PT-2025-12433 · Horde +1 · Horde Imp +2

Name of the Vulnerable Software and Affected Versions: Horde IMP versions prior to 6.2.27 Horde Application Framework versions prior to 5.2.23 Description: A Cross-Site Scripting XSS vulnerability was discovered in Horde IMP, allowing an attacker to hijack a user session by sending a crafted e-ma...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS via the chat file upload functionality. An attacker can inject malicious scripts or content into a file, which, when accessed by a victim through a URL or shared chat, executes...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview flarum/core is a simple discussion platform for your website. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via authoritative subdomain cookie overwrite. An attacker controlling a...

Flarum 注入漏洞

Flarum is a simple forum software for building communities from Flarum open source. An injection vulnerability exists in Flarum versions prior to 1.8.10, which stems from an attacker-controlled subdomain being able to set a parent domain's cookie, leading to session hijacking...

Cisco TelePresence Management Suite 跨站脚本漏洞

Cisco TelePresence Management Suite is a video server management program developed by Cisco. Cisco TelePresence Management Suite suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject malicious script or HTML code, which can be used to obtain sensitive...

GHSA-HJPM-7MRM-26W8 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Summary The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs e.g., https://evil.com, it incorrectly allows...

S3Proxy 跨站脚本漏洞

S3Proxy is an S3 API from the individual developer Andrew Gaul. A cross-site scripting vulnerability exists in S3Proxy, which stems from the presence of a reflective cross-site scripting vulnerability that can lead to malicious URL injection scripts hijacking sessions...

ChurchCRM 安全漏洞

ChurchCRM is ChurchCRM open source an open source CRM system for churches. ChurchCRM suffers from an input validation error vulnerability that stems from not properly validating input. An attacker can exploit this vulnerability to hijack a user session...

CVE-2025-24438

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed...

CVE-2025-24417

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed...

CVE-2025-24410

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed...

CVE-2025-24412

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the article name field in plugins/content/pages/content.php, accessible over the content/edit endpoint. An attacker can steal cookies and perform session hijacking by injecting malicious scripts. Details...

CVE-2021-22783

A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door. Affected Product: Ritto Wiser Door All versions...

CVE-2022-26647

A vulnerability has been identified in SCALANCE X200-4P IRT All versions V5.5.2, SCALANCE X201-3P IRT All versions V5.5.2, SCALANCE X201-3P IRT PRO All versions V5.5.2, SCALANCE X202-2IRT All versions V5.5.2, SCALANCE X202-2IRT All versions V5.5.2, SCALANCE X202-2P IRT All versions V5.5.2, SCALAN...

HCL iAutomate 安全漏洞

HCL iAutomate is a powerful and intelligent runbook automation product from HCL Corporation, USA. A security vulnerability exists in HCL iAutomate. An attacker exploiting this vulnerability could hijack the victim's session ID from an authenticated session...

CVE-2024-22245

Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in EAP could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary...

CVE-2024-22250

Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system...

PT-2025-5375 · Symantec · Symantec Privileged Access Management

Name of the Vulnerable Software and Affected Versions: Symantec Privileged Access Management versions prior to 4.2.1 Description: A malicious actor can fix the session of a Symantec Privileged Access Management user by tricking the user into clicking a specially crafted link to the PAM server. Th...

SUSE CVE-2025-24390

A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023.X OTRS 2024.X...