PT-2025-34470 · My-Site · My-Site

Name of the Vulnerable Software and Affected Versions: my-site version 1.0.2.RELEASE Description: An incorrect access control issue exists in the doFilter function, allowing attackers to access sensitive components without authentication. Recommendations: Apply updates to address the access contr...

Malicious code in @navancorp/angular-web-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c94679c1658a3cfefa49daf06a90a50daeb480069b754976a6f72efa2e4e1d44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-41423 Malicious code in @navancorp/angular-web-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c94679c1658a3cfefa49daf06a90a50daeb480069b754976a6f72efa2e4e1d44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mattermost Fails to Sanitize Path Traversal Sequences

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2 fails to sanitize path traversal sequences in template file destination paths, which allows a system admin to perform path traversal attacks via malicious path components, potentially enabling malicious file...

May 13, 2025—KB5058411 (OS Build 26100.4061)

None None...

Linux Distros Unpatched Vulnerability : CVE-2024-22243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the...

CVE-2024-53495

Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication...

CVE-2025-28041

Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication...

CVE-2025-28041

Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication...

CVE-2025-49424

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themepassion Support Ticket support-ticket allows Reflected XSS.This issue affects Support Ticket: from n/a through = 1.9...

CVE-2025-49424

CVE-2025-49424 corresponds to a Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Essential Doo Components for Visual Composer (versions up to 1.9). The root cause is improper input neutralization during web page generation, enabling DOM-based XSS. PatchStack notes the affected plu...

CVE-2025-49424 WordPress Support Ticket Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themepassion Support Ticket support-ticket allows Reflected XSS.This issue affects Support Ticket: from n/a through = 1.9...

EUVD-2025-25255

A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role...

CVE-2025-9098

A vulnerability was determined in Elseplus File Recovery App 4.4.21 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit...

CVE-2025-9097

A vulnerability was found in Euro Information CIC banque et compte en ligne App 12.56.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.cicprod.bad. The manipulation leads to improper export of android application...

CVE-2024-57152

Summary: CVE-2024-57152 affects my-site v1.0.2 due to incorrect access control in the preHandle function of the cn.luischen.interceptor.BaseInterceptor class, enabling unauthenticated access to sensitive components. The CVSS v3.1 base score is 7.5 (HIGH); attack vector is NETWORK, with LOW attack...

iTranswarp 安全漏洞

iTranswarp is a full-featured CMS by Crypto Michael Individual Developers. A security vulnerability exists in iTranswarp 2.19 and earlier versions that stems from improper access control of the doFilter function, which could lead to unauthenticated access to sensitive components...

PT-2025-33951 · Diego.Benna · Essential Doo Components For Visual Composer

Name of the Vulnerable Software and Affected Versions: Essential Doo Components for Visual Composer versions n/a through 1.9 Description: An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue exists in diego.benna Essential Doo Components for Visual Composer,...

Ubuntu: Security Advisory (USN-7703-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress plugin Essential Doo Components for Visual Composer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress plugin...