChaos versions prior to 3.19.0 Description: A critical issue exists in LitmusChaos related to improper authorization. The vulnerability stems from the manipulation of the role argument during the processing of the /auth/list projects AP...

LitmusChaos 安全漏洞

LitmusChaos is a program open-sourced by Litmus Chaos that practices chaos engineering in a cloud-native manner. A security vulnerability exists in LitmusChaos 3.19.0 and earlier versions, which stems from improper handling of the parameter roles in the file /auth/listprojects, which could lead t...