CVE-2025-10290

Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press This vulnerability affects Focus for iOS 143.0...

Security Vulnerabilities fixed in Focus for iOS 143.0 — Mozilla

Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press...

Unmark Code Issues Vulnerabilities

Unmark is an open source to-do list application for bookmarking. A code issue vulnerability exists in Unmark 1.9.3 and earlier versions, which stems from incorrect manipulation of the parameter url in the file /application/controllers/Marks.php, which could lead to server-side request forgery. An...

CVE-2025-59143

creationtimestamp| type| source ---|---|--- 2025-09-15 19:21:19+00:00| seen| https://bsky.app/profile/bad-at-computer.bsky.social/post/3lyvjo7ma7c2n 2025-09-20 21:19:46+00:00| seen| https://bsky.app/profile/okbosmedia.bsky.social/post/3lzccme7hxv2k...

CVE-2025-59155 hackmd-mcp server-side request forgery in HTTP transport mode

hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains a server-side request forgery SSRF vulnerability when the server is run in HTTP transport mode. Arbitrary hackmdApiUrl values supplied vi...

CVE-2025-58748 Dataease H2 data source JDBC URL validation bypass leads to remote code execution

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation H2.java does not verify that a provided JDBC URL starts with jdbc:h2. This lack of validation allows a crafted JDBC configuration that substitutes the Amazon...

PT-2025-37724

Name of the Vulnerable Software and Affected Versions: ZKEACMS version 4.3 Description: A vulnerability exists in ZKEACMS that allows for server-side request forgery. The issue is located in the Proxy function within the src/ZKEACMS/Controllers/MediaController.cs file. Manipulation of the url...

ZKEACMS 代码问题漏洞

ZKEACMS is a visually designed, WYSIWYG content management system from ZKEASOFT open source. A code issue vulnerability exists in ZKEACMS version 4.3, which stems from the incorrect manipulation of the parameter url of the function Proxy in the file src/ZKEACMS/Controllers/MediaController.cs, whi...

PT-2025-37706

Name of the Vulnerable Software and Affected Versions: ServitiumCRM version 2.10 Description: A cross-site scripting XSS issue exists in ServitiumCRM version 2.10. This allows attackers to execute arbitrary code through a crafted URL targeting the mobile parameter. Recommendations: Sanitize or...

CVE-2025-56252

Cross Site Scripting xss vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter...

CVE-2025-10204

creationtimestamp| type| source ---|---|--- 2025-09-14 13:52:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lysgtfmiwr2c 2025-09-15 00:01:54+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lytiuzflta2j 2025-11-27 06:57:26+00:00| confirmed|...

CVE-2025-56556

creationtimestamp| type| source ---|---|--- 2025-09-11 22:57:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyltuhsnsw2x...

Exploit for CVE-2025-50110

CVE-2025-50110 Cleartext Transmission of Sensitive Informa...

Phishing Webpage Detection: Unveiling the Threat Landscape and Investigating Detection Techniques

In the realm of cybersecurity, phishing stands as a prevalent cyber attack, where attackers employ various tactics to deceive users into gathering their sensitive information, potentially leading to identity theft or financial gain. Researchers have been actively working on advancing phishing...

CVE-2025-43781

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.12 allows remote attackers to inject arbitrary web script or HTML via the URL in search bar portl...

CVE-2025-59013 Open Redirect in TYPO3 CMS

An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL...

CVE-2025-42933

creationtimestamp| type| source ---|---|--- 2025-09-09 05:36:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyeyroa63k2r 2025-09-09 06:45:43+00:00| seen| https://gist.github.com/Darkcrai86/e4cb495943d18b664199d51dd5059d24 2025-09-09 06:59:44+00:00| seen|...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

PT-2025-36920

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.110 through 7.4.3.128 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.8 Description: A reflected cross-site...

CVE-2025-58450

creationtimestamp| type| source ---|---|--- 2025-09-08 23:02:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyecqt3c7p2l 2025-09-09 03:17:32+00:00| seen| https://bsky.app/profile/crowdcyber.bsky.social/post/3lyeqzdw3ft26 2026-01-24 22:43:54+00:00| seen|...