CVE-2025-42990

Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted...

CVE-2025-42989

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application...

CVE-2024-41504

Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting XSS. In the "Oportunidades" opportunities section of the application when creating or editing an "Atividade" activity, the form field "Descrico" allows injection of JavaScript...

Huawei HarmonyOS Deserialization Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a deserialization vulnerability, which arises from unsafe deserialization of serialized data received by an application from a...

PT-2025-24185 · Unknown · Alessandro Piconi Simple Keyword To Link

Name of the Vulnerable Software and Affected Versions: Alessandro Piconi Simple Keyword to Link versions 1.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attac...

PT-2025-24159 · Shamil Shafeev · 'Подсказки' От Dadata.Ru

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shamil Shafeev «Подсказки» от DaData.ru allows Stored XSS. This issue affects «Подсказки» от DaData.ru: from n/a through 1.0.6...

CVE-2025-5666

creationtimestamp| type| source ---|---|--- 2025-06-05 16:00:53+00:00| published-proof-of-concept| Telegram/A-y2hlt3NyCckM2xKlWbOeh88hUhPwc1MHtx9ZiUH06LUZA 2025-06-05 18:42:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lquxxd3f232p...

Django 4.x < 4.2.22, 5.0.x < 5.1.10, 5.2.x < 5.2.2 Log Injection Vulnerability - Windows

Django is prone to a log injection vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if...

Grafana 11.0.x < 11.0.5 Multiple Vulnerabilities

According to its self-reported version, the Grafana install hosted on the remote host is 10.3.x earlier than 10.3.10, or 10.4.x earlier than 10.4.9, or 11.0.x earlier than 11.0.5, or 11.1.x earlier than 11.1.6, or 11.2.x earlier than 11.2.1. It is, therefore, affected by multiple vulnerabilities:...

Grafana 9.3.x < 9.3.13 Exposure Of Sensitive Information To An Unauthorized Actor

According to its self-reported version, the Grafana install hosted on the remote host is 9.2.x earlier than 9.2.17, or 9.3.x earlier than 9.3.13, or 9.4.x earlier than 9.4.9. It is, therefore, affected by a exposure of sensitive information to an unauthorized actor vulnerability. Note that the...

Grafana 10.3.x < 10.3.4 Improper Privilege Management

According to its self-reported version, the Grafana install hosted on the remote host is 8.5.x earlier than 9.5.7, or 10.0.x earlier than 10.0.12, or 10.1.x earlier than 10.1.8, or 10.2.x earlier than 10.2.5, or 10.3.x earlier than 10.3.4. It is, therefore, affected by a improper privilege...

Introducing AI Attack Coverage in Exposure Command: Secure what traditional AppSec Tools miss

The rise of GenAI-powered applications – from internal copilots to customer-facing chatbots – is changing how businesses operate. While these tools drive innovation, they also introduce a fast moving, often invisible layer of risk. Most traditional AppSec tools were never built to handle the uniq...

CVE-2017-7178

creationtimestamp| type| source ---|---|--- 2025-06-03 14:00:00+00:00| seen| https://github.blog/security/application-security/dns-rebinding-attacks-explained-the-lookup-is-coming-from-inside-the-house/ 2026-02-11 08:11:05+00:00| seen|...

CVE-2024-13915 Unrestricted Access to Exported Service in com.pri.factorytest

Android based smartphones from vendors such as Ulefone and Krüger&Matz contain "com.pri.factorytest" application preloaded onto devices during manufacturing process. The application "com.pri.factorytest" version name: 1.0, version code: 1 exposes a ”com.pri.factorytest.emmc.FactoryResetService“...

PT-2025-23317 · Hcl · Hcl Traveler For Microsoft Outlook

Name of the Vulnerable Software and Affected Versions: HCL Traveler for Microsoft Outlook HTMO affected versions not specified Description: The issue is related to a COM hijacking vulnerability. This vulnerability could allow an attacker to modify or replace the application with malicious content...

MINI-RHCJ-CWJ5-QPXW

Bulletin has no description...

CVE-2025-45997

Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can upload a PHP file disguised as an image by modifying the Content-Type header to image/jpg...

CVE-2025-20621

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel...

SafeLine WAF: Open Source Web Application Firewall with Zero-Day Detection and Bot Protection

From zero-day exploits to large-scale bot attacks — the demand for a powerful, self-hosted, and user-friendly web application security solution has never been greater. SafeLine is currently the most starred open-source Web Application Firewall WAF on GitHub, with over 16.4K stars and a rapidly...

CVE-2024-3455

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addpostlogin.php. The manipulation of the argument SingleLoginId leads to sql injection. The attack can b...