CVE-2025-63690

pig-mesh Pig versions 3.8.2 and below are vulnerable to remote code execution (RCE) . The flaw exists in the Quartz management function within the system management module, where an attacker can execute arbitrary Java classes with parameterless constructors and methods accepting a String paramete...

CVE-2025-63690: Use of Externally-Controlled Input to Select Classes or Code

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, th...

PT-2025-45450

Name of the Vulnerable Software and Affected Versions pig-mesh versions 3.8.2 and below Description The software contains a flaw that allows for remote code execution. Specifically, when configuring scheduled tasks within the Quartz management function, located in the system management module, it...

CVE-2025-63690

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, th...

pig 安全漏洞

pig is a privilege management system for pig-mesh open source. A security vulnerability exists in pig 3.8.2 and earlier versions, which originates in the Quartz management feature that can execute arbitrary Java classes via reflection, potentially leading to remote code execution...

EUVD-2025-38066

A reflected XSS vulnerability exists in CMSimpleXH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML navigation links, breadcrumbs, search form action, footer links. An attacker-controlled string placed in the...

CVE-2025-63589

A reflected Cross-Site Scripting (XSS) vulnerability exists in CMSimple_XH version 1.8 within the index.php router. The root cause is the failure to sanitize or encode attacker-controlled path segments before they are inserted into generated HTML elements, including navigation links, breadcrumbs,...

CVE-2025-63589

A reflected XSS vulnerability exists in CMSimpleXH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML navigation links, breadcrumbs, search form action, footer links. An attacker-controlled string placed in the...

WordPress plugin Penci Bookmark & Follow 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2025-5770

A reflected cross-site scripting XSS vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling...

CVE-2025-5770

A reflected cross-site scripting XSS vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling...

EUVD-2025-36631

Cross-Site Request Forgery CSRF vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS.This issue affects hpb seo plugin for WordPress: from n/a through = 3.0.1...

CVE-2025-62523

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing CORS misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper...

CVE-2025-62523

PLOS (PILOS) before 4.8.0 contains a CORS misconfiguration in middleware: it reflects the Origin header in Access-Control-Allow-Origin with credentials allowed, potentially enabling cross-origin requests with user credentials. Laravel’s session handling adds origin checks that prevent cross-origi...

CVE-2025-62523 PILOS Misconfigured the Access-Control-Allow-Origin Header

PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing CORS misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper...

EUVD-2025-35829

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery SSRF. Additionally, the...

CVE-2025-58971

CVE-2025-58971 describes a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress Doctreat theme, affected versions

CVE-2025-61456

A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce v1.0 within the index.php endpoint. The root cause is the failure to sanitize the URL path parameter before reflecting it into the HTML response, specifically via the /index parameter. Attackers can inject JavaScript pa...

E-commerce 安全漏洞

E-commerce is a dynamic e-commerce website by the individual developer Bhabishya Ghimire. A security vulnerability exists in E-commerce version 1.0, which stems from the /search parameter not clearing the input to be reflected directly back to the response HTML, which could lead to a cross-site...

CVE-2025-61454

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce v1.0 within the search.php endpoint. The root cause is the failure to sanitize the search parameter from POST data before reflecting it back into the response HTML. An attacker can craft a request containing m...