CVE-2025-4022

A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluationharness/evaluators.py. The manipulation of the argument target"url" leads to code injection. The attack can ...

CVE-2025-24344

A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute arbitrary client-side code in the context of another user's browser via a crafted HTTP request...

WordPress plugin abcsubmit code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress plugin Add custom page template code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Add custom...

CVE-2025-45015

A Cross-Site Scripting XSS vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. The vulnerability allows remote attackers to inject arbitrary JavaScript code via the fromdate and todate parameters...

CVE-2025-3984

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

CVE-2025-2817

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...

CVE-2025-2817

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...

UBUNTU-CVE-2025-2817

Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file...

CVE-2025-2817

The CVE-2025-2817 issue describes a vulnerability in Thunderbird’s update mechanism where a medium-integrity user process could interfere with the SYSTEM updater by manipulating file-locking, enabling privilege escalation via code injection into a user-privileged process. Affected products includ...

CVE-2025-2817

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...

CVE-2025-2817 Privilege escalation in Thunderbird Updater

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...

Security Vulnerabilities fixed in Firefox ESR 128.10 — Mozilla

Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file...

Command Execution Vulnerability in H3C Magic NX15000 10 Gigabit Wi-Fi 6 Router from Xinhua San Technology Co.

The H3C Magic NX15000 10 Gigabit Wi-Fi 6 Router is a high-end router for users and groups seeking whole-house coverage and high-quality networking. A command execution vulnerability exists in the H3C Magic NX15000 10 Gigabit Wi-Fi 6 Router from Xinhua San Technologies Co. that can be exploited by...

VMSMan 代码注入漏洞

VMSMan is a remote control and remote scripting solution from VMSMan, Inc. A code injection vulnerability exists in VMSMan 20250416 and prior versions, which stems from improper handling of the parameter Email in the file /login.php, which could lead to a cross-site scripting attack...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper handling of long command line inputs. An attacker can cause the application to crash by supplying an excessively long command line input. This is only exploitable if the application is running on...

CVE-2024-11922 Input Validation vulnerability in Web Client emails that do not go through Secure Mail

Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email...

CVE-2025-4022

A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluationharness/evaluators.py. The manipulation of the argument target"url" leads to code injection. The attack can ...

CVE-2025-4022 web-arena-x webarena evaluators.py HTMLContentEvaluator code injection

A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluationharness/evaluators.py. The manipulation of the argument target"url" leads to code injection. The attack can ...

CVE-2025-4022 web-arena-x webarena evaluators.py HTMLContentEvaluator code injection

A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluationharness/evaluators.py. The manipulation of the argument target"url" leads to code injection. The attack can ...