CVE-2025-61769

Emlog is an open source website building system. A cross-site scripting XSS vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload...

EUVD-2025-32568

A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote exploitation of the attack is possible. Th...

CVE-2025-61777 FlagForge Allows Unauthenticated Badge Template API Access

Flag Forge is a Capture The Flag CTF platform. Starting in version 2.0.0 and prior to version 2.3.2, the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized user...

EUVD-2025-32544

Emlog is an open source website building system. A cross-site scripting XSS vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload...

CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

CVE-2025-59152

Litestar vulnerability in RateLimitMiddleware: when X-Forwarded-For is present, cache_key_from_request() trusts it unconditionally, enabling per-header-bucket rate-limiting and bypass of IP-based quotas. Affected: Litestar 2.17.0 with default RateLimitMiddleware configuration. Mitigation: upgrade...

CVE-2025-59152 X-Forwarded-For Header Spoofing Bypasses Litestar Rate Limiting

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...

EUVD-2025-32541

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...

CVE-2025-11337 Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. This affects an unknown part of the file /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do. Performing manipulation of the argument fileName results in path traversal. It is...

CVE-2025-11336 Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functionality of the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do. Such manipulation of the argument fileName leads...

EUVD-2025-32527

Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing.This issue affects Logo Cloud: before 2.57...

CVE-2025-57515

The CVE-2025-57515 entry concerns Uniclare Student Portal v2, where a SQL injection flaw exists in input fields. The vulnerability enables attackers to inject arbitrary SQL commands and, per sources, can leverage time-delay functions to infer database responses. Documented affected component is t...

Uniclare Student portal 安全漏洞

Uniclare Student portal is a student portal system from Uniclare. A security vulnerability exists in Uniclare Student Portal version v2, which stems from insufficient validation of input fields and could lead to an SQL injection attack...

CVE-2025-57515

A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnerable input fields, enabling the execution of time-delay functions to infer database responses...

PT-2025-40917

Name of the Vulnerable Software and Affected Versions Jinher OA versions prior to 2.0 Description A security flaw exists in Jinher OA. The issue involves xml external entity reference within an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo=1...

Apache Subversion 安全漏洞

Apache Subversion is an open source version control system from the American Apache Apache Foundation. The system is compatible with the Concurrent Versions System CVS. A security vulnerability exists in versions prior to Apache Subversion 2 that stems from post-release reuse during SANM decoding...

CVE-2025-59830

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters...

CVE-2025-8917 Path Traversal Leading to Remote Code Execution in allegroai/clearml

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the safeextract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical fil...

CVE-2025-9332

The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-61597

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting XSS via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will...