17079 matches found
LibreNMS 安全漏洞
LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A cross-site scripting vulnerability exists in LibreNMS that stems from insufficient...
CVE-2025-62380
Mailgen (Node.js) versions up to 2.0.31 expose an HTML injection/XSS risk in plaintext output generated by generatePlaintext. The plaintext cleaning code strips HTML tags with a regex, decodes HTML entities, and then replaces decoded content; however, HTML tags containing certain Unicode line sep...
WordPress plugin Theme Importer 跨站请求伪造漏洞
WordPress Theme Importer plugin is mainly used to import website content such as pages, menus, images, etc. from other platforms or websites into WordPress for quick migration or rebuilding of websites. The WordPress Theme Importer plugin suffers from a cross-site request forgery vulnerability,...
EUVD-2025-34426
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability...
CVE-2025-11718
CVE-2025-11718 affects Mozilla Firefox versions earlier than 144. The issue allows a malicious page to spoof the address bar by creating a fake bar in response to a visibilitychange event when the Android address bar is hidden after scrolling. Impact is spoofing UI and potential user deception; n...
webkitgtk: A website may be able to access sensor information without user consent
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches...
webkitgtk: A website may be able to access sensor information without user consent
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches...
WeGIA 跨站脚本漏洞
WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A cross-site scripting vulnerability exists in WeGIA versions prior to 3.5.0 that stems from insufficient cleaning and escaping of the idpet parameter, which could lead to a reflective cross-site scriptin...
Thwarting AI Bots with Edge Content Rewriting
...
EUVD-2025-33889
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site...
CVE-2025-11631 RainyGao DocSys deleteDoc.do path traversal
A vulnerability was determined in RainyGao DocSys up to 2.02.36. Affected by this vulnerability is an unknown functionality of the file /Doc/deleteDoc.do. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly...
PT-2025-41715
Name of the Vulnerable Software and Affected Versions HCL Unica Platform affected versions not specified Description The HCL Unica Platform is affected by improperly configured security-related HTTP headers. This configuration can result in browsers applying less secure default settings for...
Cross-site Scripting (XSS)
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the improper validation of specified type of input. An attacker can execute arbitrary JavaScript...
Cross-site Scripting (XSS)
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper input neutralization in the web page generation in Vega visualizations. An attacker can...
CVE-2025-41089 Reflected Cross-Site Scripting (XSS) in CMS
Reflected Cross-Site Scripting XSS in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add an element that has the 'Configuration Name' field, such as the 'Clock'...
EUVD-2025-33661
The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted...
Web Developer for Chrome 安全漏洞
Web Developer for Chrome is a browser developer extension by Chris Pederick Personal Developer. A security vulnerability exists in Web Developer for Chrome version 0.4.9, which stems from malicious code that generates a domain name and obtains remote scripts via DGA, which could lead to user-leve...
CVE-2025-11416 PHPGurukul Beauty Parlour Management System invoices.php sql injection
A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/invoices.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been released to th...