CVE-2025-25324

An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25331

An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25330

An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25331

An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25323

An issue in Qianjin Network Information Technology Shanghai Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link...

Tencent MicroVision 安全漏洞

Tencent MicroVision Tencent MicroVision is a short video creation and sharing platform from China's Tencent. It is used for users to create, share and view short videos. A security vulnerability exists in Tencent MicroVision version 8.137.0, which stems from a specially crafted link that can acce...

CVE-2025-25326

An issue in the Merchants Union Finance iOS app 6.19.0 allows attackers to access sensitive user information by supplying a crafted link. CVE-2025-25326 has a CVSS v3.1 base score of 5.5 (Medium) with Local attack vector, Low attack complexity, No privileges required, and User interaction require...

CVE-2025-25333

CVE-2025-25333 affects IKEA CN iOS 4.13.0. The vulnerability allows attackers to access sensitive user information by supplying a crafted link. Impact on confidentiality is stated as high; no root cause, exploit details, or remediation are provided in the available documents.

CVE-2025-25326

An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link...

CVE-2025-25331

Beitatong Technology LianJia iOS 9.83.50 is reported vulnerable to an issue that allows access to sensitive user information when a crafted link is supplied. The available documents do not specify the underlying root cause, affected components beyond the listed iOS app version, or any remediation...

CVE-2025-25324

Technical details about CVE-2025-25324 are not publicly available in the provided documents. Monitoring for updates from sources may be needed to confirm affected components, root cause, impact, and remediation.

CVE-2025-25054

Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user...

PT-2025-7442 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 2024R1.2.2 Description: The issue allows unauthenticated users to access multiple pages that display the usernames and email addresses of all current users. This is an Information Disclosure vulnerability. Recommendations: F...

CVE-2024-54961

Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users...

K000149858: Apache Tomcat vulnerability CVE-2024-52318

Security Advisory Description Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue. CVE-2024-52318 Impact This vulnerability may...

CVE-2024-13719 PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure

The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...

Multiple cross-site scripting vulnerabilities in Movable Type

Overview Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor CWE-79 - CVE-2025-22888 Stored cross-site scripting vulnerability in the HTML edit mode ...

CVE-2025-25054

Movable Type (Six Apart) contains a Reflected Cross-Site Scripting vulnerability in the user information edit page that is triggered when the Multi-Factor authentication plugin is enabled and a logged-in user visits a crafted page. Exploitation could cause arbitrary script execution in the user’s...

CVE-2025-25054

Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user...

CVE-2024-29120

In Streampark version 2.1.4, when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc...