U.S. Dept Of Defense: Cross-Site Scripting via URL on ███████

A Cross-Site Scripting XSS vulnerability was discovered on a website from the U.S. Department of Defense. The vulnerability was found in the GET method via the URL. Exploitation of this vulnerability could have led to the execution of malicious scripts. No further details about the vulnerability ...

CVE-2025-57296

creationtimestamp| type| source ---|---|--- 2025-09-19 16:32:38+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115231919783504863 2026-03-12 21:02:40+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mgvcd3yes72v...

Unspecified Vulnerability in Multiple Apple Products (CNVD-2025-22674)

Apple Safari is a web browser that is the default browser that comes with the Mac OS X and iOS operating systems.Apple iOS is a suite of operating systems developed for mobile devices.Apple iPadOS is a suite of operating systems for the iPad tablet computer. A security vulnerability exists in...

CVE-2021-43579

creationtimestamp| type| source ---|---|--- 2025-09-17 21:02:36+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lz2qayqpvb2s...

CVE-2025-59346 Dragonfly server-side request forgery vulnerability

Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery SSRF vulnerability that enables users to force DragonFly2’s components to make requests to internal services that are otherwise not accessible to...

CVE-2025-59341

esm.sh is a nobuild content delivery networkCDN for modern web development. In 136 and earlier, a Local File Inclusion LFI issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem or other...

CVE-2025-56252

Cross Site Scripting xss vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter...

The vulnerability of the Safari browser in iOS and iPadOS operating systems, related to incorrect authentication, allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of the Safari browser in iOS and iPadOS operating systems is related to improper authentication. Exploiting this vulnerability allows a malicious actor to redirect a user to an arbitrary URL address...

CVE-2021-47676

creationtimestamp| type| source ---|---|--- 2025-09-16 17:41:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyxuledsy62g...

CVE-2025-10016

creationtimestamp| type| source ---|---|--- 2025-09-16 13:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyxgwgpygk2c...

CVE-2025-10290

Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press This vulnerability affects Focus for iOS 143.0...

Unmark Code Issues Vulnerabilities

Unmark is an open source to-do list application for bookmarking. A code issue vulnerability exists in Unmark 1.9.3 and earlier versions, which stems from incorrect manipulation of the parameter url in the file /application/controllers/Marks.php, which could lead to server-side request forgery. An...

Security Vulnerabilities fixed in Focus for iOS 143.0 — Mozilla

Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link explicitly through a long-press...

CVE-2025-59143

creationtimestamp| type| source ---|---|--- 2025-09-15 19:21:19+00:00| seen| https://bsky.app/profile/bad-at-computer.bsky.social/post/3lyvjo7ma7c2n 2025-09-20 21:19:46+00:00| seen| https://bsky.app/profile/okbosmedia.bsky.social/post/3lzccme7hxv2k...

CVE-2025-59155 hackmd-mcp server-side request forgery in HTTP transport mode

hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains a server-side request forgery SSRF vulnerability when the server is run in HTTP transport mode. Arbitrary hackmdApiUrl values supplied vi...

CVE-2025-58748 Dataease H2 data source JDBC URL validation bypass leads to remote code execution

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation H2.java does not verify that a provided JDBC URL starts with jdbc:h2. This lack of validation allows a crafted JDBC configuration that substitutes the Amazon...

PT-2025-37724

Name of the Vulnerable Software and Affected Versions ZKEACMS version 4.3 Description A server-side request forgery issue exists in ZKEACMS 4.3. The Proxy function within the src/ZKEACMS/Controllers/MediaController.cs file is susceptible to manipulation of the url argument, leading to server-side...

ZKEACMS 代码问题漏洞

ZKEACMS is a visually designed, WYSIWYG content management system from ZKEASOFT open source. A code issue vulnerability exists in ZKEACMS version 4.3, which stems from the incorrect manipulation of the parameter url of the function Proxy in the file src/ZKEACMS/Controllers/MediaController.cs, whi...

CVE-2025-56252

Cross Site Scripting xss vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter...

PT-2025-37706

Name of the Vulnerable Software and Affected Versions ServitiumCRM version 2.10 Description A cross-site scripting XSS issue exists in ServitiumCRM version 2.10. This allows attackers to execute arbitrary code through a crafted URL targeting the mobile parameter. Recommendations Sanitize or encod...