CVE-2025-64074

A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to delete arbitrary files on the host by supplying a crafted session cookie value...

CVE-2026-25577

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmettcore.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause...

CVE-2025-64075

A path traversal vulnerability in the checktoken function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value...

CVE-2019-25312

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session...

CVE-2019-25312

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session...

CVE-2019-25312

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session...

CVE-2019-25312

CVE-2019-25312 affects InoERP 0.7.2, introducing a persistent cross-site scripting (XSS) vulnerability in the comment section. The issue allows unauthenticated attackers to submit comments containing JavaScript payloads that execute in other users’ browsers, with potential cookie and session info...

CVE-2025-64075

A path traversal vulnerability in the checktoken function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value...

CVE-2025-64075

A path traversal vulnerability in the checktoken function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value...

HCL AION Cross-Site Request Forgery Vulnerability

HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from a cross-site request forgery vulnerability that stems from a missing or insecure SameSite attribute of a cookie, and no detailed vulnerability details are provided at this time...

CVE-2025-64074

A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to delete arbitrary files on the host by supplying a crafted session cookie value...

CVE-2025-64074

A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to delete arbitrary files on the host by supplying a crafted session cookie value...

PT-2026-7607

Name of the Vulnerable Software and Affected Versions InoERP version 0.7.2 Description InoERP version 0.7.2 has a persistent cross-site scripting issue in the comment section. Unauthenticated attackers can inject malicious scripts, such as JavaScript payloads, through comments. These scripts...

PT-2026-7617

A path traversal vulnerability in the check token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value...

PT-2026-7600

Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names during document uploads. Attackers can upload files with embedded SVG scripts that execute in the browser, potentially stealing cookies or...

CVE-2025-64075

A path traversal vulnerability in the checktoken function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value...

CVE-2025-64074

CVE-2025-64074 describes a path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 (version 23.09.27). A remote attacker can delete arbitrary files on the host by supplying a crafted session cookie value. The available documents do not provide concret...

CVE-2025-64075

CVE-2025-64075 describes a path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 firmware 23.09.27. The issue allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value. Affected c...

Phraseanet 跨站脚本漏洞

Phraseanet is an open-source digital asset management system developed by Alchemy. Version Phraseanet 4.0.3 contains a cross-site scripting vulnerability. This vulnerability stems from stored-xss attacks, which can allow for the injection of malicious scripts when uploading specially crafted file...

CVE-2026-25577

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmettcore.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause...