CVE-2025-32074 XSSes in Extension:ConfirmAccount

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - Confirm Account Extension: from 1.39 through 1.43...

CVE-2025-32074

The MediaWiki - Confirm Account Extension (versions 1.39 through 1.43 ) is vulnerable to a Cross-Site Scripting (XSS) attack due to improper encoding or escaping of output . This vulnerability allows an attacker to execute malicious scripts in a user's browser session. To mitigate the risk, it is...

MediaWiki 安全漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the Wikimedia USA Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki - A security vulnerability exists in Confirm Account Extension versions 1.39 throug...

CVE-2025-32074: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - Confirm Account Extension: from 1.39 through 1.43...

PT-2025-16138 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - Confirm Account Extension versions 1.39 through 1.43 Description: The issue is related to improper encoding or escaping of output, which enables Cross-Site Scripting XSS in the Mediawiki - Confirm Account Extension. This is due to...

CVE-2025-2715 timschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scripting

A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...

CVE-2025-2715

The CVE-2025-2715 entry describes a cross-site scripting flaw affecting timschofield webERP up to 5.0.0.rc+13, in ConfirmDispatch_Invoice.php (Narrative parameter). Remote exploitation is possible; multiple sources note the vulnerability and advise applying a patch. The initial disclosure indicat...

CVE-2025-2715: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...

UBUNTU-CVE-2024-51144

Cross Site Request Forgery CSRF vulnerability exists in the 'pvmsg.php?action=addmessage', pvmsg.php?action=confirmdelete , and ajax.server.php?page=user&action=flipfollow endpoints in Ampache = 6.6.0...

MAL-2025-875 Malicious code in test-for-confirm-paths (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in test-for-confirm-paths (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-36751

creationtimestamp| type| source ---|---|--- 2025-01-15 22:08:09+00:00| seen| https://infosec.exchange/users/cve/statuses/113834648470715594 2025-01-15 22:15:44+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfss4fqvha2p 2025-01-15 22:55:16+00:00|...

VulnCheck KEV: CVE-2024-52875

Several vulnerabilities are present in GFI KerioControl due to improper sanitization of the 'dest' GET parameter used to generate a 'Location' HTTP header. The affected endpoints include /nonauth/addCertException.cs, /nonauth/guestConfirm.cs, and /nonauth/expiration.cs. Exploitation could allow f...

AZL-54917 CVE-2024-56643 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccpfeatchangerecv If dccpfeatpushconfirm fails after new value for SP feature was accepted without reconciliation 'entry == NULL' branch, memory allocated for that value with dccpfeatclonespval is never...

DEBIAN-CVE-2024-56643

In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccpfeatchangerecv If dccpfeatpushconfirm fails after new value for SP feature was accepted without reconciliation 'entry == NULL' branch, memory allocated for that value with dccpfeatclonespval is never...

UBUNTU-CVE-2024-56643

In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccpfeatchangerecv If dccpfeatpushconfirm fails after new value for SP feature was accepted without reconciliation 'entry == NULL' branch, memory allocated for that value with dccpfeatclonespval is never...

Malicious code in windows-confirm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d941ea99acd2b75940d396cc9ab95033f82521f2085f79948f2ab44796a1a8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the confirm_login_allowed() method in the Django web application framework, related to the disclosure of information that allows attackers to access confidential data

The vulnerability of the confirmloginallowed method in the Django web application framework relates to the exposure of sensitive information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data remotely...

Script execution via PDF as attachment - CVE-2021-39111

The attachment as PDF is a vulnerable PDFJS library. To confirm the vulnerability, we uploaded a PDF file containing a JavaScript. After opening a preview of the PDF file, the console displayed the message "Hello, xss is working," indicating that the JavaScript code had been successfully executed...

DEBIAN-CVE-2022-48909

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix connection leak There's a potential leak issue under following execution sequence : smcrelease smcconnectwork if sk-skstate == SMCINIT sendclcconfirim tcpabort; ... sk.skstate = SMCACTIVE smccloseactive...