Spring-Analysis 代码注入漏洞

Spring-Analysis is a Spring source code reading note by skywalker individual developer. Spring-Analysis has a code injection vulnerability that stems from cross-site scripting due to improper handling of the Name parameter in the SimpleController.java file...

PT-2025-26595 · Brain2 · Brain2

Name of the Vulnerable Software and Affected Versions: BRAIN2 versions 0.0 through 3.05 Description: A script can be integrated into a report on a client with a non-admin user. The reports could later be executed on the BRAIN2 server with administrator rights, potentially allowing for code...

VulnCheck KEV: CVE-2025-34039

A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet bsh.servlet.BshServlet without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This...

CodeAstro Patient Record Management System 代码注入漏洞

CodeAstro Patient Record Management System is a patient record management system from CodeAstro, Inc. A code injection vulnerability exists in CodeAstro Patient Record Management System version 1.0, which originates from cross-site scripting due to incorrect operation of the parameter Patient...

SourceCodester Student Result Management System 代码注入漏洞

SourceCodester Student Result Management System is a SourceCodester open source student result management system. A code injection vulnerability exists in SourceCodester Student Result Management System version 1.0, which originates from a cross-site scripting attack due to incorrect manipulation...

Code-Projects School Fees Payment System 代码注入漏洞

School Fees Payment System is a tuition payment system. School Fees Payment System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter translationremark in the file /fees.php, which can be exploited ...

CVE-2025-5255 TCC Bypass via Dylib Injection in Phoenix Code

The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library Dylib injection. A local attacker with unprivileged access can use...

Arbitrary Code Injection

Overview org.webjars.npm:jsonpath is a Query JavaScript objects with JSONPath expressions. Robust / safe JSONPath engine for Node.js. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on th...

Arbitrary Code Injection

Overview jsonpath is a Query JavaScript objects with JSONPath expressions. Robust / safe JSONPath engine for Node.js. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval...

PHPGurukul Bus Pass Management System 代码注入漏洞

Bus Pass Management System is a bus pass management system. Bus Pass Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the profile name parameter in the file /admin/admin-profile.php, which can...

PHPGurukul Notice Board System 代码注入漏洞

Notice Board System is a bulletin board system. Notice Board System has a cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the parameters Title/Description in the file /admin/manage-notices.php, which can be...

Code-Projects School Fees Payment System 代码注入漏洞

School Fees Payment System is a tuition payment system. School Fees Payment System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Branch/Address/Detail in the file /branch.php, which can be...

SourceCodester My Food Recipe 代码注入漏洞

SourceCodester My Food Recipe is a SourceCodester open source recipe sharing web application. A code injection vulnerability exists in SourceCodester My Food Recipe version 1.0, which originates from cross-site scripting due to incorrect manipulation of the parameter Name in the file...

Code-Projects Responsive Blog 代码注入漏洞

Code-Projects Responsive Blog is an open source responsive blog by Code-Projects. A code injection vulnerability exists in Code-Projects Responsive Blog version 1.0/1.12.4/3.3.4, which originates from a cross-site scripting error in file /responsive/resblog/blogadmin/admin/pageViewMembers.php...

Code-Projects Responsive Blog 代码注入漏洞

Code-Projects Responsive Blog is an open source responsive blog by Code-Projects. A code injection vulnerability exists in Code-Projects Responsive Blog version 1.0, which stems from cross-site scripting due to incorrect manipulation of the parameter keyword in the file /search.php...

Pterodactyl Panel 代码注入漏洞

Pterodactyl Panel is a free open source game server administration panel from Pterodactyl Open Source. A code injection vulnerability exists in Pterodactyl Panel versions prior to 1.11.11, which stems from the /locales/locale.json endpoint that does not validate the locale and namespace parameter...

Arbitrary Code Injection

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Arbitrary Code Injection via the /locales/locale.json endpoint when processing the locale and namespace query parameters. An attacker can execute arbitrary code on the server by sending...

Luna Imaging 代码注入漏洞

Luna Imaging is a web-hosted solution for displaying, managing, and preserving digital archival collections from Luna Imaging USA. A code injection vulnerability exists in Luna Imaging version 7.5.5.6 and earlier, which stems from improper manipulation of the parameter q in the file...

PHPGurukul COVID19 Testing Management System 代码注入漏洞

The COVID19 Testing Management System is a new crown pneumonia testing management system. COVID19 Testing Management System suffers from a code injection vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by parameter q in file...

CVE-2025-6101

A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1. Affected is the function functionmessage of the file letta/letta/interface.py. The manipulation of the argument functionname/functionargs leads to improper neutralization of directives in dynamically evaluated...