BIT-KIBANA-2025-25009 Kibana Cross-Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload...

BIT-ELK-2025-25009 Kibana Cross-Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload...

CVE-2025-25009

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload...

CVE-2025-25009 Kibana Cross-Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload...

EUVD-2025-32867

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload...

CVE-2025-25009 Kibana Cross-Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload...

CVE-2025-25009

CVE-2025-25009 affects Kibana components where improper neutralization of input during web page generation enables stored XSS via case file uploads. The vulnerability is documented across multiple feeds (NVD, CVE lists, OSV, Nessus) with correlated advisories indicating Kibana versions in use; th...

CVE-2025-25009 Kibana Cross-Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload...

CVE-2025-25009: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload...

Kibana 8.18.8, 8.19.5, 9.0.8, and 9.1.5 Security Update (ESA-2025-20)

Kibana Cross-Site Scripting XSS ESA-2025-20 Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. Affected Versions: 7.x: All versions prior to and including 7.17.29 8.x: All versions from 8.0.0 up to and including 8.18.7 8.19.x: All...

PT-2025-40995

Name of the Vulnerable Software and Affected Versions Kibana versions 8.18.8 through 8.19.5 Kibana versions 9.0.8 through 9.1.5 Description The software contains an issue related to the improper neutralization of input during web page generation. This can lead to Stored Cross-Site Scripting XSS...

CVE-2025-2626

A vulnerability classified as critical was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This vulnerability affects unknown code of the file editcase.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has...

PT-2024-38508 · Sourcecodester · Sourcecodester Kortex Lite Advocate Office Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Kortex Lite Advocate Office Management System version 1.0 Description: A vulnerability was found in the SourceCodester Kortex Lite Advocate Office Management System, affecting an unknown part of the file register case.php. The...

CVE-2018-17418

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

CVE-2018-17418: Unrestricted Upload of File with Dangerous Type

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

PT-2018-15403

Name of the Vulnerable Software and Affected Versions S-CMS version 1.0 Description The issue allows unauthorized access to certain files, including PHP source code, by manipulating the DownName parameter in the "admin/download.php" endpoint with a mixed-case file extension. For example, using...

Cmseasy某处SQL盲注漏洞（绕过360防护）

简要描述： 注入..但是木回显 盲注了.. 详细说明： index.php 84行 stats::getbot; 由于初始化的时候也没对$SERVER做过滤的什么措施 导致的注入 stats.php 13行到78行 getbot 这个功能是看蜘蛛的记录 $SERVER 没过滤 我们只需要把HTTPUSERAGENT伪造成蜘蛛的就ok了 public static function getbot $ServerName = $SERVER"SERVERNAME"; $ServerPort = $SERVER"SERVERPORT"; $ScriptName =...