CVE-2025-24361 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script b...

CVE-2025-24361

The CVE-2025-24361 issue affects Nuxt (Vue.js) dev-server workflow: when using webpack (3.0.0–3.15.12) or rspack (3.12.2–3.152) builders, loading a malicious site can trigger source-code exposure. Attacker can use Function::toString on window.webpackChunknuxt_app values to reveal the Nuxt source....

Nuxt 安全漏洞

Nuxt is a free open source framework from Nuxt Open Source. A security vulnerability exists in Nuxt version 3.0.0 through versions prior to 3.15.3, which stems from a potential source code theft during development if a victim opens a malicious website...

The vulnerability of the sub_422eb8 function in Linksys E8450 Wi-Fi router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the sub422eb8 function in Linksys E8450 Wi-Fi routers’ microprogramming software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

WordPress InspiryThemes RealHomes Theme Privilege Escalation Vulnerability (Jan 2025)

The WordPress theme RealHomes by InspiryThemes is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

New Research: The State of Web Exposure 2025

Are your websites leaking sensitive data? New research reveals that 45% of third-party apps access user info without proper authorization, and 53% of risk exposures in Retail are due to the excessive use of tracking tools. Learn how to uncover and mitigate these hidden threats and risks—download...

The vulnerability of the Microsoft Update Catalog’s update website, related to deserialization mechanism flaws, allows attackers to escalate their privileges.

The vulnerability in the Microsoft Update Catalog’s update website is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Malicious code in passkeys-resources-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5256b8944e68915e19451b582ae574907838c2157234efe3f5290b6330ac3439 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24019

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager FPM on the host without any limitation on the filesystem's scope...

CVE-2025-24019

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager FPM on the host without any limitation on the filesystem's scope...

CVE-2024-12104: Missing Authorization

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfdeletefile and wpfdeletefile functions in all versions up to, and including, 4.0.9. This makes it possible for...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from the lack of protective measures for website structures, allowing attackers to trigger service interruptions.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the lack of protective measures for website structures, allowing attackers to execute arbitrary code.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from the redirection of the URL to an unreliable website, allowing attackers to carry out phishing attacks.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks remotely...

The vulnerability of the CyberPanel web hosting control panel, related to the lack of protective measures for the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the CyberPanel web hosting panel is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Vulnerability of the Accounting.php script (/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php) in the PhpSpreadsheet library, which allows attackers to perform cross-site scripting attacks.

The vulnerability in the Accounting.php script /phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php of the PhpSpreadsheet library is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to perform cross-site...

The vulnerability of the web interface of the IBM Sterling B2B Integrator software allows a perpetrator to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the web interface of the IBM Sterling B2B Integrator software solution relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code and gain unauthorized access to protected...

autoglasswarehouse.com.au Cross Site Scripting vulnerability OBB-4012647

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Teradata Vantage Editor 安全漏洞

Teradata Vantage Editor is a new lightweight SQL editor from Teradata Corporation. A security vulnerability exists in Teradata Vantage Editor version 1.0.1 and prior versions, which stems from the presence of unexpected functionality that could cause a client user to access an arbitrary remote We...

CVE-2024-52870

The Teradata Vantage Editor version 1.0.1 and prior versions contain a security vulnerability due to the presence of unintended functionality, specifically the inclusion of Chromium Developer Tools . This flaw allows a client user to access arbitrary remote websites , potentially leading to unaut...