CVE-2025-52543

CVE-2025-52543 affects E3 Site Supervisor Control (firmware versions prior to 2.31F01) and its application services MGW/RCI. The root cause is use of client-side hashing for authentication, enabling an attacker to authenticate by obtaining only a password hash. Public references consistently desc...

CVE-2025-52543 Login to the application services using only the password hash

E3 Site Supervisor Control firmware version 2.31F01 application services MGW and RCI uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash...

Copeland E3 Supervisory Control 安全漏洞

Copeland E3 Supervisory Control is an industrial equipment control system from Copeland, USA. A security vulnerability exists in Copeland E3 Supervisory Control versions prior to 2.31F01, which stems from client-side hash authentication and could lead to authentication via password hashing...

PT-2025-35552

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: The E3 Site Supervisor Control application services MGW and RCI utilize client-side hashing for authentication. This allows an attacker to authenticate by obtaining only the...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

Linux Distros Unpatched Vulnerability : CVE-2023-6736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the WEEKEND-PLANS field. An attacker can execute arbitrary code in the context of the affected application by submitting a specially crafted payload. Details Cross-site scripting or XSS is a code vulnerabili...

SolidInvoice 安全漏洞

SolidInvoice is an invoice solution application from SolidInvoice Open Source. A security vulnerability exists in SolidInvoice versions 2.3.7 and 2.3.8 that stems from client-side functionality that is susceptible to cross-site scripting attacks...

CVE-2025-31979

A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or w...

CVE-2025-31979

CVE-2025-31979 concerns HCL BigFix Service Management (SM). The vulnerability is a file upload validation bypass where the application fails to properly enforce file type restrictions during upload, allowing an attacker to upload unauthorized or malicious files (e.g., scripts, executables, web sh...

Critical Flaws in Base44 Exposed Sensitive Data and Allowed Account Takeovers

Our research uncovered multiple critical vulnerabilities in Base44, an AI-powered platform that lets you turn any idea into a fully functional custom app. These flaws ranged from an open redirect that leaked access tokens, to stored cross-site scripting XSS, insecure authentication design,...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

CVE-2025-56694

The CVE-2025-56694 affects lumasoft fotoShare Cloud (version 2025-03-13). The vulnerability is a client-side password validation issue (CWE-602) that could allow unauthenticated attackers to view password-protected photo albums. Root cause appears to be improper client-side validation. CVSS v3.1 ...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

CVE-2025-50977

Gitblit (version 1.7.1) contains a template injection vulnerability that enables reflected XSS via the r parameter. Exploitation requires authenticated admin access and can be triggered through GET requests to the /summary endpoint or POST requests to certain Wicket interfaces, enabling injection...

CVE-2025-50977

A template injection vulnerability leading to reflected cross-site scripting XSS has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute...

CVE-2025-56694

Client-side password validation CWE-602 in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums...

PT-2025-34871 · Lumsoft · Fotoshare Cloud

Name of the Vulnerable Software and Affected Versions: lumasoft fotoShare Cloud version 2025-03-13 Description: The software exhibits a client-side password validation issue, which allows unauthenticated attackers to view password-protected photo albums. Recommendations: At the moment, there is n...

Linux Distros Unpatched Vulnerability : CVE-2020-13262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on...