HTMLy 代码注入漏洞

HTMLy is HTMLy open source set of PHP-based blogging platform. A code injection vulnerability exists in htmly 3.1.0 and earlier versions, which stems from incorrect manipulation of the parameter label in the file /htmly/admin/field/post, and could lead to a cross-site scripting attack...

cs253.stanford.edu

It is an offensive tool for web application security education. The repository contains a collection of assignments and exercises for the CS 253 Web Security course at Stanford University. The assignments are designed to educate students on various web security topics, including client-side...

07FLY多款产品 代码注入漏洞

07FLY-CMS and so on are products of China Zero Takeoff 07FLY company.07FLY-CMS is a free and open source content management system.07FLYCMS is a free and open source content management system.07Fly 07FLYCRM and so on are products of China Zero Takeoff 07Fly company.07FLYCRM is a customer...

Security Bulletin: Stored Cross-Site Scripting (XSS) Vulnerability in IBM Lakehouse Web UI Enables Privileged Code Injection, affects watsonx.data

Summary IBM Lakehouse is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. This can affect...

CVE-2025-8276

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Patika Global Technologies HumanSuite allows...

chat_forum 代码注入漏洞

chatforum is a chat and dating forum system developed by Chengyi Wang. A code injection vulnerability exists in chatforum 80bdb92f5b460d36cab36e530a2c618acef5afd2 and previous versions, which stems from incorrect manipulation of the parameter path in the file /q.php, and may lead to cross-site...

Exploit for Code Injection in Langflow

CVE-2025-3248 Introduction Langflow versions prior to 1.3...

CVE-2025-10057 WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the writetocustomfile function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers,...

CVE-2025-10057 WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the writetocustomfile function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers,...

CVE-2025-10057

CVE-2025-10057 details from multiple sources confirm a Remote Code Execution flaw in the WordPress plugin “WP Import – Ultimate CSV XML Importer for WordPress” up to version 7.28. The root cause is unfiltered PHP code being written by write_to_customfile(), enabling an authenticated user with Sub...

i-Educar 代码注入漏洞

i-Educar is a free educational software from Portábilis Open Source. A code injection vulnerability exists in i-Educar 2.10 and earlier versions, which stems from a misuse of the parameter nmanotacao/descricao in the file /intranet/educarcalendarioanotacaocad.php, which could lead to a cross-site...

i-Educar 代码注入漏洞

i-Educar is a free educational software from Portábilis Open Source. A code injection vulnerability exists in i-Educar 2.10 and earlier versions, which stems from misuse of the parameter tipoacao in the file /module/Configuracao/ConfiguracaoMovimentoGeral, and could lead to a cross-site scripting...

i-Educar 代码注入漏洞

i-Educar is a free educational software open source by Portábilis. A code injection vulnerability exists in i-Educar 2.10 and earlier versions, which stems from a misbehavior of the parameter abreviatura/tipoacao in the file /intranet/educarfuncaocad.php, which could lead to a cross-site scriptin...

WordPress plugin WP Import – Ultimate CSV XML Importer for WordPress 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in th...

itsourcecode E-Logbook with Health Monitoring System for COVID-19 代码注入漏洞

itsourcecode E-Logbook with Health Monitoring System for COVID-19 is an electronic logging system for the New Crown Pneumonia Health Monitoring System for COVID-19 open source by itsourcecode. A code injection vulnerability exists in itsourcecode E-Logbook with Health Monitoring System for COVID-...

Dyad 代码注入漏洞

Dyad is an AI application builder open-sourced by Dyad. A code injection vulnerability exists in Dyad 0.19.0 and earlier versions, which stems from the Preview Window feature that can bypass Docker container protection and could lead to the execution of arbitrary code...

i-Educar 代码注入漏洞

i-Educar is a free educational software open source by Portábilis. A code injection vulnerability exists in i-Educar version 2.10 and earlier, which stems from a misuse of the parameter refpessoa in the file /intranet/educarusuariodet.php, which could lead to a cross-site scripting attack...

CVE-2025-8276

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Patika Global Technologies HumanSuite allows...

CVE-2025-8276 HTML Injection in Patika Global Technologies' HumanSuite

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Patika Global Technologies HumanSuite allows...

CVE-2025-8276

CVE-2025-8276 affects Patika Global Technologies’ HumanSuite (prior to 53.21.0). The issue stems from improper encoding/escaping of output and insufficient neutralization of input in web page generation, enabling Cross-Site Scripting (XSS) and injection-style risks (including potential code/data ...