CVE-2025-61189

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the we...

PT-2025-40299

Name of the Vulnerable Software and Affected Versions Jeecgboot versions 3.8.2 and earlier Description Jeecgboot versions 3.8.2 and earlier are susceptible to a path traversal issue. The /sys/comment/addFile API endpoint allows attackers to upload files with system-whitelisted extensions to the...

PT-2025-39430

Name of the Vulnerable Software and Affected Versions vulnerability-lookup version 2.16.0 Description A cross-site scripting XSS issue exists in the handling of user-supplied input within the Bundles, Comments, and Sightings components of the software. Untrusted data was not properly sanitized...

CVE-2025-56264

The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability...

CVE-2025-56264

The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability...

CVE-2025-56264

The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability...

OneBlog 安全漏洞

OneBlog is a beautiful and powerful Java blog by yadong.zhang individual developer. A security vulnerability exists in OneBlog version 2.3.9, which stems from a flaw in the /api/comment endpoint that could lead to a denial-of-service attack...

CVE-2025-56264

CVE-2025-56264 affects zhangyd-c OneBlog 2.3.9 with a denial-of-service vulnerability in the /api/comment endpoint. The provided metrics indicate a network-exposed attack surface (AV:N/AC:L/PR:N/UI:N/S:U) with issue causing availability impact (I: N, A: H) and a base CVSSv3.1 score of 7.5. Connec...

PT-2025-38071

Name of the Vulnerable Software and Affected Versions: zhangyd-c OneBlog version 2.3.9 Description: The /api/comment endpoint in zhangyd-c OneBlog is susceptible to a denial-of-service issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for thi...

CVE-2025-10255

A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit h...

CVE-2025-10255

A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit h...

CVE-2025-10255 Ascensio System SIA OnlyOffice Comment Messages.aspx cross site scripting

A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit h...

CVE-2025-10255

CVE-2025-10255 affects Ascensio System SIA OnlyOffice up to version 12.7.0. The issue is tied to an unknown function in the file /Products/Projects/Messages.aspx within the Comment Handler component, which can enable remote cross-site scripting via manipulation. Public exploit details exist, and ...

Ascensio System ONLYOFFICE 安全漏洞

Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. A security vulnerability exists in Ascensio System ONLYOFFICE version 12.7.0 and earlier, which stems from an incorrect manipulation of the component Comment Handler in the file /Products/Projects/Messages.aspx, which...

PT-2025-37192

Name of the Vulnerable Software and Affected Versions: OnlyOffice versions through 12.7.0 Description: A vulnerability exists in Ascensio System SIA OnlyOffice that can lead to cross site scripting. The issue is located in the Comment Handler component, specifically within the file...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /c/portal/comment/discussion/geteditor path. An attacker can execute arbitrary web scripts in the context of a user's browser by crafting a malicious request. Details Cross-site scripting or XSS is a cod...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

PT-2025-37097

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.73 through 7.4.3.128 Liferay DXP versions 2024.Q3.0 through 2024.Q3.1 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay versions 7.4 update 73 through...