Liferay Portal and Liferay DXP have cross-site scripting vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2025-43770: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

Linux Distros Unpatched Vulnerability : CVE-2017-15393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debuggi...

CVE-2025-8813

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attac...

K000152958: Curl vulnerability CVE-2021-22876

Security Advisory Description curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the...

CVE-2025-8813

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attac...

CVE-2025-8813

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attac...

CVE-2025-8813 atjiu pybbs IndexController.java changeLanguage redirect

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attac...

CVE-2025-8813

CVE-2025-8813 affects atjiu pybbs up to 6.0.0. The vulnerability resides in the changeLanguage function of src/main/java/co/yiiu/pybbs/controller/front/IndexController.java, where manipulation of the referer argument leads to an open redirect. It can be triggered remotely and the exploit has been...

CVE-2025-8813: URL Redirection to Untrusted Site

A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attac...

PT-2025-32488 · Unknown · Atjiu Pybbs

Name of the Vulnerable Software and Affected Versions: atjiu pybbs versions up to 6.0.0 Description: A vulnerability exists in atjiu pybbs versions up to 6.0.0 related to an open redirect. The issue is located in the changeLanguage function within the file...

PyBBS input validation error vulnerability

pybbs is a community platform for Java development by iuiu individual developers. An input validation error vulnerability exists in pybbs 6.0.0 and earlier versions, which originates from the function changeLanguage parameter referer in the file...

CVE-2025-54783

CVE-2025-54783 affects SuiteCRM up to version 7.14.6, with a reflected XSS vulnerability triggered by modifying the HTTP Referer header to inject JavaScript. The server may block the domain but still execute the injected script. Remediation is to upgrade to SuiteCRM 7.14.7 or later. No exploitati...

CVE-2025-54783 SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to inclu...

SuiteCRM cross-site scripting vulnerability

SuiteCRM is a customer relationship management system from the SuiteCRM team. A cross-site scripting vulnerability exists in SuiteCRM 7.14.6 and earlier versions, which stems from a modification to the HTTP Referer header that could lead to a reflected cross-site scripting attack...

CVE-2025-54783: Improper Neutralization of Input During Web Page Generation

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to inclu...

The Bug Report - July 2025 Edition

The Bug Report – July 2025 Edition By Jonathan Omakun and Tola Olawale · August 6, 2025 Why am I here? July usually means barbecues, fireworks and pool parties—but this year, it brought something far more explosive: unauthenticated remote code execution, deserialization chaos, and an old-school...

CVE-2025-50578: Improper Input Validation

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading...

📄 SeoToaster 2.5.0 Open Redirection

SeoToaster version 2.5.0 suffers from an open redirection vulnerability. Exploit Title: Open Redirect "Login Page" Functionality - seotoasterv2.5.0 Date: 07/2025 Exploit Author: Andrey Stoykov Version: 2.5.0 Tested on: Debian 12 Blog: https://msecureltd.blogspot.com/ Open Redirect "Login Page"...

CVE-2025-34114

A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Referrer-Policy, Permissions-Policy,...