CVE-2025-9098 Elseplus File Recovery App AndroidManifest.xml improper export of android application components

A vulnerability was determined in Elseplus File Recovery App 4.4.21 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit...

GHSA-Q4RG-7CJJ-5R86 ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js

A cross-site scripting XSS issue exists in ExpressGateway up to 1.16.10 in the REST endpoint implemented in lib/rest/routes/users.js. User-controlled input is reflected into the HTTP response without proper sanitization, allowing arbitrary JavaScript execution in the browser of a logged-in user w...

GHSA-XFP8-X3J6-H67V ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js

A cross-site scripting XSS issue exists in ExpressGateway ≤ 1.16.10 in lib/rest/routes/apps.js. User-controlled data returned by the REST endpoint is not sanitized before being rendered by the admin/UI layer, allowing an authenticated, low-privileged actor to store or reflect a payload that...

CVE-2025-9097

Summary: CVE-2025-9097 affects the Android app “Euro Information CIC banque et compte en ligne App” (version 12.56.0). The vulnerability is in the AndroidManifest.xml of the component com.cic_prod.bad , where an improper export of Android components is possible. This enables a local attacker to l...

Rockwell Automation PLC - Micro850 L50E和Rockwell Automation PLC - Micro870 L70E 安全漏洞

Rockwell Automation PLC - Micro850 L50E and Rockwell Automation PLC - Micro870 L70E are both Rockwell Automation products.Rockwell Automation PLC - Micro850 L50E is a programmable controller. The Rockwell Automation PLC - Micro850 L50E is a programmable controller.The Rockwell Automation PLC -...

PT-2025-33695 · Netis · Netis Wf2419

Name of the Vulnerable Software and Affected Versions: Netis WF2419 version 1.2.29433 Description: A cross-site scripting issue exists in the Wireless Settings Page component, specifically within the /index.htm file. Manipulation of the SSID argument with the input triggers the vulnerability...

PT-2025-33623 · Euroinformation · Euro Information Cic Banque Et Compte En Ligne App

Name of the Vulnerable Software and Affected Versions: Euro Information CIC banque et compte en ligne App version 12.56.0 Description: A vulnerability exists due to improper export of android application components within the AndroidManifest.xml file of the com.cic prod.bad component. This allows...

PT-2025-33628 · Acrel · Environmental Monitoring Cloud Platform

Name of the Vulnerable Software and Affected Versions: Acrel Environmental Monitoring Cloud Platform versions prior to 20250805 Description: A vulnerability exists in Acrel Environmental Monitoring Cloud Platform up to version 20250804. The issue affects an unknown part of the...

PT-2025-33631 · 1&1 · Mail.Com App +1

Name of the Vulnerable Software and Affected Versions: 1&1 Mail & Media mail.com App version 8.8.0 Description: A security vulnerability has been detected due to improper export of Android application components. The issue affects an unknown function within the AndroidManifest.xml file of the...

PT-2025-33683 · Cip · Cip

Name of the Vulnerable Software and Affected Versions: Versions affected not specified Description: A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and becomes unresponsive. Upon power cycle,...

PT-2025-33627 · Unknown +1 · Elseplus File Recovery App +1

Name of the Vulnerable Software and Affected Versions: Elseplus File Recovery App version 4.4.21 Description: A vulnerability exists in Elseplus File Recovery App version 4.4.21 on Android. The issue affects an unknown functionality within the AndroidManifest.xml file, leading to the improper...

CVE-2025-9096 ExpressGateway express-gateway REST Endpoint apps.js cross site scripting

A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

PT-2025-33621 · Unknown · Express Gateway

Name of the Vulnerable Software and Affected Versions: ExpressGateway versions up to 1.16.10 Description: A vulnerability exists in ExpressGateway, specifically within the lib/rest/routes/apps.js component’s REST Endpoint. The issue involves an unknown function and allows for cross-site scripting...

PT-2025-33620 · Unknown · Express Gateway

Name of the Vulnerable Software and Affected Versions: ExpressGateway versions up to 1.16.10 Description: A flaw has been found in ExpressGateway affecting processing within the lib/rest/routes/users.js library of the REST Endpoint component. Manipulation of this component can lead to cross site...

CVE-2025-7761

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting XSS. Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did no...

CVE-2025-8919

A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the component History Page. The manipulation of the argument código/objetivo habilidade leads to cross site scripting. It is possible to launch...

CVE-2025-7761

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting XSS. Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did no...

CVE-2025-7761 Reflected XSS in Lepszy BIP

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting XSS. Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did no...

PT-2025-33145 · Unknown · Lepszy Bip

Name of the Vulnerable Software and Affected Versions: Lepszy BIP affected versions not specified Description: Lepszy BIP is susceptible to a Reflected Cross-Site Scripting XSS issue. Insufficient input validation within the index.php form allows for the execution of arbitrary JavaScript code in ...

CVE-2025-8919

A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the component History Page. The manipulation of the argument código/objetivo habilidade leads to cross site scripting. It is possible to launch...