kodbox 代码问题漏洞

kodbox is a web file manager by warlee individual developer. A code issue vulnerability exists in kodbox version 1.61, which stems from a server-side request forgery due to incorrect manipulation of the parameter url in the file /?explorer/upload/serverDownload...

Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the referer and FORWARDURL parameters. An attacker can execute arbitrary JavaScript in the context of a user's browser by injecting malicious payloads using encoded characters and a null-byte %00 in these...

GHSA-H4M4-XP33-37MJ Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2025-55751

OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida. An attacker can craft a link to the trusted application that, when visited, redirects the user to a malicious external site. This enables phishing,...

CVE-2025-55602

D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formSysCmd function via the submit-url parameter...

D-Link DIR-619L 缓冲区错误漏洞

D-Link DIR-619L is a home wireless router from AUO D-Link, designed for home and small office environments, utilizing the IEEE 802.11n wireless standard with a maximum transmission rate of 300Mbps. The D-Link DIR-619L suffers from a buffer overflow vulnerability that originates from the submit-ur...

CVE-2025-55602

D-Link DIR-619L firmware 2.06B01 is affected by a buffer overflow in the formSysCmd function via the submit-url parameter. The issue permits network-exposed exploitation with low complexity and can impact availability (DoS) and integrity/confidentiality as per CVSS notes, though the documents do ...

PT-2025-33890 · Totvs · Totvs Portal Meu Rh

Name of the Vulnerable Software and Affected Versions: TOTVS Portal Meu RH versions up to 12.1.17 Description: A flaw has been identified in the Password Reset Handler component that may allow for an open redirect. Manipulation of the redirectUrl argument can lead to a redirect to an arbitrary UR...

Liferay Portal Vulnerable to Cross-Site Scripting via backURL Paramter

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8 and 2025.Q1.0 through 2025.Q1.15 allows a remote authenticated user to inject JavaScript code via comliferayjournalwebportletJournalPortletbackURL parameter...

CVE-2025-55586

CVE-2025-55586 affects TOTOLINK A3002R v4.0.0-B20230531.1404. The flaw is a buffer overflow in the url parameter of /boafrm/formFilter, leading to a Denial of Service when fed with crafted input. The available sources confirm the issue but do not provide a definitive patch; PT-Security notes ther...

Bottinelli Informatical Vedo Suite Server-Side Request Forgery Vulnerability

Bottinelli Informatical Vedo Suite is an enterprise software suite for the textile and design industry from Bottinelli Informatica, Italy. Bottinelli Informatical Vedo Suite suffers from a server-side request forgery vulnerability, which originates from the /apivedo/video/preview endpoint that do...

PT-2025-33525 · WordPress · Anber Elementor Addon

Name of the Vulnerable Software and Affected Versions: Anber Elementor Addon versions prior to 1.0.2 Description: The Anber Elementor Addon plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2025-8462

CVE-2025-8462 covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin “RT Easy Builder – Advanced addons for Elementor.” The issue arises from insufficient input sanitization and output escaping of the social URL parameter, affecting all versions up to 2.3. Authenticated attack...

PT-2025-32617 · WordPress · Rt Easy Builder – Advanced Addons For Elementor

Name of the Vulnerable Software and Affected Versions: RT Easy Builder – Advanced addons for Elementor plugin for WordPress versions prior to 2.3 Description: The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the social...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

PT-2025-32222 · Bottinelli Informatical · Vedo Suite

Name of the Vulnerable Software and Affected Versions: Bottinelli Informatical Vedo Suite version 2024.17 Description: Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /api vedo/video/preview endpoint. This allows remote authenticated attackers t...