CVE-2025-43744

A stored DOM-based Cross-Site Scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and...

CVE-2025-43744

A stored, DOM-based XSS in Liferay Portal 7.4.0–7.4.3.132 and Liferay DXP 2024–2025 (various Qx updates) via the Asset Publisher UI in Source.js, allowing JavaScript injection through DDM structure field labels inserted into the DOM via innerHTML without proper encoding. Impact is client-side XSS...

CVE-2025-43744

A stored DOM-based Cross-Site Scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and...

CVE-2025-43744

A stored DOM-based Cross-Site Scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and...

CVE-2025-9144

A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisheredit.shtm. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be...

CVE-2025-9144 Scada-LTS publisher_edit.shtm cross site scripting

A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisheredit.shtm. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be...

CVE-2025-9144

CVE-2025-9144 affects Scada-LTS 2.7.8.1, where manipulation of the Name argument in the file publisher_edit.shtm triggers cross-site scripting. The issue is exploitable remotely and public PoCs/exploits are available. Connected sources consistently identify an unknown code path in publisher_edit....

CVE-2025-9144 Scada-LTS publisher_edit.shtm cross site scripting

A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisheredit.shtm. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be...

CVE-2025-9144 Scada-LTS publisher_edit.shtm cross site scripting

A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisheredit.shtm. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be...

PT-2025-33742 · Scada-Lts · Scada-Lts

Name of the Vulnerable Software and Affected Versions: Scada-LTS version 2.7.8.1 Description: A weakness exists in Scada-LTS 2.7.8.1 related to the manipulation of the Name argument in the publisher edit.shtm file, leading to cross-site scripting. The attack can be initiated remotely, and the...

PT-2025-33857 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2024.Q1.1 through 2024.Q1.19 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q4.0 through...

Scada-LTS 代码注入漏洞

Scada-LTS is an open source, web-based, multi-platform solution from Scada-LTS Open Source. A code injection vulnerability exists in Scada-LTS version 2.7.8.1, which stems from a cross-site scripting attack due to incorrect manipulation of the parameter Name in the file publisheredit.shtm...

Malicious code in node-heatpipe-publisher (npm)

The package node-heatpipe-publisher was found to contain malicious code...

MAL-2025-31792 Malicious code in react-google-publisher-tag-v15 (npm)

The package react-google-publisher-tag-v15 was found to contain malicious code...

Malicious code in react-google-publisher-tag-v15 (npm)

The package react-google-publisher-tag-v15 was found to contain malicious code...

MAL-2025-8245 Malicious code in @landmineaknpm2/delectus-quibusdam-consequuntur (npm)

The package @landmineaknpm2/delectus-quibusdam-consequuntur was found to contain malicious code...

MAL-2025-27625 Malicious code in node-heatpipe-publisher (npm)

The package node-heatpipe-publisher was found to contain malicious code...

The vulnerability of the Web Server component of the Oracle BI Publisher software, which is used for creating reports, allows a malicious individual to gain access to read, modify, add, or delete data.

The vulnerability of the Web Server component of the Oracle BI Publisher software for creating reports is related to lack of access control measures. Exploiting this vulnerability could allow an attacker to gain read, modify, add, or delete access to data...

CVE-2025-50060

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Server. Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher...

Oracle Business Intelligence Publisher (OAS) (July 2025 CPU)

The 7.6.0.0.0, and 8.2.0.0.0 versions of Oracle Business Intelligence Publisher installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory. - Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API Apac...