PT-2025-22852 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.117 Description: A critical issue was found in DedeCMS, affecting an unknown function of the file dede/sys verifies.php?action=getfiles. The manipulation of the refiles argument leads to code injection. This issue can be...

CMS Made Simple（CMSMS） 代码注入漏洞

CMS Made Simple CMSMS is an open source content management system CMS from Cmsms team. The system supports role-based permission management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A code injection vulnerability exists in CMS Made Simple...

Bitwarden 代码注入漏洞

Bitwarden is an open source password manager from Bitwarden Inc. in the United States. A code injection vulnerability exists in Bitwarden 2.25.1 and earlier versions, which stems from a misbehavior of the component PDF File Handler resulting in cross-site scripting...

PT-2025-22863 · Unknown · Defog-Ai Introspect

Name of the Vulnerable Software and Affected Versions: defog-ai introspect versions up to 0.1.4 Description: A critical vulnerability has been found in defog-ai introspect. This issue affects the execute analysis code safely function of the file introspect/backend/tools/analysis tools.py. The...

CVE-2025-2272

Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05...

Tmall_demo 代码注入漏洞

Tmalldemo is a Spring Boot-based mini Tmall by the Xianqi Mall projectteam team. A code injection vulnerability exists in Tmalldemo 20250505 and earlier versions, which stems from a misbehavior of the component Search Box resulting in cross-site scripting...

Tmall_demo 代码注入漏洞

Tmalldemo is a Spring Boot-based mini Tmall by the projectteam. A code injection vulnerability exists in Tmalldemo 20250505 and earlier versions, which stems from cross-site scripting due to incorrect operation of the parameter Detailed Address in the component Buy Item Page...

Tmall_demo 代码注入漏洞

Tmalldemo is a Spring Boot based mini Tmall by the projectteam. Tmalldemo 20250505 and previous versions of the code injection vulnerability, the vulnerability stems from the file /tmall/admin/ in the parameter Product Name/Product Title of the wrong operation leads to cross-site scripting...

Exploit for Authentication Bypass by Spoofing in Apache Apisix

Apache APISIX 2.12.x Remote Code Execution RCE Exploit This...

CVE-2025-32794

OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting XSS vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system ...

CVE-2025-32794

OpenEMR CVE-2025-32794 is a stored XSS vulnerability in the patient registration flow (First/Last Name) that affects versions prior to 7.0.3.4. An authenticated user with patient creation privileges can inject JavaScript, which is executed when viewing the patient encounter under Orders → Procedu...

CVE-2025-20167

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-22136

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These fuses create potential code injection vectors even though the...

CVE-2025-0060

SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged...

CVE-2024-25582

Module savepoints could be abused to inject references to malicious code delivered through the same domain. Attackers could perform malicious API requests or extract information from the users account. Exploiting this vulnerability requires temporary access to an account or successful social...

CVE-2024-43128

Improper Control of Generation of Code 'Code Injection' vulnerability in WC Product Table WooCommerce Product Table Lite allows Code Injection.This issue affects WooCommerce Product Table Lite: from n/a through 3.5.1...

CVE-2024-9414

In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page. This could allow an attacker to steal cookies, redirect users, or perform unauthorized actions...

CVE-2024-47194

A vulnerability has been identified in ModelSim All versions V2024.3, Questa All versions V2024.3. vish2.exe in affected applications allows a specific DLL file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate...

CVE-2024-47617

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting XSS issue, which could potentially...

CVE-2024-45798

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The arduino-esp32 CI is vulnerable to multiple Poisoned Pipeline Execution PPE vulnerabilities. Code injection in testsresults.yml workflow GHSL-2024-169 and environment Variable...