CVE-2025-1746 Cross-Site Scripting vulnerability in OpenCart

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal...

PT-2025-9101 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the search in the "/product/search" endpoint. This could be exploited to steal...

51Job 安全漏洞

51Job is a job site from China's MileagePlus 51Job company. A security vulnerability exists in 51Job version 14.22.0, which originates from a specially crafted link that can access sensitive user information...

IKEA 信息泄露漏洞

IKEA is a well-known furniture retail brand from Sweden by the Dutch company IKEA. It offers a wide range of home products and food products to fulfill life's needs. A security vulnerability exists in IKEA version 4.13.0 that originates from a specially crafted link that can access sensitive user...

Boohee Health 安全漏洞

Boohee Health 薄荷健康 is a weight loss and fitness light fasting management software from the Chinese company Boohee. A security vulnerability exists in Boohee Health version 13.0.13, which originates from a specially crafted link that can access sensitive user information...

YuPao DirectHire 安全漏洞

YuPao DirectHire is a recruiting software from the Chinese company YuPao 鱼泡. A security vulnerability exists in YuPao DirectHire version 8.8.0, which originates from a specially crafted link that can access sensitive user information...

AiShanDong 安全漏洞

AiShanDong 爱山东 is an application mall system from the Chinese company AiShanDong 爱山东. A security vulnerability exists in AiShanDong version 5.0.0, which originates from a specially crafted link that can access sensitive user information...

Suning EMall 安全漏洞

Suning EMall is an integrated online shopping platform of China-based Suning Ebay Suning Inc. A security vulnerability exists in Suning EMall iOS version 9.5.198, which originates from a specially crafted link that can access sensitive user information...

MUCFC Merchants Union Finance 安全漏洞

MUCFC Merchants Union Finance MUCFC is a credit loan installment borrowing platform from China Merchants Union MUCFC Corporation. A security vulnerability exists in MUCFC Merchants Union Finance iOS version 6.19.0, which originates from a specially crafted link that can access sensitive user...

MSC-2025-2093

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Suspect publisher – this publisher has a history ...

WordPress plugin Registration Forms 日志信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A log information disclosure...

MSC-2025-1890

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive private user information –...

CVE-2025-22961

A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access Control CWE-284. Unauthenticated attackers can directly access sensitive database backup files snapshotusers.db via publicly exposed URLs...

CVE-2022-46163

Travel support program is a rails app to support the travel support program of openSUSE TSP. Sensitive user data bank account details, password Hash can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The...

Google Bans 158,000 Malicious Android App Developer Accounts in 2024

Google said it blocked over 2.36 million policy-violating Android apps from being published to the Google Play app marketplace in 2024 and banned more than 158,000 bad developer accounts that attempted to publish such harmful apps. The tech giant also noted it prevented 1.3 million apps from...

CVE-2025-24109

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to access sensitive user data...

CVE-2025-24109

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access sensitive user data...

CVE-2025-24109

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access sensitive user data...

CVE-2025-24109

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access sensitive user data...

PT-2025-3363 · Tencent · Wesing

Name of the Vulnerable Software and Affected Versions: Tencent Technology Shanghai Co., Ltd WeSing iOS version 9.3.39 Description: An issue in WeSing iOS allows attackers to access sensitive user information via supplying a crafted link. Recommendations: For version 9.3.39, avoid using links from...