Omise: 2FA requirement bypass when inviting team members

The application's requirement for users to enable 2FA before sending team invitations was bypassed by modifying client-side responses. This allowed invitations to be sent without enabling 2FA, defeating the security requirement...

CVE-2025-9495 Viessmann Vitogate 300 Authentication Bypass

The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attack...

Viessmann Vitogate 300 安全漏洞

Viessmann Vitogate 300 is a communication gateway from Viessmann, Germany. A security vulnerability exists in the Viessmann Vitogate 300 that stems from not implementing proper server-side authentication and relying on front-end authentication controls, which could allow an attacker to bypass log...

CVE-2025-59414

Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specifi...

CVE-2025-53969 Cognex In-Sight Explorer and In-Sight Camera Firmware Client-Side Enforcement of Server-Side Security

Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software, such as the In-Sight Explorer tool, to perform management operations such as changing network settings or modifying users' access to the...

Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival

Summary A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. Technical Details The vulnerability occurs in...

GHSA-P6JQ-8VC4-79F6 Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival

Summary A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. Technical Details The vulnerability occurs in...

CVE-2025-59414 Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival

Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specifi...

CVE-2025-59414 Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival

Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specifi...

CVE-2025-59414

Nuxt (Vue.js framework) exposes a client-side path traversal in the Island payload revival during prerendering. The vulnerability occurs in the revive-payload.client.ts flow when serialized __nuxt_island objects trigger Island fetches via /__nuxt_island/${key}.json, with key potentially containin...

Remote Code Execution (RCE)

unopim/unopim is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper input validation because the image upload on user creation performs only client-side file type checks, allowing an attacker to modify a captured upload change extension and content to .php and execute...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the comliferayportalsearchwebportletSearchPortletuserId parameter. An attacker can execute arbitrary web scripts or inject malicious HTML by supplying crafted input. Details Cross-site scripting or XSS is a...

Nuxt 路径遍历漏洞

Nuxt is a free open source framework from Nuxt Open Source. A path traversal vulnerability exists in Nuxt versions prior to 3.19.0 and prior to 4.1.0, which stems from a path traversal issue in the client-side payload recovery mechanism that could lead to an attacker manipulating client-side...

PT-2025-38250

Name of the Vulnerable Software and Affected Versions: Nuxt versions prior to 3.19.0 Nuxt versions prior to 4.1.0 Description: A client-side path traversal vulnerability exists in Nuxt's Island payload revival mechanism. This allows attackers to manipulate client-side requests to different...

Patika Global HumanSuite 安全漏洞

Patika Global HumanSuite is a human resource management platform from Patika Global, Turkey. A security vulnerability exists in Patika Global HumanSuite versions prior to 53.21.0, which stems from a user-controllable key leading to authorization bypass and improper authorization, which could be...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the remote app title field. An attacker can execute arbitrary web scripts or inject malicious HTML by submitting crafted input to this field. Details Cross-site scripting or XSS is a code vulnerability that...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name field in Kaleo Forms Admin. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting a malicious payload that is stored and rendered without proper...

Proxmox Virtual Environment 安全漏洞

Proxmox Virtual Environment Proxmox VE is an open source server virtualization environment Linux distribution from Proxmox. A security vulnerability exists in Proxmox Virtual Environment version 8.4, which stems from a stored cross-site scripting vulnerability in the WebAuthn Relying Party field...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/admin process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/960grid process. An attacker can execute arbitrary scripts in the context of a user's browser by submitting...