14510 matches found
Moment.js: Path traversal in moment.locale
A path traversal vulnerability was found in Moment.js that impacts npm server users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity...
CVE-2025-24907
Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi Vantara...
CVE-2025-24909
Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and...
CVE-2025-24908
Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi Vantara...
CVE-2025-0757
Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and...
Cross-Site Scripting (XSS)
pear/httprequest2 is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper sanitization and escaping of user input in the affected files tests/network/getparameters.php and tests/network/postparameters.php, which allows GET and POST parameters to be reflected...
Dell PowerScale OneFS Integer Overflow Vulnerability
Dell PowerScale OneFS is an operating system from Dell USA. Dell PowerScale OneFS suffers from an integer overflow vulnerability that stems from a failure to properly validate user input, which can be exploited by an attacker to cause a denial of service...
PT-2025-17754 · Unknown · Popup Anything
Name of the Vulnerable Software and Affected Versions: Anything Popup versions n/a through 7.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS, where an attacker can inject maliciou...
PT-2025-17811 · Peekaboo · Peekaboo
Name of the Vulnerable Software and Affected Versions: Peekaboo versions n/a through 1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...
PT-2025-17696 · Apache · Apache Http Server
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns unvalidated user input in the Apache HTTP Server. No further details are provided about the nature of the issue, affected devices, or real-world incidents. Recommendations...
Cross-site Scripting (XSS)
jquery-validation is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized user input in the showLabel function due to improper handling of placeholder values that populate messages via $.validator.messages...
CVE-2025-43948
The Codemers KLIMS laboratory information management system, version 1.6.DEV , is vulnerable to Python code injection (CWE-77). An attacker can provide malicious Python code as an input value for a parameter or qualifier, such as those used for sorting. This flaw allows for the server-side execut...
CVE-2025-43948
Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or qualifier such as for sorting, which will get executed on the server side...
PT-2025-17590 · Unknown · Laravel Starter
Name of the Vulnerable Software and Affected Versions: Laravel Starter version 11.11.0 Description: The issue concerns Cross Site Scripting XSS in the tags feature. Users who can create or modify tags can inject malicious JavaScript code into the name field. Recommendations: For Laravel Starter...
PT-2025-17495 · Unknown · Event Post
Name of the Vulnerable Software and Affected Versions: Bastien Ho Event post versions n/a through 5.9.11 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS in the Event post. Recommendations:...
code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)
Exploit Title: code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting XSS Google Dork: inurl:/exam/feedback.php Date: 2025-04-19 Exploit Author: Pruthu Raut Vendor Homepage: https://code-projects.org/ Software Link:...
PT-2025-17518 · Unknown · Visual Composer Website Builder
Name of the Vulnerable Software and Affected Versions: Visual Composer Website Builder versions through 45.10.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables attackers to...
PT-2025-17368 · Apache · Apache Http Server
Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issu...
PT-2025-17367 · Apache · Apache Http Server
Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input. No further details are provided about the nature of the issue, affected devices, or real-world incidents. Recommendations: At the momen...