EUVD-2023-3317

Malicious code in bioql PyPI...

EUVD-2025-31394

Malicious code in bioql PyPI...

EUVD-2025-28137

Malicious code in bioql PyPI...

EUVD-2025-10989

Malicious code in bioql PyPI...

EUVD-2024-1892

Malicious code in bioql PyPI...

EUVD-2025-3999

Malicious code in bioql PyPI...

EUVD-2023-2944

Malicious code in bioql PyPI...

EUVD-2022-5105

Malicious code in bioql PyPI...

EUVD-2025-26374

Malicious code in bioql PyPI...

EUVD-2025-5567

Malicious code in bioql PyPI...

EUVD-2023-3064

Malicious code in bioql PyPI...

EUVD-2025-24930

Malicious code in bioql PyPI...

EUVD-2025-30532

Malicious code in bioql PyPI...

CVE-2025-9209

The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated...

CVE-2025-40646

CVE-2025-40646 describes a Stored Cross-Site Scripting (XSS) in Energy CRM v2025 by Status Tracker Ltd. The vulnerability arises from insufficient validation of user input in a POST to /crm/create_job_submit.php, using the JobCreatedBy parameter. An attacker could craft a request that, when viewe...

CVE-2025-40646 Exposure of sensitive information in Viday

Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload...

CVE-2025-40646 Multiple vulnerabilities in Energy CRM by Status Tracker

Stored Cross-Site Scripting XSS vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/createjobsubmit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote...

CVE-2025-59685

Kazaar 1.25.12 allows a JWT with none in the alg field...

PT-2025-41596

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.5 Description Authlib, a Python library for building OAuth and OpenID Connect servers, has an issue in its JOSE implementation. It accepts JWS/JWT header and signature segments without size limits. An attacker can...

ViDay 跨站脚本漏洞

ViDay is a business management platform from the Spanish company ViDay. ViDay suffers from a cross-site scripting vulnerability that originates from a JWT containing sensitive user information in an HTTP request, which could lead to information disclosure...