Tables app share information not limited to relevant users

None...

Users with read-only permissions for team folder can restore deleted files from trash bin

None...

Approval app allows users to request approval for other users file

None...

Calendar app allowed booking appointments without the generated token

None...

Deck app allows to spoof file extensions by using RTLO characters

None...

Calendar attachments of local files are offered to downloaded

None...

Missing ownership check in Tables app allows moving columns into tables of other users

None...

Tables app allowed users to view columns metadata information of any table

None...

Stored XSS in contacts app via organisation and title field

None...

Participants were able to blindly delete poll drafts of other users by ID

None...

Deck app allowed user with "Can share" permission to modify permissions of other non-owners

None...

Exploit for CVE-2025-55182

CVE-2025-55182-exp 🔥 Overview CVE-2025-55182 is a cri...

OPPO ColorOS 安全漏洞

OPPO ColorOS is a suite of Android-based operating systems for mobile devices from Chinese company OPPO. A security vulnerability exists in OPPO ColorOS, which stems from improper validation of the source of application installation, which may result in malicious applications being installed...

CVE-2025-14111: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Such manipulation leads to path traversal. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is...

CVE-2025-14086: Improper Access Control

A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of the argument openid results in improper access controls. The attack can be executed remotely. The exploit has been made public and could be...

CVE-2025-14085: Improper Control of Dynamically-Identified Variables

A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. Remote exploitation of the attack is possible. The exploi...

RARLAB RAR App 路径遍历漏洞

RARLAB RAR App is a compression, decompression and file management software from RARLAB, Inc. A path traversal vulnerability exists in Rarlab RAR App 7.11 Build 127 and earlier versions, which stems from a path traversal issue in the component com.rarlab.rar, and could lead to a remote attack...

PT-2025-49300

Name of the Vulnerable Software and Affected Versions Nextcloud Contacts app versions prior to 5.5.4 Nextcloud Contacts app versions prior to 6.0.6 Nextcloud Contacts app versions prior to 7.2.5 Description A malicious user could modify the organisation and title fields to load additional CSS...

CVE-2025-66515: Improper Authentication

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerabilit...

CVE-2025-66554: Improper Neutralization of Input During Web Page Generation

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. Prior to 5.5.4, 6.0.6, and 7.2.5, a malicious user was able to modify their organisation and title field to load additional CSS files. Javascript and other options were correctly blocked ...