CVE-2025-65300

CVE-2025-65300 説明 CVE-2025-65300: Coohom SaaSプラットフォームにおける保存型クロスサイトスクリプティング（XSS）の脆弱性 公開日: 2025-10-28 最終更新: 2025-10-28 報告者: Phisit Pupiw ベンダー: Coohom CWE: CWE-79 – クロスサイトスクリプティング 概要 保存型クロスサイトスクリプティング（XSS）の脆弱性が、Coohom SaaSプラットフォームのAccount Settings → Profile →...

prey-android-client

在这里，你将找到适用于 Android 设备的 Prey 客户端当前版本及开发中版本的所有源代码。 Prey 是一个用于设备追踪、监控、数据保护和设备管理的 SaaS 平台。其开源代理程序运行在终端设备上，并连接到集中式控制面板，使组织能够定位设备、执行安全策略、保护敏感数据，并远程管理其整个设备群。 功能 通过 GPS 地理定位，在地图上找到您的手机或平板电脑。 使用内置的前后摄像头拍照。 即使您的手机处于静音状态，也能远程触发响亮的警报。 在屏幕上显示定制的警报消息。 系统要求 Android Studio Ladybug 或更高版本 JDK 17 Gradle 8.7 Androi...

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments,...

CVE-2026-53469 Migration-planner: unprotected delete endpoint wipes all tenant data

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments,...

CVE-2026-53469 Migration-planner: unprotected delete endpoint wipes all tenant data

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments,...

Infosoftbd Clcknshop Cross-Site Scripting Vulnerability

Infosoftbd Clcknshop is a multi-tenant/multi-tenant SAAS based e-commerce platform from Infosoftbd. A cross-site scripting vulnerability exists in Infosoftbd Clcknshop that stems from the fact that incorrect manipulation of the parameter q can lead to cross-site scripting...

ERPGo SaaS 3.9 - CSV Injection Vulnerability

Exploit Title: ERPGo SaaS 3.9 - CSV Injection Exploit Author: Sajibe Kanti Vendor Name: RajodiyaInfotech Vendor Homepage: https://rajodiya.com/ Software Link: https://codecanyon.net/item/erpgo-saas-all-in-one-business-erp-with-project-account-hrm-crm-pos/33263426 Version: 3.9 Tested on: Windows &...

Serious vulnerabilities found in ITarian software, patches available for SaaS products

Dutch research group DIVD has identified multiple vulnerabilities in ITarian products. In cooperation with DIVD, ITarian has made patches available to deal with these vulnerabilities for its SaaS platform. Software as a service SaaS is a software distribution model in which a cloud provider hosts...

CVE-2021-42951

A Remote Code Execution RCE vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new, specially crafted Algorithm...

Shopmetrics Mystery Shopping Software Broken Access Control / XSS Vulnerability

======================================================================= title: Broken access control & Cross-Site Scripting product: Shopmetrics Mystery Shopping Software vulnerable version: SaaS platform before v21-11 fixed version: SaaS platform v21-11 CVE number: n/a for SaaS impact: Critical...

Oracle WebLogic Detection and Mitigation

We review 2020 and 2021 Oracle WebLogic vulnerabilities and how using a unified SaaS platform can help you detect and mitigate these sophisticated risks...

Denial of Service in chatwoot/chatwoot

The extractreply function https://github.com/chatwoot/chatwoot/blob/a0ffefad717b632269883863c27242bb97d3b66d/app/presenters/mailpresenter.rbL105 is highly inefficient on HTML emails. A legitimate LinkedIn email has 20kb of HTML content which takes a minute or two to process through that function,...

What’s Next for T-Mobile and Its Customers? – Podcast

What’s the opposite of a resilient operation? It’s when your wireless carrier gets breached for the sixth time in a few years, you try to change your PIN online, and the site tells you “No can do.” As of Wednesday, T-Mobile had confirmed its sixth breach over the last three years. The purported...

Salesforce Release Updates — A Cautionary Tale for Security Teams

On the surface, Salesforce seems like a classic Software-as-a-Service SaaS platform. Someone might even argue that Salesforce invented the SaaS market. However, the more people work with the full offering of Salesforce, the more they realize that it goes beyond a traditional SaaS platform's...

Five Cloud Migration Strategies for Applications

Regardless of your current IT environment or your vision for migrating to the cloud, numerous strategies exist that can accommodate your cloud-migration approach. Fortunately, this range of options allows you to proceed with caution while making progress toward your ultimate objective. Always kee...

Docebo LMS v6.9 - (Localization) Persistent Vulnerability

Document Title: =============== Docebo LMS v6.9 - Localization Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1880 Release Date: ============= 2016-12-21 Vulnerability Laboratory ID VL-ID: ==================================== 18...