17029 matches found
BELL-CVE-2025-21910
Bulletin has no description...
GHSA-CMM4-P9V2-Q453 Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)
Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 are vulnerable to CSRF and XSS in the Concrete CMS Address attribute because addresses are not properly sanitized in the output when a country is not specified. Attackers are limited to individuals whom a site administrator has...
MAL-2025-3094 Malicious code in com.henryhoffman.unlockprotocol (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0b9fe935663d6cf238511872ce9dec97a8af571599942b2005de6e3579aa08b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
OSV-2025-253 Security exception in org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=407477665 Crash type: Security exception Crash state: org.apache.lucene.analysis.ckb.SoraniNormalizer.normalize org.apache.lucene.analysis.ckb.SoraniNormalizationFilter.incrementToken...
PT-2025-14781 · Element · Element Ios
Name of the Vulnerable Software and Affected Versions: Element X iOS versions 1.6.13 through 25.03.7 Description: The issue allows an entity in control of the element.json well-known file to access media encryption keys used for an Element Call under certain conditions. Recommendations: For...
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filterid parameter at /students/StudentFilters.php...
CVE-2025-22928
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cpid parameter at /modules/messages/Inbox.php...
PT-2025-14753 · Unknown · Labib Ahmed Team Builder
Name of the Vulnerable Software and Affected Versions: Labib Ahmed Team Builder versions n/a through 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker...
PT-2025-14711 · Unknown · Cm Header/Footer
Name of the Vulnerable Software and Affected Versions: CM Header and Footer versions 1.2.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...
PT-2025-18663 · Totolink · Totolink Ca600-Poe
Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version V5.3c.6665 B20180820 Description: A command injection issue was discovered in the msg process function via the Port parameter. This issue allows attackers to execute arbitrary commands through a manipulated request...
PT-2025-14723 · Peprodev · Peprodev Cf7 Database
Name of the Vulnerable Software and Affected Versions: PeproDev CF7 Database versions through 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker can...
Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component
SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component...
Jenkins monitor-remote-job Plugin Stores Passwords Unencrypted
Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this...
Django Potential Denial of Service (DoS) on Windows
An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.LogoutView, and django.views.i18n.setlanguage are subject to a potential denial-of-service attack v...
SUSE CVE-2025-3031
An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137...
CVE-2025-30961
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tinuzz Trackserver trackserver allows DOM-Based XSS.This issue affects Trackserver: from n/a through = 5.1.0...
CVE-2024-39780
A YAML deserialization vulnerability was found in the Robot Operating System ROS 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load functi...
MAL-2025-3065 Malicious code in ehackify-example-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60ffba72c4fb6005e35ffd9acb8fde18eaa73f3c647a76de85a153ed9b5f0a89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...