CVE-2025-62256

creationtimestamp| type| source ---|---|--- 2025-10-23 15:20:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3unxbc5662o...

CVE-2025-61301

creationtimestamp| type| source ---|---|--- 2025-10-20 21:00:56+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115408506440457376 2025-10-21 01:20:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3o62rkrt22h...

CVE-2025-35059

Newforma Info Exchange NIX '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter...

CVE-2023-7311

creationtimestamp| type| source ---|---|--- 2025-10-16 21:02:37+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m3dnrlem7o27 2026-05-18 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2026-05-18 2026-05-22 00:00:00+00:00| exploited| The...

CVE-2025-54658

creationtimestamp| type| source ---|---|--- 2025-10-16 16:43:38+00:00| seen| https://gist.github.com/Darkcrai86/b4da33d01b6276bae1786afc8e2b6e3e...

CVE-2025-62376 pwn.college DOJO vulnerable to improper authentication in workspace endpoint allowing unauthorized Windows VM access

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef, the /workspace endpoint contains an improper authentication vulnerability that allows an attacker to access any active Windows VM without proper authorization. The...

AndSoft e-TMS Cross-Site Scripting Vulnerability (CNVD-2025-23539)

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the file...

GHSA-5M9M-J5P7-M7F9 Casdoor is vulnerable to Improper Authorization

An issue in the permission verification module and organization/application editing interface in Casdoor before 2.63.0 allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after log...

GHSA-4789-QFC9-5F9Q

creationtimestamp| type| source ---|---|--- 2025-10-07 19:38:33+00:00| seen| https://seclists.org/oss-sec/2025/q4/17...

CVE-2025-11332 CmsEasy URL view.php cross site scripting

A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing a manipulation of the argument PHPSELF can lead to cross site scripting. The attack may be launched remotely. The exploit has been public...

EUVD-2025-29526

Malicious code in bioql PyPI...

EUVD-2022-4243

Malicious code in bioql PyPI...

EUVD-2022-52181

Malicious code in bioql PyPI...

EUVD-2025-32121

Malicious code in bioql PyPI...

CVE-2025-59772 Multiple vulnerabilities in AndSoft's e-TMS

Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and...

CVE-2025-59762

CVE-2025-59762 is a reflected XSS in AndSoft e-TMS v25.03. The vulnerability stems from insufficient validation of the parameters l, demo, demo2, TNTLOGIN, UO and SuppConn in /clt/LOGINFRM_DLG.ASP, enabling an attacker to inject JavaScript via a malicious URL. Documented across NVD/CVE records an...

CVE-2025-46148

creationtimestamp| type| source ---|---|--- 2025-09-24 05:17:18+00:00| seen| https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a 2025-09-25 14:33:51+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115265426624032158...

Cross-site Scripting (XSS)

Overview @meshconnect/web-link-sdk is an A client-side JS library for integrating with Mesh Connect Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createLink.openLink function. An attacker can execute arbitrary JavaScript code in the context of the parent pag...

0xtrails (>=0.1.9 <=0.6.6), @aarc-dev/deposit-widget (>=0.3.0 <=0.4.47) +11 more potentially affected by CVE-2025-59430 via @meshconnect/web-link-sdk (>=3.0.2 <=3.2.14)

@meshconnect/web-link-sdk NPM version =3.0.2, =0.1.9, =0.3.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.4, =1.0.0, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.5 Source cves: CVE-2025-59430 Source advisory: SNYK:JS-MESHCONNECTWEBLINKSDK-13004671...

0xtrails (>=0.1.9 <=0.6.6), @aarc-dev/deposit-widget (>=0.3.0 <=0.4.47) +13 more potentially affected by CVE-2025-59430 via @meshconnect/web-link-sdk (>=2.1.1 <=3.2.14)

@meshconnect/web-link-sdk NPM version =2.1.1, =0.1.9, =0.3.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.4, =0.1.15, =0.0.2, =1.0.0, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.5 Source cves: CVE-2025-59430 Source advisory: OSV:GHSA-VH3F-QPPR-J97F...