8367 matches found
PT-2025-47955
YCCMS 3.4 contains a stored cross-site scripting XSS vulnerability in the article management functionality. The vulnerability exists in the add and getPost functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field...
FedPoisonTTP: A Threat Model and Poisoning Attack for Federated Test-Time Personalization
Test-time personalization in federated learning enables models at clients to adjust online to local domain shifts, enhancing robustness and personalization in deployment. Yet, existing federated learning work largely overlooks the security risks that arise when local adaptation occurs at test tim...
EUVD-2025-198384
The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2025-10702
Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...
CVE-2025-13468 SourceCodester Alumni Management System Delete admin_class.php delete_event authorization
A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function deleteforum/deletecareer/deletecomment/deletegallery/deleteevent of the file admin/adminclass.php of the component Delete Handler. Executing manipulation of the argument ID can lead to...
CVE-2025-13468
Summary (CVE-2025-13468): In SourceCodester Alumni Management System 1.0, the Delete Handler component (admin/admin_class.php) is affected. The vulnerability arises from manipulating the argument ID in functions delete_forum, delete_career, delete_comment, delete_gallery, and delete_event, which ...
CVE-2025-13468 SourceCodester Alumni Management System Delete admin_class.php delete_event authorization
A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function deleteforum/deletecareer/deletecomment/deletegallery/deleteevent of the file admin/adminclass.php of the component Delete Handler. Executing manipulation of the argument ID can lead to...
SourceCodester Alumni Management System 安全漏洞
SourceCodester Alumni Management System is SourceCodester open source a Php, Mysql-based alumni management system. A security vulnerability exists in SourceCodester Alumni Management System version 1.0, which stems from incorrect manipulation of the parameter ID in the file admin/adminclass.php,...
CVE-2025-10702
Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...
CVE-2025-10702
Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...
Microsoft Mitigates Record 15.72 Tbps DDoS Attack Driven by AISURU Botnet
Microsoft on Monday disclosed that it automatically detected and neutralized a distributed denial-of-service DDoS attack targeting a single endpoint in Australia that measured 15.72 terabits per second Tbps and nearly 3.64 billion packets per second pps. The tech giant said it was the largest DDo...
CVE-2025-13198
A vulnerability has been found in DouPHP up to 1.8 Release 20251022. This impacts an unknown function of the file upload/include/file.class.php. The manipulation of the argument File leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
Updated apache-commons-beanutils packages fix security vulnerability
Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default. CVE-2025-48734...
CVE-2025-13198 DouPHP file.class.php unrestricted upload
A vulnerability has been found in DouPHP up to 1.8 Release 20251022. This impacts an unknown function of the file upload/include/file.class.php. The manipulation of the argument File leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...
CVE-2025-13198
CVE-2025-13198 affects DouPHP up to version 1.8 Release 20251022. The vulnerability is tied to the file upload/include/file.class.php component, where manipulation of the File argument enables unrestricted file uploads. This enables remote exploitation, with public disclosure of the exploit. Reme...
CVE-2025-47222
A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class path and the provided class is not expected to return different errors if the class exists in deployment or not. This returns information...
EUVD-2025-176941
Malicious code in public-bundle-class-iota-thread npm...
EUVD-2025-178201
Malicious code in key-encrypt-bad-class-kernel npm...