4683 matches found
CVE-2025-61602 BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
BigBlueButton is an open-source virtual classroom. A denial-of-service DoS vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed reactionEmojiId in the GraphQL mutation...
CVE-2025-35062 Newforma Info Exchange (NIX) default anonymous access
Newforma Info Exchange NIX before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication...
Listmonk Insecure Sprig Template Functions Environment Disclosure
This module exploits insecure Sprig template functions in Listmonk versions prior to v5.0.2. The env and expandenv functions are enabled by default, allowing authenticated users with campaign permissions to extract sensitive environment variables via campaign preview. Module Options msf use...
EUVD-2025-33375
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Management pages that, when visited by another user, enable the attacker to execute commands with the target's...
EUVD-2025-33386
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Template Definition page that, when visited by another user, enables the attacker to execute commands with the...
EUVD-2025-33371
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Quick Template page that, when visited by another user, enables the attacker to execute commands with the target's...
EUVD-2025-33380
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the arbitrary device search field that, when visited by another user, enables the attacker to execute commands with the...
CVE-2025-59991
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Management pages that, when visited by another user, enable the attacker to execute commands with the target's...
CVE-2025-59985
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in a field on the Purging Policy page that, when visited by another user, enables the attacker to execute commands with the...
CVE-2025-59996
The CVE-2025-59996 issue affects Juniper Networks Junos Space versions prior to 24.1R4, where an Improper Neutralization of Input During Web Page Generation enables cross-site scripting in the Configuration View page. Exploitation would allow an attacker to inject script tags that, when a second ...
CVE-2025-59985
Juniper Junos Space prior to 24.1R4 is affected by CVE-2025-59985 due to improper input neutralization during web page generation on the Purging Policy page, allowing injection of script tags that can execute commands with the target user’s permissions (potentially admin). The issue is a client-f...
CVE-2025-59974
CVE-2025-59974 is a stored cross-site scripting (XSS) vulnerability in Juniper Networks’ Junos Space Security Director. The issue arises from improper input neutralization during web page generation, allowing an attacker to inject scripts that are stored and later executed in other users’ browser...
CVE-2025-60375
The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and password parameters in the login request, an attacker can gain unauthorized access to user accounts, including...
CVE-2025-36636 Improper Access Control
In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope...
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
...
Microsoft Edge (Chromium-Based) < 141.0.3537.57 Multiple Vulnerabilities (Oct 2025)
Microsoft Edge Chromium-Based is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2021-22291
ABB EIBPORT V3 KNX and ABB EIBPORT V3 KNX GSM are affected by a reflected XSS due to improper input neutralization during web page generation. Affects versions prior to 3.9.2 for V3 KNX and prior to 3.9.2 for V3 KNX GSM. The vulnerability could allow attackers to execute scripts in the user’s bro...
EUVD-2018-0756
Malware in sbrugna...