CVE-2025-13232

CVE-2025-13232 affects ProjectSend up to r1720, specifically the File Editor/Custom Download Aliases component. The issue is a cross-site scripting vulnerability arising from manipulation of an unknown function within that component, enabling remote exploitation. Public exploit exists and has bee...

CVE-2025-13232 projectsend File Editor/Custom Download Aliases cross site scripting

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to...

ProxyPrints: From Database Breach to Spoof, a Plug-And-Play Defense for Biometric Systems

Fingerprint recognition systems are widely deployed for authentication and forensic applications, but the security of stored fingerprint data remains a critical vulnerability. While many systems avoid storing raw fingerprint images in favor of minutiae-based templates, recent research shows that...

CVE-2025-13232: Improper Neutralization of Input During Web Page Generation

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to...

ProjectSend 代码注入漏洞

ProjectSend cFTP is the ProjectSend open source suite of self-hosted applications based on PHP and MySQL. A code injection vulnerability exists in ProjectSend r1720 and earlier versions, which stems from a misbehavior of the component File Editor/Custom Download Aliases and could lead to cross-si...

PT-2025-47065

Name of the Vulnerable Software and Affected Versions ProjectSend versions prior to r1945 Description A cross-site scripting issue exists in ProjectSend up to version r1720. The flaw is located within the File Editor/Custom Download Aliases component and involves an unknown function. This...

MAL-2025-97965 Malicious code in joknmax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8111feb6be17602c754b0aedb06077ee900000e429239376d7c9b780145745e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joni-tomat13-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5af24c1c5245f395413dc332fbf7c96127492c077c7ffe8cada6b0ac8346d194 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helpful_wildfowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aa2ee9ff17fcc6644f9fd222674b0d80146ea106997ded9bc3a0cfa47e3b87a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-lapis24-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a6d951f052f0b01745b35a24529dbd208b57116316c125741bdc8503a3470c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20251105T184115 2025-11-05T18:41:15Z. jscPED-11136: Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3987 GHSA-fmjh-f678-cv3x GO-2025-3988 GHSA-wpwj-69cm-q9c5 GO-2025-3999 GHSA-3g72-chj4-2228...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20251023T162509 2025-10-23T16:25:09Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3979 CVE-2025-59824 GHSA-hqrf-67pm-wgfq GO-2025-3981 CVE-2025-59823 GHSA-227x-7mh8-3cf6...

SUSE-SU-2025:3799-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20251023T162509 2025-10-23T16:25:09Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3979 CVE-2025-59824 GHSA-hqrf-67pm-wgfq GO-2025-3981 CVE-2025-59823 GHSA-227x-7mh8-3cf6...

EUVD-2025-34075

CommandKit has incorrect command name exposure in context object for message command aliases...

CommandKit has incorrect command name exposure in context object for message command aliases

Impact A logic flaw exists in the message command handler of CommandKit that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling command aliases. When a message command is invoked using an alias, the ctx.commandName value...

GHSA-FHWM-PC6R-4H2F CommandKit has incorrect command name exposure in context object for message command aliases

Impact A logic flaw exists in the message command handler of CommandKit that affects how the commandName property is exposed to both middleware functions and command execution contexts when handling command aliases. When a message command is invoked using an alias, the ctx.commandName value...

OESA-2025-2379 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are subject to S...

OESA-2025-2378 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are subject to S...

django: Django SQL injection in FilteredRelation column aliases

An SQL injection flaw has been discovered in the Django web framework. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...

django: Django SQL injection in FilteredRelation column aliases

An SQL injection flaw has been discovered in the Django web framework. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...