AgentScope 安全漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. AgentScope has a security vulnerability that stems from the existence of path traversal in the save-workflow and load-workflow functions, which allows an attacker to read and write...

Online Class and Exam Scheduling System exam_save.php File SQL Injection Vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. The Online Class and Exam Scheduling System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameters member and first of...

Sytel Softdial Contact Center（Sytel SCC） 跨站脚本漏洞

Sytel Softdial Contact Center Sytel SCC is a cloud contact center software from Sytel. A cross-site scripting vulnerability exists in Sytel Softdial Contact Center Sytel SCC, which originates from /softdial/scheduler/save.php resource-storage-based cross-site scripting that could lead to...

Xinhu RockOA 安全漏洞

Xinhu RockOA is an office OA system of China Xinhu Xinhu Company. A security vulnerability exists in Xinhu RockOA 2.6.5 and earlier versions, which originates from the inputAction.php file and the saveAjax function that allows SQL injection, which may result in the execution of arbitrary code...

CVE-2025-29425

Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in examsave.php via the parameters member and first...

CVE-2025-2352

A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/indexConfigs/save of the component Backend. The manipulation of the argument categoryName leads to cross site scripting. The attack may...

CVE-2025-2352

A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/indexConfigs/save of the component Backend. The manipulation of the argument categoryName leads to cross site scripting. The attack may...

CVE-2025-2340 otale Tale Blog Site Settings save saveOptions cross site scripting

A vulnerability was found in otale Tale Blog 2.0.5. It has been declared as problematic. This vulnerability affects the function saveOptions of the file /options/save of the component Site Settings. The manipulation of the argument Site Title leads to cross site scripting. The attack can be...

PT-2025-11445

Name of the Vulnerable Software and Affected Versions: StarSea99 starsea-mall version 1.0 Description: A problematic issue has been found in the Backend component, affecting the processing of the file "/admin/indexConfigs/save". The manipulation of the categoryName argument leads to cross-site...

PT-2025-11237

Name of the Vulnerable Software and Affected Versions: The Resido - Real Estate WordPress Theme versions up to, and including, 3.6 Description: The issue is related to unauthorized access due to a missing capability check on the delete api key and save api key AJAX actions. This allows...

CVE-2025-29363

Tenda RX3 USRX3V1.0brV16.03.13.11multiTDE01 is vulnerable to buffer overflow via the schedStartTime and schedEndTime parameters at /goform/saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted packet...

UBUNTU-CVE-2025-21849

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Use spinlockirqsave in interruptible context spinlock/unlock functions used in interrupt contexts could result in a deadlock, as seen in GitLab issue 13399, which occurs when interrupt comes in while holding a lock...

CVE-2025-21849

CVE-2025-21849: Linux kernel drm/i915/gt had potential deadlocks due to spin_lock/unlock() used in interrupt contexts. The fix saves irq state before acquiring locks. Version history shows v2 adds irq state save/restore around signal_irq_work locks; v3 uses spin_lock_irqsave() in guc_lrc_desc_unp...

CVE-2025-1926

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayersavepost function. This makes it possible for...

[SECURITY] Fedora 41 Update: buildah-1.39.2-1.fc41

The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...

tianti 跨站请求伪造漏洞

tianti tianti is a JAVA lightweight CMS solution by jeffry personal developer. A security vulnerability exists in tianti v2.3, which stems from a cross-site request forgery vulnerability in the /user/ajax/save component that could lead to the execution of arbitrary operations...

WordPress plugin Page Builder: Pagelayer 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress plugin Page Builder: A...

CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

PT-2025-10639

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue allows attackers to execute arbitrary operations via a crafted GET or POST request to the /user/ajax/save API endpoint. This is due to a Cross-Site Request Forgery CSRF vulnerability. Recommendations Fo...

CVE-2025-25908: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...