CVE-2025-59359 OS command injection in Chaos Mesh via the cleanTcs mutation

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59358 Denial of Service via Unauthorized Access to Chaos Mesh debugging server

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

BIT-PRESTASHOP-2025-51586

An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature...

CVE-2025-10425

A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function of the file /admin/controller/studentcontroller.php. Such manipulation of the argument newimage leads to unrestricted upload. The attack m...

CVE-2025-10425

A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function of the file /admin/controller/studentcontroller.php. Such manipulation of the argument newimage leads to unrestricted upload. The attack m...

CVE-2025-10424

A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/facultycontroller.php. This manipulation of the argument newimage causes unrestricted upload. The attack is...

CVE-2025-10424

A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/facultycontroller.php. This manipulation of the argument newimage causes unrestricted upload. The attack is...

CVE-2025-10425 1000projects Online Student Project Report Submission and Evaluation System student_controller.php unrestricted upload

A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function of the file /admin/controller/studentcontroller.php. Such manipulation of the argument newimage leads to unrestricted upload. The attack m...

CVE-2025-10425 1000projects Online Student Project Report Submission and Evaluation System student_controller.php unrestricted upload

A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function of the file /admin/controller/studentcontroller.php. Such manipulation of the argument newimage leads to unrestricted upload. The attack m...

CVE-2025-10425

CVE-2025-10425 affects 1000projects Online Student Project Report Submission and Evaluation System 1.0. The vulnerability is in an unknown function of /admin/controller/student_controller.php, where manipulation of the new_image argument leads to unrestricted file uploads. The issue can be exploi...

CVE-2025-10424 1000projects Online Student Project Report Submission and Evaluation System faculty_controller.php unrestricted upload

A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/facultycontroller.php. This manipulation of the argument newimage causes unrestricted upload. The attack is...

CVE-2025-10424 1000projects Online Student Project Report Submission and Evaluation System faculty_controller.php unrestricted upload

A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/facultycontroller.php. This manipulation of the argument newimage causes unrestricted upload. The attack is...

CVE-2025-10424

CVE-2025-10424 affects 1000projects Online Student Project Report Submission and Evaluation System version 1.0. The vulnerability is in /admin/controller/faculty_controller.php, where manipulation of the argument new_image enables unrestricted file uploads and can be exploited remotely. Public di...

CVE-2025-10331

A vulnerability has been found in cdevroe unmark up to 1.9.3. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such manipulation of the argument Title leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to th...

CVE-2025-59361: Improper Neutralization of Special Elements used in an OS Command

The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59360: Improper Neutralization of Special Elements used in an OS Command

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

CVE-2025-59359: Improper Neutralization of Special Elements used in an OS Command

The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

PT-2025-37475

Name of the Vulnerable Software and Affected Versions Chaos Controller Manager affected versions not specified Description The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. This allows unauthenticated in-cluster attackers to perform remote code executio...

PT-2025-37474

Name of the Vulnerable Software and Affected Versions Chaos Mesh affected versions not specified Description A command injection flaw exists in Chaos Mesh’s cleanTcs mutation. This flaw allows unauthenticated in-cluster attackers to perform remote code execution across the cluster. The...

CVE-2025-59358: Missing Authentication for Critical Function

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...