Dmacroweb DM Corporative CMS SQL注入漏洞

Dmacroweb DM Corporative CMS is a content management system from the Spanish company Dmacroweb. Dmacroweb DM Corporative CMS suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter name in the file /antcatalogue.as...

Dmacroweb DM Corporative CMS SQL注入漏洞

Dmacroweb DM Corporative CMS is a content management system from the Spanish company Dmacroweb. Dmacroweb DM Corporative CMS suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter cod in the file...

CVE-2025-49141

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the gitImportSite functionality obtains a URL string from a POST request and insufficiently validates user input. The setremote function later passes this input into procopen, yielding OS...

CVE-2025-49139

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is...

CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in...

CVE-2025-49137 Hax CMS Stored Cross-Site Scripting vulnerability

HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in...

CVE-2025-49137

HAX CMS PHP prior to 11.0.0 is vulnerable to stored XSS via the saveNode and saveManifest endpoints, where unsanitized user input is stored in the site JSON schema and rendered in the generated microsite. The issue allows execution of arbitrary JavaScript through HTML tags (notably without using ...

GHSA-G4CF-PP4X-HQGW HaxCMS-PHP Command Injection Vulnerability

Summary The 'gitImportSite' functionality obtains a URL string from a POST request and insufficiently validates user input. The ’setremote’ function later passes this input into ’procopen’, yielding OS command injection. Details The vulnerability exists in the logic of the ’gitImportSite’ functio...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to missing authentication in the registration feature. An attacker with a registered user account can create user accounts that can access private data even when registration is disabled...

Improperly Implemented Security Check for Standard

Overview Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard due to the exposure of sensitive data in active sessions. An attacker can retrieve credentials for users on the management platform by exploiting this vulnerability. Note: The maintaine...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to improper security controls. An attacker can gain unauthorized access and control over active sessions by exploiting this security oversight. Note: The maintainers of BackendAI do not consider this report to...

WebStack-Guns 安全漏洞

WebStack-Guns is an open source URL navigation website project by Dana Keeling, an individual developer, with a backend based on Guns and Springboot. A security vulnerability exists in WebStack-Guns version 1.0, which stems from vulnerability to cross-site request forgery attacks...

WebStack-Guns 安全漏洞

WebStack-Guns is an open source URL navigation website project by Dana Keeling, an individual developer, with a backend based on Guns and Springboot. A security vulnerability exists in WebStack-Guns version 1.0, which stems from cross-site scripting due to incorrect manipulation of the parameter...

CVE-2025-48943 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

CVE-2025-48942 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

CVE-2025-48944 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

CVE-2025-48887 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

CVE-2025-5695

A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribetospot/subscribetodelta/subscribetoalarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch...

CVE-2025-5695

Concluded: CVE-2025-5695 affects Teledyne FLIR AX8 Backend, specifically the subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm paths in /usr/www/application/models/subscriptions.php. Root cause described as command injection that can be triggered remotely over the network; exploitation is d...

CVE-2025-5695 Teledyne FLIR AX8 Backend subscriptions.php subscribe_to_alarm command injection

A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribetospot/subscribetodelta/subscribetoalarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch...