Drupal XSS Vulnerability (SA-CORE-2025-004) - Linux

Drupal is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Tiki Wiki CMS Groupware <= 29.0 Multiple XSS Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Tiki Wiki CMS Groupware < 28.0 Multiple Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Akamai

Akamai CVE-2025-30143 - WAF Bypass in Akamai ASE Applicat...

CVE-2025-2081

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients...

CVE-2024-34398

An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers...

CVE-2024-54449

The CVE-2024-54449 entry describes a flaw in LogicalDOC’s document API where two endpoints allow an authenticated user (with read/write on an existing document) to write arbitrary files to the server’s filesystem, enabling potential remote code execution. Affected component: the document-manageme...

CVE-2025-25245

SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...

CVE-2025-2081

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients...

CVE-2025-2081 Use of Hard-Coded, Security-Relevant Constants

Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients...

CVE-2025-2081

CVE-2025-2081 affects Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool (version 3.1.2rc11). The vulnerability arises from an impersonation of the web application service, enabling misdirection of victim clients. Related ICS/CISA documentation notes a hard-coded s...

CVE-2024-34398

An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers...

CVE-2024-34398

An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers...

CVE-2024-34398

An issue was discovered in BMC Remedy Mid Tier 7.6.04. The web application allows stored HTML Injection by authenticated remote attackers...

PT-2025-11110

Name of the Vulnerable Software and Affected Versions: BMC Remedy Mid Tier version 7.6.04 Description: The web application in BMC Remedy Mid Tier allows stored HTML Injection by authenticated remote attackers. Recommendations: For BMC Remedy Mid Tier version 7.6.04, consider restricting access to...

CVE-2025-25245

SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...

CVE-2025-25245

CVE-2025-25245 affects SAP BusinessObjects BI Platform (Web Intelligence). A deprecated web application endpoint that is not properly secured allows injection of a malicious URL via data returned to the user, enabling cross-site scripting within the victim’s browser. Impacts are limited to confid...

CVE-2025-25245 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...

Fortinet FortiWeb Web application firewall rules bypass by using an empty filename (FG-IR-23-115)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-23-115 advisory. - Two improper handling of syntactically invalid structure vulnerabilities CWE-228 in FortiWeb may allowan...

PT-2025-10998

Name of the Vulnerable Software and Affected Versions: Optigo Networks Visual BACnet Capture Tool version 3.1.2rc11 Optigo Visual Networks Capture Tool version 3.1.2rc11 Description: The issue allows an attacker to impersonate the web application service, potentially misleading victim clients...