4689 matches found
CVE-2025-8739
The CVE-2025-8739 issue affects zhenfeng13 My-Blog up to version 1.0.0. The vulnerability resides in the /admin/tags/save processing where manipulating the tagName parameter enables cross-site request forgery (CSRF). Impact is described as CSRF without details on confidentiality or integrity beyo...
CVE-2025-8739 zhenfeng13 My-Blog save cross-site request forgery
A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/save. The manipulation of the argument tagName leads to cross-site request forgery. The attack may be initiated remotely. The exploit has...
CVE-2025-8739 zhenfeng13 My-Blog save cross-site request forgery
A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/save. The manipulation of the argument tagName leads to cross-site request forgery. The attack may be initiated remotely. The exploit has...
WordPress GravityWP - Merge Tags <= 1.4.4 - Local File Inclusion Vulnerability
WordPress GravityWP - Merge Tags = 1.4.4 - Local File Inclusion Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin GravityWP - Merge Tags versions = 1.4.4...
CVE-2025-54887
jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption JWE standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk becau...
PT-2025-32411 · Myblog · Myblog
Name of the Vulnerable Software and Affected Versions: zhenfeng13 My-Blog versions up to 1.0.0 Description: A cross-site request forgery issue exists due to the manipulation of the tagName argument in the processing of the /admin/tags/save API endpoint. The attack can be initiated remotely. The...
SUSE: Security Advisory (SUSE-SU-2025:02589-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Exploit for Relative Path Traversal in Articatech Artica_Proxy
LFI to RCE Exploit via Log Poisoning Python3 exploit for CVE...
CVE-2025-6078
CVE-2025-6078 affects Partner Software’s Partner Software and Partner Web applications. An authenticated user can submit notes on the Notes page in a job view, and input is not fully sanitized, allowing HTML/JavaScript in notes and resulting in stored XSS. Public details from multiple sources con...
Cross-site Scripting (XSS)
Overview markdown2 is a fast and complete Python implementation of Markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS in safemode due to improper handling of incomplete HTML tags. The encodeincompletetags function fails to properly check for auto links, allowin...
firefox: thunderbird: javascript: URLs executed on object and embed tags
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox executed javascript: URLs when used in object and embed tags...
CVE-2025-54423
copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5...
firefox: thunderbird: javascript: URLs executed on object and embed tags
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox executed javascript: URLs when used in object and embed tags...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper sanitization of multimedia tags in music files, including m3u files. An attacker can execute arbitrary JavaScript code in a victim's browser by tricking the victim into opening a crafted file. Detai...
CVE-2025-54423 copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata
copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5...
CVE-2025-54423
CVE-2025-54423 affects the Copyparty portable file server. Versions up to and including 1.18.4 allow an unauthenticated attacker to execute arbitrary JavaScript in a victim’s browser due to improper sanitization of multimedia tags in music files (including m3u). This is a DOM-based XSS vulnerabil...
firefox: thunderbird: javascript: URLs executed on object and embed tags
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox executed javascript: URLs when used in object and embed tags...
Unspecified Vulnerability in Multiple Mozilla Products (CNVD-2025-20061)
Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A security vulnerability exists in several Mozilla products that originates...
Security Bulletin: Improper Authorization in OpenStack Neutron Tagging Allows Unauthorized Network Tag Modification
Summary In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change add and clear tags on network objects that do not belong to th...
Mozilla -- 'javascript:' URLs execution
[email protected] reports: Thunderbird executed javascript: URLs when used in object and embed tags...