CVE-2025-58485

Samsung Internet prior to 29.0.0.48 is affected by an input validation issue that allows local attackers to inject arbitrary script. The root cause is improper input validation in the browser component, enabling local exploitation without network access. Impact is confined to local attack vectors...

EUVD-2025-200133

Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script...

CVE-2025-58485

Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script...

EUVD-2025-200102

Grav Admin Plugin vulnerable to Cross-Site Scripting XSS Stored endpoint /admin/config/site parameter datataxonomies...

CVE-2025-61229

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

PT-2025-48604

Name of the Vulnerable Software and Affected Versions Samsung Account versions prior to 15.5.01.1 Description A flaw exists in Samsung Account due to improper input validation. This allows a local attacker to execute arbitrary script. Recommendations Update Samsung Account to version 15.5.01.1 or...

PT-2025-48751

Name of the Vulnerable Software and Affected Versions Lookyloo versions prior to 1.35.3 Description Lookyloo is a web interface used to capture website pages and display a tree of domains that interact with each other. Prior to version 1.35.3, multiple Cross-Site Scripting XSS issues exist due to...

CVE-2025-65858

A Stored Cross-Site Scripting XSS vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed...

PT-2025-48603

Name of the Vulnerable Software and Affected Versions Samsung Internet versions prior to 29.0.0.48 Description Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script. This allows for the execution of malicious code within the...

SAMSUNG Internet 安全漏洞

SAMSUNG Internet is a cell phone application from the South Korean company Samsung SAMSUNG. It provides a browser function. A security vulnerability exists in SAMSUNG Internet versions prior to 29.0.0.48, which stems from improper input validation and could allow a local attacker to inject...

PT-2025-48640

The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2025-48743

Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting XSS in /classes/Login.php...

CVE-2025-65186

Grav CMS 1.7.49 is vulnerable to Cross Site Scripting XSS. The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface...

PT-2025-48754

Name of the Vulnerable Software and Affected Versions Aimeos GrapesJS CMS extension versions prior to 2021.10.8 Aimeos GrapesJS CMS extension versions prior to 2022.10.8 Aimeos GrapesJS CMS extension versions prior to 2023.10.8 Aimeos GrapesJS CMS extension versions prior to 2024.10.8 Aimeos...

CVE-2025-60736

CVE-2025-60736 affects Code Projects’ Online Medicine Guide 1.0. The vulnerability is an SQL Injection in /login.php via the upass parameter caused by direct string concatenation of user input into queries. The incident is rated CRITICAL (CVSS 3.1: 9.8) with network access, low attack complexity,...

CVE-2025-65187

CVE-2025-65187 describes a Stored XSS in CiviCRM prior to v6.7, specifically in the Accounting Batches field. An authenticated user can inject JavaScript into that field, which executes when the page is viewed. The vulnerability is documented across multiple feeds (NVD/Red Hat/Nessus/EUVD/OSV/Ubu...

CVE-2025-66310

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...

Malicious code in python-doenv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 79b018c186e337070650421bdaa82bd65d50d3cd29ebd457349059e7bb5ddc46 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

EUVD-2025-200025

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls...

CVE-2025-61757: Imperva Customers Protected Against Critical Oracle Identity Manager Authentication Bypass Leading to Remote Code Execution

At the end of October 2025, Oracle released an emergency security alert addressing CVE-2025-61757, a high-severity authentication-bypass flaw that enables remote code execution in the Identity Manager product of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. Multiple threat actors a...