CVE-2025-47271 OZI-Project/ozi-publish Code Injection vulnerability

The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects...

CVE-2025-47271 OZI-Project/ozi-publish Code Injection vulnerability

The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects...

CVE-2025-47271

CVE-2025-47271 concerns the OZI-project/ozi-publish GitHub Action. Affected versions are 1.13.2 through 1.13.5, where untrusted data flows into PR creation logic could allow a malicious actor to craft a branch name that injects arbitrary code. This vulnerability is patched in 1.13.6; a workaround...

CVE-2025-47271 OZI-Project/ozi-publish Code Injection vulnerability

The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects...

PT-2025-20693 · Github · Ozi Action

Name of the Vulnerable Software and Affected Versions: OZI action versions 1.13.2 through 1.13.5 Description: The OZI action, a GitHub Action for publishing releases to PyPI, has a flaw where potentially untrusted data flows into PR creation logic. This allows a malicious actor to construct a...

CVE-2025-4531

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData of the file ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class of the component Beetl Template...

CVE-2025-4531

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData of the file ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class of the component Beetl Template...

CVE-2025-4531 Seeyon Zhiyuan OA Web Application System Beetl Template EhrSalaryPayrollServiceImpl.class postData code injection

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData of the file ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class of the component Beetl Template...

CVE-2025-4531

CVE-2025-4531 affects Seeyon Zhiyuan OA Web Application System 8.1 SP2, specifically Beetl Template Handler’s EhrSalaryPayrollServiceImpl.postData. The payrollId argument is manipulated to cause code injection; attack vector is network with low complexity and no user interaction, and exploitation...

CVE-2025-4531 Seeyon Zhiyuan OA Web Application System Beetl Template EhrSalaryPayrollServiceImpl.class postData code injection

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData of the file ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class of the component Beetl Template...

ContiNew Admin 代码注入漏洞

ContiNew Admin is ContiNew open source a continuous iterative optimization of front-end and back-end separation of middle and back-end management system framework. A code injection vulnerability exists in ContiNew Admin 3.6.0 and earlier versions, which stems from cross-site scripting due to...

Seeyon Zhiyuan OA 注入漏洞

Seeyon Zhiyuan OA Zhiyuan OA is a collaboration management software from China's Seeyon. An injection vulnerability exists in Seeyon Zhiyuan OA version 8.1 SP2, which is caused by code injection due to incorrect operation of the parameter payrollId...

SourceCodester Web-based Pharmacy Product Management System 代码注入漏洞

SourceCodester Web-based Pharmacy Product Management System is SourceCodester open source a Web-based pharmacy product management system . A code injection vulnerability exists in version 1.0 of the SourceCodester Web-based Pharmacy Product Management System due to cross-site scripting in the...

PT-2025-20653 · Unknown · Seeyon Zhiyuan Oa Web Application System

Name of the Vulnerable Software and Affected Versions: Seeyon Zhiyuan OA Web Application System version 8.1 SP2 Description: A critical issue affects the function postData of the file ROOTWEB-INFclassescomourswwwehrsalaryservicedataEhrSalaryPayrollServiceImpl.class of the component Beetl Template...

Exploit for Code Injection in Foxcms

Description Published: 2025-03-27 Updated: 2025-03-27 An...

CVE-2025-28073

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized...

JAdmin 代码注入漏洞

JAdmin is JAdmin-JAVA open source a Java language based rapid development platform . JAdmin 1.0 version of the code injection vulnerability , the vulnerability stems from the file / memoAjax / save in the parameter ID operation leads to cross-site scripting...

PT-2025-27480

Name of the Vulnerable Software and Affected Versions Wing FTP Server versions prior to 7.4.4 Description Wing FTP Server is affected by a critical remote code execution RCE vulnerability CVE-2025-47812 stemming from improper handling of null bytes '0' in the web interfaces. This allows attackers...

Inetum IODAS 代码注入漏洞

Inetum IODAS is an enterprise-grade data archiving and storage management platform from Inetum France that supports hybrid cloud data lifecycle management. A code injection vulnerability exists in Inetum IODAS versions 7.2-LTS.4.1-JDK7 and 7.2-RC3.2-JDK7, which stems from cross-site scripting due...

CVE-2025-47481

Improper Control of Generation of Code 'Code Injection' vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Code Injection.This issue affects GS Testimonial Slider: from n/a through = 3.2.9...