Wing FTP < 7.4.4 Remote Code Execution

Wing FTP version 7.4.2 and earlier is vulnerable to a remote code execution vulnerability due to improper handling of null characters in file paths. An attacker can exploit this vulnerability by sending a specially crafted request that includes a null character, allowing them to execute arbitrary...

fuzzdb-collect

Based on the provided code and context, here is a summary of the analysis: Classification: This is a Python script for brute-forcing 3-character...

USN-7651-5 linux-raspi-realtime vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Serial ATA and Parallel ATA drivers; - Driver...

CVE-2025-51860

Stored Cross-Site Scripting XSS in TelegAI telegai.com 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SVG XSS payloads in either description, greeting, example dialog, or system...

CLSA-2025-1753207140 Fix CVE(s): CVE-2025-48384

SECURITY UPDATE: security vulnerability discovered - debian/patches/CVE-2025-48384.patch: quote values containing CR character in config to prevent unintentional stripping when reading - CVE-2025-48384...

CVE-2025-51860

Stored Cross-Site Scripting XSS in TelegAI telegai.com 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SVG XSS payloads in either description, greeting, example dialog, or system...

CVE-2025-51860

TelegAI (telegai.com) is affected by a Stored XSS (CVE-2025-51860) in its chat component and character container. The vulnerability allows an attacker to craft an AI Character with SVG XSS payloads in fields such as description, greeting, example dialog, or system prompt, causing arbitrary client...

PT-2025-30419 · Telegai · Telegai

Name of the Vulnerable Software and Affected Versions: TelegAI affected versions not specified Description: The application contains a stored cross-site scripting XSS issue in its chat component and character container component. An attacker can execute arbitrary client-side scripts by creating a...

Attacking Interpretable NLP Systems

Studies have shown that machine learning systems are vulnerable to adversarial examples in theory and practice. Where previous attacks have focused mainly on visual models that exploit the difference between human and machine perception, text-based models have also fallen victim to these attacks...

TelegAI Cross Site Scripting

TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to persistent cross site scripting vulnerabilities in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SV...

Exploit for CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web...

git: Fix of CVE-2025-48384

CVE-2025-48384: config: quote values containing CR character...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Administration Console. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious payloads through user-controllable input fields. Details Cross-site scripting o...

CLSA-2025-1752656083 git: Fix of CVE-2025-48384

CVE-2025-48384: config: quote values containing CR character...

AZL-65115 CVE-2025-1220 affecting package php 8.3.29-1

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...

SUSE CVE-2025-1220

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...

CVE-2025-49003

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threa...

CVE-2025-49003

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threa...

CVE-2025-49003 Dataease H2 JDBC Connection Remote Code Execution

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threa...

CVE-2025-49003 Dataease H2 JDBC Connection Remote Code Execution

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threa...