CVE-2025-1985

Due to improper neutralization of input during web page generation XSS an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device...

PT-2025-24345 · Github Actions · Broadinstitute/Cromwell

Summary Using Issue comment on .github/workflows/scalafmt-fix.yml an attacker can inject malicious code using github.event.comment.body. By exploiting the vulnerability, it is possible to exfiltrate high privileged GITHUB TOKEN which can be used to completely overtake the repo since the token has...

CVE-2025-5151

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

CVE-2025-5137

A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sysverifies.php?action=getfiles of the component Incomplete Fix CVE-2018-9175. The manipulation of the argument refiles leads to code injection. It is possible to...

VulnCheck KEV: CVE-2024-56145

Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has registerargcargv enabled...

JetBrains TeamCity GitHub Checks Webhook Cross-Site Scripting Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. JetBrains TeamCity suffers from a cross-site scripting vulnerability that originates in the GitHub Checks Webhook, which can be exploited by an attacker to inject malicio...

CVE-2025-1985

Due to improper neutralization of input during web page generation XSS an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device...

CVE-2025-1985

CVE-2025-1985 matches the Pepperl+Fuchs Profinet Gateway LB8122A.1.EL / FB8122A.1.EL family. The issue is an XSS due to improper neutralization of input during web page generation, allowing an unauthenticated remote attacker to inject HTML into the Web-UI of the affected device. Documented in mul...

CVE-2025-1985 PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability

Due to improper neutralization of input during web page generation XSS an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device...

Realce Tecnologia Queue Ticket Kiosk 代码注入漏洞

Realce Tecnologia Queue Ticket Kiosk is a queue management software from Realce Tecnologia. A code injection vulnerability exists in Realce Tecnologia Queue Ticket Kiosk 20250517 and prior versions, which stems from a parameter Name/Usuário operation leading to cross-site scripting...

Summer Pearl Vacation Rental Management Platform 代码注入漏洞

Summer Pearl Vacation Rental Management Platform is a vacation rental management platform from Summer Pearl. A code injection vulnerability exists in Summer Pearl Vacation Rental Management Platform version 1.0.1 and earlier, which stems from cross-site scripting due to the operation of parameter...

Realce Tecnologia Queue Ticket Kiosk 代码注入漏洞

Realce Tecnologia Queue Ticket Kiosk is a queue management software from Realce Tecnologia. A code injection vulnerability exists in Realce Tecnologia Queue Ticket Kiosk 20250517 and prior versions, which stems from a parameter Usuário operation leading to cross-site scripting...

CVE-2025-5151

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

CVE-2025-5151

Defog.ai Introspect up to version 0.1.4 contains a code injection vulnerability in introspect/backend/tools/analysis_tools.py: execute_analysis_code_safely, caused by unsafe handling of the code argument. An attacker on the local host could exploit this without user interaction. A patch identifie...

CVE-2025-5151 defog-ai introspect analysis_tools.py execute_analysis_code_safely code injection

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

CVE-2025-5151 defog-ai introspect analysis_tools.py execute_analysis_code_safely code injection

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

CVE-2025-5151 defog-ai introspect analysis_tools.py execute_analysis_code_safely code injection

A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function executeanalysiscodesafely of the file introspect/backend/tools/analysistools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack o...

CVE-2025-5137

A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sysverifies.php?action=getfiles of the component Incomplete Fix CVE-2018-9175. The manipulation of the argument refiles leads to code injection. It is possible to...

CVE-2025-5137

A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sysverifies.php?action=getfiles of the component Incomplete Fix CVE-2018-9175. The manipulation of the argument refiles leads to code injection. It is possible to...

CVE-2025-5137 DedeCMS Incomplete Fix CVE-2018-9175 sys_verifies.php code injection

A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sysverifies.php?action=getfiles of the component Incomplete Fix CVE-2018-9175. The manipulation of the argument refiles leads to code injection. It is possible to...