GHSA-95J3-435G-VJCP Leantime affected by Improper Neutralization of HTML Tags

Summary HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address...

GHSA-V4Q9-437P-MHPG Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)

Summary A cross-site scripting XSS vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not...

GHSA-63CR-XG3F-8JVR Leantime allows Stored Cross-Site Scripting (XSS)

Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...

Leantime allows Stored Cross-Site Scripting (XSS)

Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...

Leantime allows Refelected Cross-Site Scripting (XSS)

Summary The vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation...

GHSA-52XF-H226-PFGX Leantime allows Refelected Cross-Site Scripting (XSS)

Summary The vulnerability in Leantime's "overdue" section allows attackers to upload malicious image files containing XSS payloads. When other users view these files, the scripts execute, enabling attackers to steal sensitive information or perform unauthorized actions. Improving input validation...

Vulnerabilities fixed in Nagios XI

Nagios has fixed vulnerabilities in Nagios XI Specific to version 2024R1.2.2. The vulnerability is in the way Nagios XI handles user information, allowing unauthenticated users to access usernames and e-mail addresses of all current users. This can lead to unauthorized access and exploitation of...

CVE-2024-13818

CVE-2024-13818 affects the WordPress plugin “Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction.” Technical details in connected documents show the vulnerability is an exposure of potentially sensitive user data v...

WordPress plugin Registration Forms 日志信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A log information disclosure...

CVE-2025-0352

Rapid Response Monitoring My Security Account App utilizes an API that could be exploited by an attacker to modify request data, potentially causing the API to return information about other users...

CVE-2025-0352 Rapid Response Monitoring My Security Account App Authorization Bypass Through User-Controlled Key

Rapid Response Monitoring My Security Account App utilizes an API that could be exploited by an attacker to modify request data, potentially causing the API to return information about other users...

CVE-2025-0352

CVE-2025-0352 concerns the Rapid Response Monitoring My Security Account App. The vulnerability arises from an API that could be tampered to modify request data, potentially causing the API to return information about other users. Publicly cited sources (NVD, Red Hat, CVE list, CISA ICS advisory)...

CVE-2024-54961

Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users...

Rapid Response Monitoring My Security Account App 安全漏洞

Rapid Response Monitoring My Security Account App is an account security program from Rapid Response Monitoring. A security vulnerability exists in Rapid Response Monitoring My Security Account App that stems from a failure to validate requested data modifications. An attacker exploiting this...

IBM QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2025-04167)

IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...

CVE-2025-26604

Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension management and secure execution. Because of the nature of arbitrary user-submited code execution, this allows user to execute potentially malicious code to perform damage or extract...

Apache Atlas Cross-Site Scripting Vulnerability (CNVD-2025-05706)

Apache Atlas is a set of scalable and extensible core functional governance services from the Apache USA Foundation. Apache Atlas suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be...

CVE-2024-13525

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via Shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data...

Pimcore cross-site scripting vulnerability (CNVD-2025-12130)

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. Pimcore has a cross-site scripting vulnerabilit...

The vulnerability of the Knowledge Space integrated planning platform, which involves disclosing information about application users, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Knowledge Space integrated planning platform relates to the disclosure of user information within the application. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...