📄 Microsoft Edge Cross Site Scripting Filter Bypass

Microsoft Edge cross site scripting filter bypass proof of concept exploit. Titles: Microsoft Edge XSS Filter Bypass PoC Author: nu11secur1ty Date: 2025-07-18 Vendor: Microsoft Software: Microsoft Edge Browser Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6176 Description Thi...

PT-2025-30435 · Okta · Okta On-Premises Provisioning Agent

Name of the Vulnerable Software and Affected Versions: Okta On-Premises Provisioning OPP agents versions 2.2.1 through 2.3.0 Description: Okta On-Premises Provisioning OPP agents log specific user data during administrator-initiated password resets. An attacker gaining access to the local servers...

World Leaks Claims Dell Data Breach, Leaks 1.3 TB of Files

Former Hunters International ransomware gang, now World Leaks, claims 1.3 TB Dell data breach, leaking over 400K files with internal tools and user data...

CVE-2025-6235

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235

CVE-2025-6235 affects ExtremeControl prior to 25.5.12, with an XSS in the login interface due to improper handling of user input in HTML attributes. The vulnerability can allow injected script to run in a user’s browser under certain interactions, potentially exposing user data or enabling unauth...

CVE-2025-6235 ExtremeControl (NAC) 'onmouseover' XSS

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235 ExtremeControl (NAC) 'onmouseover' XSS

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

GPT-SoVITS-WebUI Code Issue Vulnerability (CNVD-2025-23575)

GPT-SoVITS-WebUI is a TTS training model. A code issue vulnerability exists in GPT-SoVITS-WebUI, which stems from unsafe deserialization handling of the AudioPre class when receiving user-submitted serialized data, and can be exploited by an attacker to execute arbitrary commands on the system...

PT-2025-30277 · Unknown · Extremecontrol

Name of the Vulnerable Software and Affected Versions: ExtremeControl versions prior to 25.5.12 Description: The application contains a cross-site scripting XSS issue in a login interface. This is due to improper handling of user-supplied input within HTML attributes, which allows an attacker to...

CVE-2025-6235: Improper Neutralization of Input During Web Page Generation

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

PT-2025-30330 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: Live Helper Chat version 4.60 Description: A stored cross-site scripting XSS vulnerability exists in Live Helper Chat version 4.60. This allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Telegra...

Meta execs pay the pain away with $8 billion privacy settlement

Meta chief Mark Zuckerberg and several other members of the social media giant's top brass agreed to settle increasingly heated privacy violation claims for the price of $8 billion. It is far from the first time that the company, its subsidiary Facebook, or its executives have responded to allege...

Information Disclosure

Directus is vulnerable to information disclosure. The vulnerability is due to improper handling of user data in the "Log to Console" operation within Directus Flows, which allows an attacker with admin privileges to log and access sensitive data of other users during create or update events...

WordPress Contest Gallery plugin cross-site scripting vulnerability

WordPress Contest Gallery plugin is a powerful plugin that is mainly used to organize all kinds of online contests in WordPress websites, supporting the uploading and displaying of photos, videos, audios, documents and other types of files. WordPress Contest Gallery plugin suffers from a cross-si...

CVE-2025-51497

The AdGuard plugin for Safari on MacOS is vulnerable in versions prior to 1.11.22 . The software excessively logs every URL accessed by Safari while the plugin is active, writing this information into the MacOS general logs . These logs are accessible to any unsandboxed process , potentially lead...

CVE-2025-53908

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

CVE-2025-53908

RomM is affected by an authenticated path traversal vulnerability in the /api/raw endpoint. Versions prior to 3.10.3 and prior to 4.0.0-beta.3 are vulnerable. The issue can allow leakage of passwords and user data on systems with multiple users (including unprivileged users such as the kiosk user...

CVE-2025-40724

Stored Cross-Site Scripting XSS vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the umedicinename parameter in /editmedicine.php. This vulnerability can be exploited to...

CVE-2025-40724 Stored Cross-Site Scripting (XSS) in Pharmacy POS PHP Script

Stored Cross-Site Scripting XSS vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the umedicinename parameter in /editmedicine.php. This vulnerability can be exploited to...