EUVD-2025-24882

Malicious code in bioql PyPI...

EUVD-2024-48050

Malicious code in bioql PyPI...

CVE-2025-59412

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator...

CVE-2025-59412

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator...

CVE-2025-59412

CubeCart prior to version 6.5.11 is affected by an HTML injection in the product reviews feature. User-supplied input submitted in the review description can contain HTML tags; after an administrator approves the review, the injected HTML can render on the product page for all visitors, potential...

PT-2025-38744

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.5.11 Description CubeCart, an ecommerce software solution, has an issue in the product reviews feature. User-supplied input is not properly sanitized before display. An attacker can submit HTML tags within the revi...

Code-Projects Food Ordering Review System 注入漏洞

Code-Projects Food Ordering Review System is a Code-Projects open source food ordering review system. An injection vulnerability exists in Code-Projects Food Ordering Review System version 1.0, which originates from SQL injection due to incorrect operation of the parameter occupation in the file...

Projectworlds Car Rental Project 注入漏洞

Projectworlds Car Rental Project is a car rental project by Projectworlds India. An injection vulnerability exists in Projectworlds Car Rental Project version 1.0, which stems from improper handling of the ID parameter in the /admin/approve.php file, which could lead to an SQL injection attack...

GO-2025-3555 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server...

GHSA-CW7Q-5CGC-H3H9 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

CVE-2024-7747

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with...

CVE-2024-8810

A GitHub App installed in organizations could upgrade some permissions from read to write access without approval from an organization administrator. An attacker would require an account with administrator access to install a malicious GitHub App. This vulnerability affected all versions of GitHu...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is an open source application from GitHub in the United States. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. GitHub Enterprise Server suffers from a security vulnerability that...

CVE-2024-7049

Open-webui/open-webui is affected at version v0.3.8. The root issue is that a token is returned when a user with a pending role logs in, allowing actions without admin approval and bypassing the intended approval workflow. The CVE entry lists a moderate impact (CVSS ~5.4) with no explicit exploit...

PT-2024-38044 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui/open-webui version v0.3.8 Description: A vulnerability exists where a token is returned when a user with a pending role logs in, allowing the user to perform actions without admin confirmation and bypassing the intended approval...

Unsafe plugins can be installed via pack import by tenant admins

Summary Unsafe plugins for instance sql-list can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables Details I have an example https://bot20230704.saltcorn.com/view/allplugins It's publicly accessible but has not so secure values except lis...

SUSE CVE-2017-1000386

Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Acti...

inDrive: inDriver Job - Admin Approval Bypass

A vulnerability was discovered in the "inDriver Job" application that allowed an attacker to bypass the admin approval process for publishing job offers. This vulnerability enabled the attacker to publish arbitrary content without undergoing the necessary moderation step...

SideFX: Stored XSS in messages

The security issue described involves a stored cross-site scripting XSS vulnerability in the message functionality of the system. The vulnerability allowed an attacker to inject malicious code into messages, which could be executed when the victim viewed the message. This resulted in the attacker...

Reddit: Able to approve admin approval and change effective status without adding payment details .

Summary: In https://ads.reddit.com/ you can create campaign under which you can create ads , once you create new campaign , it is on pending stage and will not be delivered unless you add payment details and is reviewed by admin and approved according to what it says here...