CVE-2025-0058

In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the...

PT-2025-2439

Name of the Vulnerable Software and Affected Versions: Fortinet FortiPortal versions 7.0.0 through 7.2.8 Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'sql injection'. This may allow an authenticated attacker to view the...

ch.helvethink.odoo4java:java-odoo-xml-rpc-plugin (>=0.0.1, <=0.0.6), com.hexagonkt:templates_jte (>=3.4.0, <=3.7.3) +62 more potentially affected by CVE-2025-23026 via gg.jte:jte-runtime (>=1.0.0, <=3.1.15)

gg.jte:jte-runtime MAVEN version =1.0.0, =0.0.1, =3.4.0, =4.0.0-a1, =0.7.0, =0.5.1, =0.7.0, =0.7.3, =0.7.0, =0.14.0, =0.1.1, =0.5.1 and more Source cves: CVE-2025-23026 Source advisory: MEND:CVE-2025-23026...

com.hexagonkt:templates_jte (>=3.4.0, <=3.7.3), com.hexagontk:templates_jte (>=4.0.0-a1, <=4.0.0-a6) +48 more potentially affected by CVE-2025-23026 via gg.jte:jte-runtime (>=3.0.0, <=3.1.15)

gg.jte:jte-runtime MAVEN version =3.0.0, =3.4.0, =4.0.0-a1, =0.7.0, =0.6.0, =0.7.0, =0.7.3, =0.7.0, =0.14.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.15 and more Source cves: CVE-2025-23026 Source advisory: OSV:GHSA-VH22-6C6H-RM8Q...

PT-2025-1453 · Pat Infinite Solutions · Helpdeskadvanced

Name of the Vulnerable Software and Affected Versions: Pat Infinite Solutions HelpdeskAdvanced versions = 11.0.33 Description: The issue is related to Directory Traversal via the WSCView/Save function. This allows for potential unauthorized access to sensitive files and directories...

CVE-2024-33299: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users...

CVE-2024-33299

Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name parameters in the endpoint /admin/module/view?type=users...

CVE-2024-33298

Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=adminbackup...

CVE-2024-33298: Improper Neutralization of Input During Web Page Generation

Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new backup function in the endpoint /admin/module/view?type=adminbackup...

REDCap security vulnerabilities

REDCap is a data collection and management web application from REDCap open source. A security vulnerability exists in REDCap version 14.9.6, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability that allows an attacker to send a CSV file to the victim to view...

CVE-2024-13262

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal View Password allows Cross-Site Scripting XSS.This issue affects View Password: from 0.0.0 before 6.0.4...

CVE-2024-13262 View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal View Password allows Cross-Site Scripting XSS.This issue affects View Password: from 0.0.0 before 6.0.4...

CVE-2024-13262 View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal View Password allows Cross-Site Scripting XSS.This issue affects View Password: from 0.0.0 before 6.0.4...

CVE-2024-13262 View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal View Password allows Cross-Site Scripting XSS.This issue affects View Password: from 0.0.0 before 6.0.4...

CVE-2024-13262

The View Password module for the Drupal CMS is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the module fails to validate the content of the classes field, which allows administrators to add CSS classes for styling the p...

CVE-2024-13257 Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021

Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3...

Drupal security vulnerabilities

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Commerce View Receipt prior to version 1.0.3, which stems from the inclusion of an authorization error vulnerability...

CVE-2024-13257: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3...

CVE-2024-13262: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal View Password allows Cross-Site Scripting XSS.This issue affects View Password: from 0.0.0 before 6.0.4...

Drupal security vulnerabilities

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal View Password prior to version 6.0.4, which stems from improper input neutralization during page generation, resulting in a cross-site scripting...