Apache OFBiz Cross-Site Scripting Vulnerability (CNVD-2025-10035)

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A cross-site scripting vulnerability exists in Apache OFBiz versions prior to 18.12.19, which stems from th...

CVE-2023-37930

creationtimestamp| type| source ---|---|--- 2025-04-08 14:47:17+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10924 2025-04-08 17:22:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmcygegpo62u 2025-04-08 18:11:08+00:00| seen| https://t.me/cvedetector/22471...

CVE-2025-30280

A vulnerability has been identified in Mendix Runtime V10 All versions V10.21.0, Mendix Runtime V10.12 All versions V10.12.16, Mendix Runtime V10.18 All versions V10.18.5, Mendix Runtime V10.6 All versions V10.6.22, Mendix Runtime V8 All versions V8.18.35, Mendix Runtime V9 All versions V9.24.34...

CVE-2025-31332

creationtimestamp| type| source ---|---|--- 2025-04-08 07:46:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10858 2025-04-08 09:18:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmc5ect2ru2i 2025-04-08 11:28:59+00:00| seen| https://t.me/cvedetector/22414...

CVE-2025-3426

We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-enginee...

CVE-2024-56475

creationtimestamp| type| source ---|---|--- 2025-04-02 19:07:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llu3i4vig224 2025-04-02 20:50:51+00:00| seen| https://t.me/cvedetector/21910...

Internet Bug Bounty: Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

The Apache Airflow Fab Provider before version 1.5.2 was affected by an insufficient session expiration vulnerability. When a user's password was changed using the admin CLI, the existing user sessions were not cleared, allowing logged-in users to continue accessing the system even after the...

PT-2025-14268 · Infoway Llc · Infoway Llc Ebook Downloader

Name of the Vulnerable Software and Affected Versions: Infoway LLC Ebook Downloader versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker c...

PT-2025-14129 · Unknown · Leadquizzes

Name of the Vulnerable Software and Affected Versions: LeadQuizzes versions 1.1.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious script...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Title/Body source fields. An attacker can inject malicious scripts by crafting malicious input to these fields. Details...

CVE-2025-1734

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when receiving headers from HTTP server, the headers missing a colon : are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers...

The vulnerability of the Application Security (AppSec) module of a software platform based on Git for collaborative code development on GitLab allows attackers to perform cross-site scripting attacks.

The vulnerability of the Application Security AppSec module of a Git-based software development platform for collaborative code editing on GitLab is related to the lack of protective measures for website structures. Exploiting this vulnerability allows an attacker operating remotely to perform...

CVE-2025-2909 Lack of encryption vulnerability in DuoxMe

The lack of encryption in the DuoxMe formerly Blue application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information...

CVE-2025-2909 Lack of encryption vulnerability in DuoxMe

The lack of encryption in the DuoxMe formerly Blue application binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorised access to the application code and discover sensitive information...

CVE-2025-2909

CVE-2025-2909 affects DuoxMe (iOS) prior to version 3.3.1. The root cause is lack of encryption in the application binary, allowing an attacker to gain unauthorised access to the app code and discover sensitive information. Public details in connected documents explicitly describe the vulnerabili...

CVE-2025-30847

CVE-2025-30847: Stored XSS in the Novelist WordPress plugin (Novelist) affecting versions up to 1.2.3. Exploitation requires authentication (Administrator+). Patch available to address the issue; affected range is from n/a through 1.2.3; CVSS v3.1 base score 5.9 (Medium).

PT-2025-13000 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: Gitlab EE/CE versions 13.5.0 through 17.8.6 Gitlab EE/CE versions 17.9 through 17.9.3 Gitlab EE/CE versions 17.10 through 17.10.1 Description: An issue has been discovered in Gitlab EE/CE for AppSec affecting certain versions. Certain error...

ROS-20250326-04

A vulnerability in the Ruby Sinatra web application development framework is related to causing an Open Redirect Attack Attack by inserting an arbitrary address into this header. Exploiting the vulnerability allows an attacker, acting remotely, to gain access to sensitive data...

How to Create a Scan in Perl to Identify Vulnerable Telnet Servers

This paper, written in Brazilian Portuguese, explains how to create a Perl script to identify vulnerable telnet servers. In the context of application security, the author provides mitigation recommendations...

CVE-2025-2748 Kentico Xperience stored cross-site scripting in multiple-file upload functionality

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178...