CVE-2025-4529

CVE-2025-4529 affects Seeyon Zhiyuan OA Web Application System 8.1 SP2. The vulnerability lies in the Download function of the ZIP File Handler within seeyon-apps-m3.jar (M3CoreController.class): manipulating the Name argument enables path traversal. Remote exploitation is possible and the exploi...

CVE-2025-28202

creationtimestamp| type| source ---|---|--- 2025-05-09 18:32:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lor2rsi53z2o 2025-05-09 20:23:32+00:00| seen| https://t.me/cvedetector/24965...

CVE-2024-58098

creationtimestamp| type| source ---|---|--- 2025-05-05 16:16:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3logrd7ubfp2w 2025-05-09 08:25:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15705 2026-03-19 00:00:00+00:00| seen|...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

CVE-2025-27921

A reflected cross-site scripting (XSS) vulnerability exists in Output Messenger versions prior to 2.0.63 . The flaw is caused by the application reflecting user-controlled input back into the web response without proper sanitization or encoding , allowing for the injection of malicious scripts. W...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

@cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

Summary The OAuth implementation failed to check that redirecturi was among the allowed set for the clientid. Impact Under certain circumstances see below, if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visitin...

PHPGurukul Boat Booking System 注入漏洞

PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. An injection vulnerability exists in version 1.0 of the PHPGurukul Boat Booking System, which stems from SQL injection due to incorrect manipulation of the parameter ID in the file /admin/change-image.php...

CVE-2025-24343

A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to write arbitrary files in arbitrary file system paths via a crafted HTTP request...

CVE-2025-24339

CVE-2025-24339 involves the web application of ctrlX OS. The vulnerability allows a remote, unauthenticated attacker to perform various attacks against users of the vulnerable system, including web cache poisoning and Man-in-the-Middle (MitM) via a crafted HTTP request. The CVSS 3.1 base metrics ...

Unspecified Vulnerability in Tenable Network Security Nessus

Tenable Network Security Nessus is a network vulnerability scanning tool developed by Tenable Network Security to detect security vulnerabilities and configuration errors in operating systems, network devices, and applications. Tenable Network Security Nessus contains a security vulnerability tha...

CVE-2025-46538

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webplanetsoft Inline Text Popup inline-text-popup allows DOM-Based XSS.This issue affects Inline Text Popup: from n/a through = 1.0.0...

CVE-2025-27540

A vulnerability has been identified in TeleControl Server Basic All versions V3.1.2.2. The affected application is vulnerable to SQL injection through the internally used 'Authenticate' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and...

IBM Sterling Control Center Cross-Site Scripting Vulnerability (CNVD-2025-09285)

IBM Sterling Control Center is an application system from International Business Machines IBM. A centralized monitoring and management system. IBM Sterling Control Center suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping o...

Cisco Secure Network Analytics Data Forgery Issue Vulnerability

Cisco Secure Network Analytics is a network security solution designed to provide enterprise-wide network visibility and advanced threat detection and response capabilities. Cisco Secure Network Analytics is vulnerable to a data forgery issue, which can be exploited by a remote attacker to submit...

CVE-2025-32795 Dify Allows Insecure User Role Access Control for APP Editing

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite...

CVE-2025-32795

CVE-2025-32795 affects Dify, an open-source LLM app development platform. Prior to version 0.6.12, a misconfigured access control allowed normal/non-admin users to edit app details (names, descriptions, icons) despite not having permission to view apps, compromising integrity. Root cause: insuffi...

CVE-2025-3698

Interface exposure vulnerability in the mobile application com.transsion.carlcare may lead to information leakage risk...

Tenable Network Security Nessus 安全漏洞

Tenable Network Security Nessus is a network vulnerability scanning tool developed by Tenable Network Security to detect security vulnerabilities and configuration errors in operating systems, network devices, and applications. Tenable Network Security Nessus contains a security vulnerability tha...

CVE-2025-25983

The Macro-video Technologies Co.,Ltd V380 Pro android application, specifically versions 2.1.44 and 2.1.64 , contains a security vulnerability in the QE code based sharing component . This flaw allows an attacker to obtain sensitive information . To mitigate the risk, it is recommended to disable...