Exploit for Deserialization of Untrusted Data in Apache Parquet_Java

Canary Exploit for Parquet CVE-2025-30065...

The vulnerability of the SAP NetWeaver Application Server ABAP software integration platform, related to the lack of measures for cleaning input data, allows attackers to execute cross-site scripting attacks (XSS).

The vulnerability of the software for developing and executing applications in the ABAP language of SAP NetWeaver Application Server is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS...

CVE-2025-43948

creationtimestamp| type| source ---|---|--- 2025-04-22 21:04:13+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12976 2025-04-22 21:09:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lngln2qcq52y 2025-04-22 22:35:23+00:00| seen|...

CVE-2025-32950

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4, attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server...

io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage

Impact Attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful...

CVE-2024-13569

creationtimestamp| type| source ---|---|--- 2025-04-22 07:03:23+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12809 2025-04-22 07:04:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnf4gmpr7s2a 2025-04-22 10:02:36+00:00| seen|...

CVE-2025-43949

MuM aka Mensch und Maschine MapEdit aka mapedit-web 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that control a web application's database server...

CVE-2025-32790

creationtimestamp| type| source ---|---|--- 2025-04-18 12:58:23+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12419 2025-04-18 14:55:37+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ln3uuk2l7ws2 2025-04-18...

CVE-2025-32790 Dify Allows Insecure User Role Access Control for APP DSL Exporting

Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for...

IBM Security Verify Governance Cross-Site Scripting Vulnerability (CNVD-2025-09286)

IBM Security Verify Governance is an intelligent identity access platform from International Business Machines IBM, Inc. provides organizations with a platform to analyze, define and control user access and access risk. A cross-site scripting vulnerability exists in IBM Security Verify Governance...

CVE-2025-39567

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through = 1.7.8...

PT-2025-16972 · Unknown · Studio Hyperset The Great Firewords Of China

Name of the Vulnerable Software and Affected Versions: Studio Hyperset The Great Firewords of China versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an...

PT-2025-17042 · Unknown · Eazy Under Construction

Name of the Vulnerable Software and Affected Versions: Eazy Under Construction versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

CVE-2025-32859

The CVE-2025-32859 entry concerns Siemens TeleControl Server Basic prior to version V3.1.2.2, which is vulnerable to SQL injection via the internal LockWebServerGatewaySettings method. An authenticated attacker who can reach port 8000 can bypass authorization and read/write the application databa...

PT-2025-16266 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is an XPath injection vulnerability that could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document...

Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)

Exploit Title: Roundcube Webmail 1.6.6 - Stored Cross Site Scripting XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6 t...

Apache OFBiz Cross-Site Scripting Vulnerability (CNVD-2025-10035)

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A cross-site scripting vulnerability exists in Apache OFBiz versions prior to 18.12.19, which stems from th...

CVE-2023-37930

creationtimestamp| type| source ---|---|--- 2025-04-08 14:47:17+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10924 2025-04-08 17:22:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmcygegpo62u 2025-04-08 18:11:08+00:00| seen| https://t.me/cvedetector/22471...

CVE-2025-30280

A vulnerability has been identified in Mendix Runtime V10 All versions V10.21.0, Mendix Runtime V10.12 All versions V10.12.16, Mendix Runtime V10.18 All versions V10.18.5, Mendix Runtime V10.6 All versions V10.6.22, Mendix Runtime V8 All versions V8.18.35, Mendix Runtime V9 All versions V9.24.34...

CVE-2025-31332

creationtimestamp| type| source ---|---|--- 2025-04-08 07:46:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10858 2025-04-08 09:18:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmc5ect2ru2i 2025-04-08 11:28:59+00:00| seen| https://t.me/cvedetector/22414...