Frappe Technologies – Frappe security vulnerabilities

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A security vulnerability exists in Frappe Technologies Frappe version 15.57.5, which stems from unvalidated inputs in the blanketordertype parameter,...

AIRI Project code injection vulnerability

Project AIRI is an AI dialog bot open-sourced by moeru-ai. Project AIRI version 0.7.2-beta.2 suffers from a code injection vulnerability that stems from the MarkdownRenderer.vue component directly using v-html to render unescaped HTML content, which could lead to cross-site scripting attacks, as...

PT-2025-37178

Name of the Vulnerable Software and Affected Versions: Online Fire Reporting System version 1.2 Description: The Online Fire Reporting System contains a stored cross-site scripting XSS issue. This is due to insufficient validation of user-supplied fromdate and todate parameters via a POST request...

CVE-2025-41040

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datacode', 'datalang0key', 'datalang0value', 'datalang1key' and 'datatitle' parameters in /apprain/developer/language/lipsum.xm...

CVE-2025-41054

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/cycle...

CVE-2025-41055

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/dialogs...

CVE-2025-41040

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datacode', 'datalang0key', 'datalang0value', 'datalang1key' and 'datatitle' parameters in /apprain/developer/language/lipsum.xm...

CVE-2025-41054

CVE-2025-41054 affects appRain CMF 4.0.5. It’s a stored authenticated XSS in /apprain/developer/addons/update/cycle via data[Addon][layouts] and data[Addon][layouts_except]. Reported exploitation status is not provided; CVSS indicates NETWORK, LOW attack complexity, and user interaction is REQUIR...

CVE-2025-41040 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datacode', 'datalang0key', 'datalang0value', 'datalang1key' and 'datatitle' parameters in /apprain/developer/language/lipsum.xm...

Simple Grading System login.php File SQL Injection Vulnerability

Simple Grading System is a simple grading system. Simple Grading System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the file /login.php. An attacker can exploit this vulnerability to execute illegal SQL commands to steal...

WellChoose Organization Portal System SQL Injection Vulnerability

WellChoose Organization Portal System is an electronic directory service system from WellChoose in Taiwan, China. The WellChoose Organization Portal System suffers from a SQL injection vulnerability that arises from the application's lack of validation of externally entered SQL statements. The...

ProcessMaker Open Source Security Vulnerabilities

ProcessMaker Open Source is a workflow management software from US-based ProcessMaker, Inc. A security vulnerability exists in ProcessMaker Open Source versions 2.0.23 through 2.5.1 that originates from multiple endpoints that do not validate user input and could lead to remote code execution...

Online Appointment Booking System cover.php file SQL Injection Vulnerability

Online Appointment Booking System is an online appointment booking system. The Online Appointment Booking System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter uname/psw in the file /cover.php. The...

VMware AVI Load Balancer security vulnerabilities

VMware Avi Load Balancer is a load balancing platform from VMware. VMware Avi Load Balancer suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL...

CVE-2025-48944

vLLM is an inference and serving engine for large language models LLMs. In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality ...

e-Diary Management System password-recovery.php File SQL Injection Vulnerability

The e-Diary Management System is an electronic diary management system. The e-Diary Management System suffers from a SQL injection vulnerability that originates from a missing validation of externally entered SQL statements in the parameter username/contactno of the password-recovery.php file. An...

PT-2025-15235

Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.20.1 Description A vulnerability was identified in tarteaucitron.js where user-controlled inputs for element dimensions width and height were not properly validated. This allowed an attacker with direct...

tarteaucitron.js security vulnerabilities

tarteaucitron.js is a cookie manager for the Amauri CHAMPEAUX individual developer. A security vulnerability exists in tarteaucitron.js versions prior to 1.20.1, which stems from insufficient validation of inputs to the addOrUpdate function and could lead to prototype contamination...

IBM Concert security vulnerability

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. IBM Concert suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. A...

Hitachi Energy MicroSCADA X SYS600 SQL Injection Vulnerability

Hitachi Energy MicroSCADA X SYS600 is a SCADA product from Hitachi, Japan. It ensures optimal control and reliable operation of your switching station through seamless integration and connectivity between different devices and systems. A SQL injection vulnerability exists in Hitachi Energy...