CVE-2025-4529

CVE-2025-4529 affects Seeyon Zhiyuan OA Web Application System 8.1 SP2. The vulnerability lies in the Download function of the ZIP File Handler within seeyon-apps-m3.jar (M3CoreController.class): manipulating the Name argument enables path traversal. Remote exploitation is possible and the exploi...

Pegasus-Pentest-Arsenal - A Comprehensive Web Application Security Testing Toolkit That Combines 10 Powerful Penetration Testing Features Into One Tool

/\ / | / \ | \ | || | | | | / | /| |/ |/ |/ ,/; ; ; ,'/|; ,/,/, ,'/ |;/,/,/,/| ,/; |;|/,/,/,/,/| ,/'; |;|,/,/,/,/,/| ,/'; |;|/,/,/,/,/,/|, / ; |;|,/,/,/,/,/,/| / ,'; |;|/,/,/,/,/,/,/| /,/'; |;|,/,/,/,/,/,/,/| /;/ '; |;|/,/,/,/,/,/,/,/| ██████╗ ███████╗ ██████╗ █████╗ ███████╗██╗ ██╗███████╗...

PT-2025-20653 · Unknown · Seeyon Zhiyuan Oa Web Application System

Name of the Vulnerable Software and Affected Versions: Seeyon Zhiyuan OA Web Application System version 8.1 SP2 Description: A critical issue affects the function postData of the file ROOTWEB-INFclassescomourswwwehrsalaryservicedataEhrSalaryPayrollServiceImpl.class of the component Beetl Template...

U.S. Dept Of Defense: Cross-Site Scripting via 'wikitext' parameter

A Cross-Site Scripting XSS vulnerability was discovered in the 'wikitext' parameter of a web application. The vulnerability allowed an attacker to inject malicious scripts that could be executed by the application. No further details were provided regarding the impact or the affected product...

PT-2025-20552 · Radware · Radware Cloud Web Application Firewall

Name of the Vulnerable Software and Affected Versions: Radware Cloud Web Application Firewall WAF versions before 2025-05-07 Description: The issue allows remote attackers to bypass firewall filters by adding a special character to the request. There is a proof-of-concept demonstration of the...

CVE-2025-47635 WordPress WebinarPress plugin <= 1.33.28 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects WebinarPress: from n/a through = 1.33.28...

PT-2025-20033 · Unknown · Boinc Server

Name of the Vulnerable Software and Affected Versions: BOINC Server versions prior to 1.4.5 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject malicious scripts into w...

WordPress plugin Accept Donations with PayPal 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Accept Donations with PayPal plugin, which stems from the WEB application not adequately verifying that a...

Radware Cloud Web Application Firewall Vulnerable to Filter Bypass

Overview The Radware Cloud Web Application Firewall is vulnerable to filter bypass by multiple means. The first is via specially crafted HTTP request and the second being insufficient validation of user-supplied input when processing a special character. An attacker with knowledge of these...

CVE-2025-44073

SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admincommentnews.php...

MediaWiki < 1.39.9, 1.40.x < 1.41.3, 1.42.x < 1.42.2 Information Disclosure Vulnerability - Windows

MediaWiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MediaWiki < 1.39.9, 1.40.x < 1.41.3, 1.42.x < 1.42.2 Information Disclosure Vulnerability - Linux

MediaWiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

CVE-2025-27921

CVE-2025-27921 is a reflected XSS in Output Messenger prior to version 2.0.63 where user input is reflected in the web app response. Affected product: Output Messenger (client/web component). Mitigations reported: upgrade to version 2.0.63 or later; no exploitation of this CVE has been observed b...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

The vulnerability of UserGate Next-Generation Firewall (NGFW) and UserGate Web Application Firewall (WAF) at the web application level arises from the failure to implement measures to neutralize specific elements. This allows attackers to execute arbitrary operating system commands with maximum privileges.

The vulnerability of UserGate Next-Generation Firewall NGFW and UserGate Web Application Firewall WAF at the web application level is related to the failure to implement measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute any command on the...

CVE-2025-4213

A vulnerability has been found in PHPGurukul Online Birth Certificate System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit...

CVE-2025-27532

A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated lowprivileged attacker to access secret information via multiple crafted HTTP requests...

CVE-2025-24346

A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated lowprivileged attacker to manipulate the “/etc/environment” file via a crafted HTTP request...