EUVD-2023-60190

Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Attackers can trick administrators into clicking a crafted SVG logo that redirects to a potentially dangerous URL through improper file upload filtering...

WordPress plugin Directorist 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

The vulnerability of the Virtual Keyboard Video Monitor (vKVM) system used in Cisco Integrated Management Controller (IMC) remote management solutions allows a hacker to redirect users to any desired URL address.

The vulnerability of the Virtual Keyboard Video Monitor vKVM system, a remote administration tool from Cisco’s Integrated Management Controller IMC, involves redirecting URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to any given URL addres...

CVE-2023-53882 JLex GuestBook 1.6.4 Reflected Cross-Site Scripting via URL Parameter

JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attackers to inject malicious scripts. Attackers can craft malicious links with XSS payloads to steal session tokens or execute arbitrary JavaScript in victims' browsers...

PT-2025-51311

Name of the Vulnerable Software and Affected Versions Ateme TITAN File version 3.9.12.4 Description The software contains an authenticated server-side request forgery issue in the job callback URL parameter. This allows attackers to bypass network restrictions. Exploitation involves an unvalidate...

CVE-2025-67818

creationtimestamp| type| source ---|---|--- 2025-12-12 19:27:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7st2khr5p2c...

CVE-2025-13363

CVE-2025-13363 concerns the IMAQ CORE WordPress plugin. According to Wordfence, versions up to and including 1.2.1 are vulnerable to a Cross-Site Request Forgery (CSRF) due to missing nonce validation on the URL structure settings update function. This enables unauthenticated attackers to modify ...

PT-2025-50878

Name of the Vulnerable Software and Affected Versions GroupSession versions prior to 5.7.1 Description The software’s initial configuration may have the "External page display restriction" set to "Do not limit". This configuration allows a user to be redirected to an arbitrary website when...

Exploit for CVE-2022-25765

Command Injection quando processa URLs não sanitizadas. Isso aco...

CVE-2024-58312

xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. Attackers can exploit directory traversal techniques to read critical system files like using encoded path traversal characters in HTTP...

CVE-2025-67505

creationtimestamp| type| source ---|---|--- 2025-12-11 01:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7oepprs6m2e...

PT-2025-50608

Name of the Vulnerable Software and Affected Versions Yalantis uCrop version 2.2.11 Description A server-side request forgery condition exists in Yalantis uCrop 2.2.11. The issue is related to the downloadFile function within the com.yalantis.ucrop.task.BitmapLoadTask.java file, specifically in t...

uCrop 代码问题漏洞

uCrop is an Android image cropping library open-sourced by Yalantis. A code issue vulnerability exists in uCrop version 2.2.11, which stems from a flaw in the function downloadFile in the file com.yalantis.ucrop.task.BitmapLoadTask.java of the component URL Handler, which could lead to server-sid...

CVE-2025-13607

A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL...

GHSA-MJCP-GPGX-GGCG

creationtimestamp| type| source ---|---|--- 2025-12-10 01:47:43+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3m7lwvgz5u52x...

EUVD-2025-202068

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a through = 3.15.7...

CVE-2025-34397

creationtimestamp| type| source ---|---|--- 2025-12-09 18:23:42+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115691003669191782...

CVE-2025-62082

creationtimestamp| type| source ---|---|--- 2025-12-09 16:00:21+00:00| seen| https://gist.github.com/Darkcrai86/ef17d2dc0caf1ff17172b93af46f911e...

CVE-2025-12807

creationtimestamp| type| source ---|---|--- 2025-12-09 15:52:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7kvnvapsq2a 2026-01-14 17:27:21+00:00| seen| https://mastodon.social/ap/users/115426718704364579/statuses/115894625226861827 2026-01-14 17:27:41+00:00| seen|...

CVE-2025-13604

CVE-2025-13604 is a stored XSS in the WordPress plugin “Login Security, FireWall, Malware removal by CleanTalk” (versions ≤ 2.168). The root cause is insufficient input sanitization and output escaping on the page URL, enabling unauthenticated attackers to inject scripts executed when users load ...