38949 matches found
PT-2025-15285 · Unknown · Cs2-Weaponpaints-Website
Name of the Vulnerable Software and Affected Versions: CS2-WeaponPaints-Website version 2.1.7 Description: A vulnerability exists in the errorpage.php file where user-controlled input is not adequately validated before being processed. Specifically, the errorcode parameter in the $ GET supergloba...
LinkedIn: HTML Injection in LinkedIn Premium Support Chat
The vulnerability exists in the LinkedIn Premium support chat interface where unsanitized HTML input was rendered directly in the chat window. An attacker could have exploited this by injecting malicious HTML such as clickable links, potentially leading to phishing or redirection attacks on...
CVE-2025-3318
A vulnerability classified as critical was found in KenjFrog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. The manipulation of the argument sort leads to sql injection. T...
CVE-2025-3306
A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /don.php. The manipulation of the argument fullname leads to sql injection. The attack may be initiated remotely. The exploit has been...
CVE-2025-0279
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and...
CVE-2025-3296
CVE-2025-3296 affects SourceCodester Online Eyewear Shop 1.0. The vulnerability is an SQL injection caused by improper handling of the ID parameter in /classes/Users.php?f=delete_customer, allowing remote exploitation. Descriptions across multiple sources confirm a critical issue with variant CVS...
CVE-2025-3144
A vulnerability classified as problematic was found in MindSpore 2.5.0. Affected by this vulnerability is the function mindspore.numpy.fft.hfftn. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and ma...
gitoxide does not detect SHA-1 collision attacks
Summary gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. Details gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct G...
GHSA-2FRX-2596-X5R6 gitoxide does not detect SHA-1 collision attacks
Summary gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. Details gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct G...
CVE-2025-3254 xujiangfei admintwo add server-side request forgery
A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has bee...
CVE-2025-32129
Technical details for CVE-2025-32129 are not provided in the supplied documents. Monitor for updates from vendors and security advisories; the initial description notes a Stored XSS in Welcome Bar (
CVE-2025-31130 gitoxide does not detect SHA-1 collision attacks
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations...
CVE-2025-31130 gitoxide does not detect SHA-1 collision attacks
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations...
CVE-2025-31384
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos: from n/a through 1.0.5...
CVE-2025-31384
CVE-2025-31384 affects the Aviplugins Videos WordPress plugin, with an issue described as Improper Neutralization of Script-Related HTML Tags in a Web Page (Reflected XSS) affecting Versions up to 1.0.5. The vulnerability is exploitable via network vector and requires user interaction; CVSS 3.1 b...
CVE-2025-3245
A vulnerability was found in itsourcecode Library Management System 1.0. It has been rated as critical. Affected by this issue is the function Search of the file librarymanagement/src/LibraryManagement/Forgot.java. The manipulation of the argument txtuname leads to sql injection. The attack may b...
NSA and Global Allies Declare Fast Flux a National Security Threat
NSA and global cybersecurity agencies warn fast flux DNS tactic is a growing national security threat used in phishing, botnets, and ransomware...
CVE-2025-2075 Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole and userrole functions missing proper capability checks performed through the...