CVE-2025-22274

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not...

CVE-2025-22272

In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the...

Pix Software Vivaz 代码注入漏洞

Pix Software Vivaz is an application from Pix Software. A code injection vulnerability exists in Pix Software Vivaz version 6.0.11. An attacker can exploit the vulnerability to remotely execute code...

WordPress plugin The Authors List 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A code injection vulnerabili...

PT-2025-9155 · Cursor +1 · Cursor +1

Name of the Vulnerable Software and Affected Versions: ToDesktop versions prior to 2024-10-03 Description: The issue allows remote attackers to execute arbitrary commands on the build server, potentially reading secrets from the desktopify config.prod.json file and deploying updates to any app, v...

CVE-2025-22274

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not...

CVE-2025-22270

An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additional error that allows bypassing the...

CVE-2025-22272

In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the...

CVE-2025-22270

CVE-2025-22270 affects CyberArk Endpoint Privilege Manager (EPM) SaaS 24.7.1. An attacker with admin access to the Role Management UI can inject code by adding a new role in the name field. The risk is mitigated by an additional error that bypasses CSP, which prevents JavaScript execution but all...

NetAlertX 24.9.12 Code Execution

NetAlertX version 24.9.12 suffers from a code execution vulnerability. ============================================================================================================================================= | Title : NetAlertX 24.9.12 PHP Code Injection Vulnerability | | Author : indoushka ...

BeyondTrust 24.3.1 Code Execution

BeyondTrust version 24.3.1 suffers from a code execution vulnerability. ============================================================================================================================================= | Title : BeyondTrust v24.3.1 PHP Code Injection Vulnerability | | Author : indoush...

Ivanti EPM 1.0 Code Execution

Ivanti EPM version 1.0 suffers from a code execution vulnerability. ============================================================================================================================================= | Title : Ivanti EPM v1.0 PHP Code Injection Vulnerability | | Author : indoushka | |...

Judge0 1.13.0 Code Execution

Judge0 version 1.13.0 suffers from a code execution vulnerability. ============================================================================================================================================= | Title : Judge0 v 1.13.0 PHP Code Injection Vulnerability | | Author : indoushka | |...

PT-2025-9091 · Cyberark · Cyberark Endpoint Privilege Manager

Name of the Vulnerable Software and Affected Versions: CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 Description: The issue concerns code injection in the "modalDlgMsgInternal" parameter via POST in the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, which is then...

CyberArk Endpoint Privilege Manager 安全漏洞

CyberArk Endpoint Privilege Manager is a privilege management software from the Israeli company CyberArk. The software includes features such as privilege management, application control and credential loss protection. A security vulnerability exists in CyberArk Endpoint Privilege Manager version...

CyberArk Endpoint Privilege Manager 安全漏洞

CyberArk Endpoint Privilege Manager is a privilege management software from the Israeli company CyberArk. The software includes features such as privilege management, application control and credential loss protection. A security vulnerability exists in CyberArk Endpoint Privilege Manager version...

js2py 0.74 Code Execution

js2py version 0.74 suffers from a code execution vulnerability. ============================================================================================================================================= | Title : js2py versions 0.74 Code Injection Vulnerability | | Author : indoushka | | Teste...

Ollama 0.5.11 Code Execution

Ollama version 0.5.11 suffers from a code execution vulnerability. ============================================================================================================================================= | Title : Ollama 0.5.11 Code Injection Vulnerability | | Author : indoushka | | Tested o...

Security Bulletin: IBM MQ Appliance Console is affected by code injection vulnerability (CVE-2025-0975)

Summary IBM MQ Appliance has addressed a code injection vulnerability in the IBM MQ Console. Vulnerability Details CVEID:CVE-2025-0975 DESCRIPTION: IBM MQ console could allow an authenticated user to execute code due to improper neutralization of escape characters. CWE:CWE-150: Improper...

DrayTek Vigor 165 代码注入漏洞

The DrayTek Vigor 165 is a VDSL2 35b hypervector modem/router from China Juyi DrayTek. A security vulnerability exists in the DrayTek Vigor 165 that originates from an unvalidated certificate and could lead to arbitrary code execution...