CVE-2025-36611

Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access 'Link Following' Vulnerability. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation...

CVE-2025-53357 GLPI permits reservation modification by unauthorized users

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a connected user can alter the reservations of another user. Thi...

CVE-2025-27514

GLPI CVE-2025-27514 affects GLPI versions 9.5.0–10.0.18. A malicious payload can trigger a stored XSS on the project’s Kanban, when processed by the application. Root cause described as a stored XSS vulnerability in the Kanban component; exploitation details are not expanded beyond this descripti...

PT-2025-31175 · Z-Push +1 · Z-Push +1

Name of the Vulnerable Software and Affected Versions: z-push/z-push-dev versions prior to 2.7.6 Description: The software is vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic...

PT-2025-31319 · Apple · Macos Ventura 13.7.7 +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sequoia 15.6 macOS versions prior to Sonoma 14.7.7 macOS versions prior to Ventura 13.7.7 Description: A race condition existed due to improper state handling, potentially allowing an application to cause unexpected...

PT-2025-31332 · Apple · Macos Sequoia 15.6 +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sequoia 15.6 macOS versions prior to Sonoma 14.7.7 Description: An application may be able to hijack entitlements granted to other privileged applications due to improved data protection. Recommendations: Update to mac...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a security bypass vulnerability (CVE-2024-56339)

Summary IBM Webphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a security bypass caused by a failure to honor security configuration. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Product...

CVE-2025-54378

HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS...

CVE-2025-32429

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2025-7723

A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

rsmail

Extension: RSMail! Version: Old 1.22.26, 1.22.27, 1.22.28 / New 1.22.29 Update details: Versions affected 1.19.20 through 1.22.28. Self XSS allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted parameter. Fixed in 1.22.29 Update URL:...

Harbor repository description page has Cross-site Scripting vulnerability

Impact In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue. Patches Harbor v2.12.3 Harbor 2.11.3 Workarounds No References Credit [email protected]...

PT-2025-30529 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: An unrestricted file upload of dangerous file types in Samsung Electronics MagicINFO 9 Server allows for code injection. Recommendations: MagicINFO 9 Server versions prior to...

CVE-2025-54139 HAX CMS' application pages are vulnerable to clickjacking

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an...

CVE-2025-54141 ViewVC's standalone server exposes arbitrary server filesystem content

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style...

PT-2025-30256 · Helmholz +1 · Rex100 +1

Name of the Vulnerable Software and Affected Versions: versions prior to 2025-41681 Description: A high privileged remote attacker can gain persistent cross-site scripting XSS via POST requests due to improper neutralization of special elements used to create dynamic content. Recommendations: At...

CVE-2025-52169

agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting XSS vulnerability...

CVE-2025-48156

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Parakoos Image Wall image-wall allows Stored XSS.This issue affects Image Wall: from n/a through = 3.1...

CVE-2025-54042

Cross-Site Request Forgery CSRF vulnerability in Xfinitysoft WP Post Hide wp-post-hide allows Cross Site Request Forgery.This issue affects WP Post Hide: from n/a through = 1.0.9...

GHSA-VQPH-P5VC-G644 Grafana is vulnerable to XSS attacks through open redirects and path traversal

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01,...