152 matches found
EUVD-2022-2034
Malicious code in bioql PyPI...
EUVD-2022-4243
Malicious code in bioql PyPI...
EUVD-2024-49895
Malicious code in bioql PyPI...
EUVD-2022-38919
Malicious code in bioql PyPI...
EUVD-2023-55683
Malicious code in bioql PyPI...
EUVD-2023-12128
Malicious code in bioql PyPI...
EUVD-2025-6056
Malicious code in bioql PyPI...
EUVD-2023-0773
Malicious code in bioql PyPI...
EUVD-2023-50543
Malicious code in bioql PyPI...
CVE-2025-52553 authentik has Insufficient Session verification for Remote Access Control endpoint access
authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, howev...
CVE-2025-32013 Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery SSRF vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request ...
CVE-2024-11325 AWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting
The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2024-9353 Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting
The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web...
Decidim vulnerable to data disclosure through the embed feature
Impact If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded such as a Participatory Process, an Assembly, a Proposal, a Result, etc, then some data of this resource could be accessed. Patches version 0.27.6...
How to block access URL https://x.x.x.x/oauth/idp/.well-known/openid-configuration
This article will guide on how to block access to the URL https://x.x.x.x/oauth/idp/.well-known/openid-configuration, where x.x.x.x is the URL of the gateway...
urlaub-mit-kindern-familienurlaub.de Improper Access Control vulnerability OBB-3772866
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Redirect from searchrequest.html page to login screen
h3. Issue Summary Hello team, We would like to open an improvement request to allow the searchrequest.html page to be redirected to the login page if the user is not logged on. This desired behavior is similar to the issue view page, since it automatically redirects you to the login screen if...
GHSA-RXRC-RGV4-JPVX React Developer Tools extension Improper Authorization vulnerability
The React Developer Tools extension registers a message listener with window.addEventListener'message', in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch. The URL is not...