CI4MS 跨站脚本漏洞

CI4MS is an open-source blog page management tool developed by Ci4MS. Versions of CI4MS prior to 0.31.0.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper cleaning of user input in the backend user management function, which could lead to storage-based...

CVE-2025-61676 October CMS Vulnerable to Stored XSS via Branding Styles

October is a Content Management System CMS and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting XSS vulnerabilities was identified in October CMS backend configuration forms. A user with the Customize Backend Styles permission could inject malicious HTML/JS into the...

CVE-2025-12642

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

CVE-2025-12642 HTTP Header Smuggling via Trailer Merge

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

Cross-site Scripting (XSS)

Overview codingms/additional-tca is a package providing additional TCA fields and tools Affected versions of this package are vulnerable to Cross-site Scripting XSS in the BadgeSuggested class. An authenticated user with access to the backend can create malicious output in the HTML context by...

Command execution vulnerability in Fusion K2 router at lanset settings page

The Fusion K2 PSG1218 router is a must-have new generation wireless router for entry-level users. The Fusion K2 router suffers from a command execution vulnerability at the lanset settings page. The vulnerability is due to the backend code failing to properly filter user input ipaddr, which can b...

XSS Vulnerability in Apple's CMS

Apple CMS is a free cms website builder. Apple CMS has an XSS vulnerability. The vulnerability stems from the failure of the backend to effectively filter the data submitted by the user due to the attacker can take advantage of the vulnerability can obtain cookies and other sensitive information...