CVE-2025-40646 Exposure of sensitive information in Viday

Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload...

ViDay 跨站脚本漏洞

ViDay is a business management platform from the Spanish company ViDay. ViDay suffers from a cross-site scripting vulnerability that originates from a JWT containing sensitive user information in an HTTP request, which could lead to information disclosure...

PT-2025-40330

Name of the Vulnerable Software and Affected Versions Viday affected versions not specified Description The software exhibits a flaw that could allow an attacker to obtain sensitive customer information. This is achieved by intercepting HTTP requests and locating JWTs within the request payload...

Neto CMS 安全漏洞

Neto CMS is an e-commerce platform from Neto Australia. A security vulnerability exists in Neto CMS versions v6.313.0 through v6.314.0 that originates from a specially crafted HTTP request resulting in a CRLF injection that may execute arbitrary code...

CVE-2025-10137 Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery

The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be...

Cisco Secure Firewall Threat Defense Software Web Services RCE (cisco-sa-http-code-exec-WmfP3h3O)

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability. - A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance ASA Software, Cisco Secure Firewall Threat Defense FTD Software, Cisco IOS Software, Cisco IOS...

CVE-2025-20363

CVE-2025-20363 affects Cisco Secure Firewall ASA/FTD web services and several Cisco IOS families. The issue arises from improper validation of user-supplied input in HTTP requests, allowing an unauthenticated remote attacker (ASA/FTD) or an authenticated, low-privilege remote attacker (IOS/IOS XE...

CVE-2025-20362

Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial...

CVE-2025-20333

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper...

CVE-2025-20333

CVE-2025-20333 affects Cisco Secure Firewall ASA/FTD VPN web server. The issue stems from improper validation of HTTP(S) input in VPN requests, allowing an authenticated remote attacker with VPN credentials to execute arbitrary code as root and potentially fully compromise the device. A related v...

Cisco Secure Firewall Adaptive Security Appliance和Cisco Secure Firewall Threat Defense 安全漏洞

Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense are both products of Cisco, Inc.Cisco Secure Firewall Adaptive Cisco Secure Firewall Adaptive Security Appliance is an enterprise-class firewall software.Cisco Secure Firewall Threat Defense is an integrate...

Out-of-bounds Write

Overview nvidia-pytriton is a PyTriton - Flask/FastAPI-like interface to simplify Triton's deployment in Python environments. Affected versions of this package are vulnerable to Out-of-bounds Write via the HTTP and Sagemaker request handler. An attacker could cause an out-of-bounds write through ...

CVE-2025-59055

InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery SSRF vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS...

CVE-2025-58422

RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may alter the values of HTTP requests, which could result in tampering with the operation history of the product’s management tool...

Linux Distros Unpatched Vulnerability : CVE-2020-28713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via a...

CVE-2025-34172 Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting

In pfSense CE /usr/local/www/haproxy/haproxystats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated...

CVE-2025-9269 Server-Side Request Forgery (SSRF) vulnerability found in embedded web server

A Server-Side Request Forgery SSRF vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerabili...

Cacti 1.3.x-DEV Remote Code Execution

Cacti version 1.3.x-DEV suffer from an unauthenticated remote code execution vulnerability. An attacker can exploit this issue by sending a specially crafted HTTP request to the affected application. A successful exploit could allow the attacker to execute arbitrary code on the target system. No...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 2.0.0 Vulnerability Details CVEID:CVE-2024-35195 DESCRIPTION: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cer...

CVE-2025-58422

RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may alter the values of HTTP requests, which could result in tampering with the operation history of the product’s management tool...