CVE-2018-13408

An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges...

CVE-2025-46550 Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the /?BazaR endpoint and idformulaire parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link...

CVE-2025-0757

Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x...

CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

Keycloak 安全漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from a security vulnerability that stems from the fact that an attacker can steal user sessions, thereby compromising data confidentiality and integrity...

CVE-2025-2859 Improper Authentication vulnerability in saTECH BCU

An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user...

CVE-2025-2859 Improper Authentication vulnerability in saTECH BCU

An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user...

CVE-2025-24381

Dell Unity, versions 5.4 and prior, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The...

CVE-2025-24381

Dell Unity, versions 5.4 and prior, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The...

CVE-2025-24381

Dell Unity, versions 5.4 and prior, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The...

CVE-2025-24381

Dell Unity, versions 5.4 and prior, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The...

CVE-2025-24381

Dell Unity (Dell EMC) affected versions: 5.4 and prior. Issue: URL Redirection to an Untrusted Site (Open Redirect) that can be exploited by an unauthenticated attacker with remote access to redirect a targeted application user to arbitrary URLs. Potential impact per sources includes phishing to ...

Vulnerabilities fixed in SAP software

SAP has fixed several vulnerabilities in its software components, including SAP Commerce, SAP NetWeaver, and SAP BusinessObjects. The vulnerabilities include Cross-Site Scripting XSS and missing authorization controls, which allow attackers to gain unauthorized access, manipulate data, and reveal...

CVE-2025-1230

Stored Cross-Site Scripting XSS vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘//index.php’, affecting the ‘link’ parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cook...

CVE-2025-1230

Stored Cross-Site Scripting XSS vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘//index.php’, affecting the ‘link’ parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cook...

CVE-2025-1230 Cross-Site Scripting (XSS) vulnerability in Prestashop

Stored Cross-Site Scripting XSS vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘//index.php’, affecting the ‘link’ parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cook...

CVE-2025-23363

A vulnerability has been identified in Teamcenter V14.1 All versions, Teamcenter V14.2 All versions, Teamcenter V14.3 All versions V14.3.0.14, Teamcenter V2312 All versions V2312.0010, Teamcenter V2406 All versions V2406.0008, Teamcenter V2412 All versions V2412.0004. The SSO login service of...

GHSA-CPFX-964W-4JVP Authentication bypass in @sap/approuter

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session of the victim by injecting malicious payload, causing High impact on confidentiality and integrity of the application...

Authentication bypass in @sap/approuter

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session of the victim by injecting malicious payload, causing High impact on confidentiality and integrity of the application...

CVE-2025-24876 Authentication bypass via authorization code injection in SAP Approuter

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application...