CVE-2025-4022 web-arena-x webarena evaluators.py HTMLContentEvaluator code injection

A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluationharness/evaluators.py. The manipulation of the argument target"url" leads to code injection. The attack can ...

CVE-2025-4022 web-arena-x webarena evaluators.py HTMLContentEvaluator code injection

A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluationharness/evaluators.py. The manipulation of the argument target"url" leads to code injection. The attack can ...

CVE-2025-4022

CVE-2025-4022 concerns web-arena-x webarena up to version 0.2.0. The vulnerability lies in the function HTMLContentEvaluator located at we barena/evaluation_harness/evaluators.py, where manipulation of the argument target["url"] enables code injection. The attack is remote and the exploit has bee...

CVE-2025-4022 web-arena-x webarena evaluators.py HTMLContentEvaluator code injection

A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluationharness/evaluators.py. The manipulation of the argument target"url" leads to code injection. The attack can ...

CVE-2025-3491

The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acptvalidatesetting' function. This is due to insufficient sanitization of the 'templatename' parameter. This makes it possib...

Broadcom Brocade Fabric OS Code Injection Vulnerability

Broadcom Brocade Fabric OS contains a code injection vulnerability that allows a local user with administrative privileges to execute arbitrary code with full root privileges...

Seeyon OA 代码注入漏洞

Seeyon OA Seeyon OA is a collaborative management software of China Seeyon Internet Seeyon Company. Seeyon OA 8.1SP2 version of the code injection vulnerability, the vulnerability stems from the file ssoproxy.jsp parameter Name operation leads to cross-site scripting attacks...

PT-2025-18070 · Unknown · Web-Arena-X

Name of the Vulnerable Software and Affected Versions: web-arena-x webarena version 0.2.0 Description: A critical vulnerability was found in the web-arena-x webarena software. This issue affects the HTMLContentEvaluator function of the file webarena/evaluation harness/evaluators.py. The...

Seeyon OA 代码注入漏洞

Seeyon OA Seeyon OA is a collaboration management software from China Seeyon Internet Seeyon. A code injection vulnerability exists in Seeyon OA version 8.1SP2, which originates from a cross-site scripting attack caused by operations in the file date.jsp...

Redmine 代码注入漏洞

Redmine is an open source set of open source Web-based project management and defect tracking tools from Redmine Open Source. The product provides features such as project management, issue tracking and role-based access control. A code injection vulnerability exists in Redmine versions 6.0.0,...

GHSA-37PQ-893F-G7Q5 Apereo CAS code injection vulnerability

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

Apereo CAS code injection vulnerability

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

Code Injection

Overview Affected versions of this package are vulnerable to Code Injection via the saveService function. If dynamic service registration is enabled which it is not by default, a privileged attacker with access to the saveService interface and the ability to modify application.properties can...

CVE-2025-3984

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

CVE-2025-3984 Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

CVE-2025-3984 Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

CVE-2025-3984

CVE-2025-3984 affects Apereo CAS 5.2.6. The vulnerability targets the saveService function in cas-5.2.6/webapp-mgmt/cas-management-webapp-support/src/main/java/org/apereo/cas/mgmt/services/web/RegisteredServiceSimpleFormController.java (Groovy Code Handler), enabling code injection. Reported as n...

CVE-2025-3984 Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component...

CVE-2025-3935

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys,...

PT-2025-18015

Name of the Vulnerable Software and Affected Versions Apereo CAS version 5.2.6 Description A critical issue was found, affecting the saveService function of the RegisteredServiceSimpleFormController.java file in the Groovy Code Handler component. This issue leads to code injection and can be...