PT-2025-40395

Name of the Vulnerable Software and Affected Versions AndSoft e-TMS version 25.03 Description A cross-site scripting issue exists that allows an attacker to execute JavaScript code in a victim's browser. This is achieved by sending a malicious URL. The vulnerability is reflected in the...

AndSoft e-TMS 跨站脚本漏洞

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the file...

CVE-2021-1636

creationtimestamp| type| source ---|---|--- 2025-10-01 21:02:27+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m25wrr5laf2n...

CVE-2025-56200

A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leadi...

PT-2025-40534

🚨 CVE-2024-41886 Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker could inject malformed data into url input parameters to reboot the NVR. The manufacturer has released patch firmware for the flaw, please refer to the...

validator.js has a URL validation bypass vulnerability in its isURL function

A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs...

GHSA-9965-VMPH-33XX validator.js has a URL validation bypass vulnerability in its isURL function

A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs...

Google Chrome 安全漏洞

Google Chrome on Android is a mobile browser from Google, optimized for Android devices, offering fast browsing, smart search, privacy protection and cross-device syncing. Google Chrome on Android suffers from an Omnibox mal-implementation vulnerability that can be exploited by attackers to cause...

CVE-2025-11030

creationtimestamp| type| source ---|---|--- 2025-09-26 19:51:31+00:00| seen| https://gist.github.com/Darkcrai86/9a26432a4df88d5274d3832d0339804b...

CVE-2025-60017

creationtimestamp| type| source ---|---|--- 2025-09-26 04:41:10+00:00| seen| http://takeonme.org/cves/cve-2025-35027/ 2026-01-12 17:05:20+00:00| seen| Telegram/11xIB1xBiKHHk4vkf1TSD8teitNOWN5Pk1ybJV3ig8HDqzg 2026-02-27 23:27:41+00:00| seen| https://t.me/VictoryDrones/52894...

CVE-2025-59831

creationtimestamp| type| source ---|---|--- 2025-09-25 15:13:46+00:00| seen| https://gist.github.com/Darkcrai86/c3f7244513af4442fb9d34ce20b3bfb8...

CVE-2025-55556

creationtimestamp| type| source ---|---|--- 2025-09-24 02:11:42+00:00| seen| https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc...

PT-2025-39304

Name of the Vulnerable Software and Affected Versions Cisco IOS Software affected versions not specified Description A flaw exists in the web UI of Cisco IOS Software that may allow a remote attacker with low privileges to trigger a denial of service DoS condition. This is caused by improper inpu...

User Interface (UI) Misrepresentation of Critical Information

Overview Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information via improper handling of error messages passed through URL parameters. An attacker can manipulate browser-displayed error messages by injecting arbitrary content, potentially...

CVE-2024-6429 Content Spoofing in Multiple WSO2 Products via Error Message Injection

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this...

CVE-2025-35042

creationtimestamp| type| source ---|---|--- 2025-09-23 03:02:17+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lzhwowvzy72q...

CVE-2025-10760 Harness lookup_repo.go LookupRepo server-side request forgery

A flaw has been found in Harness 3.3.0. This impacts the function LookupRepo of the file app/api/controller/gitspace/lookuprepo.go. Executing manipulation of the argument url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been published and may be...

Unauthorized Access

Liferay Portal is vulnerable to Unauthorized Access. The vulnerability is due to improper access control because unauthenticated users guests can access files uploaded by object entries and stored in documentlibrary via direct URL...

U.S. Dept Of Defense: Cross-Site Scripting via URL on ███████

A Cross-Site Scripting XSS vulnerability was discovered on a website from the U.S. Department of Defense. The vulnerability was found in the GET method via the URL. Exploitation of this vulnerability could have led to the execution of malicious scripts. No further details about the vulnerability ...

CVE-2025-57296

creationtimestamp| type| source ---|---|--- 2025-09-19 16:32:38+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115231919783504863 2026-03-12 21:02:40+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mgvcd3yes72v...