CVE-2025-41752

CVE-2025-41752 describes a reflected XSS in pxc_portSfp.php that can be exploited by an unauthenticated attacker to entice an authenticated user to click a malicious link and modify device configuration via web-based management. The vulnerability is reported as affecting PHOENIX CONTACT FL SWITCH...

Weak Authentication

org.apache.druid, druid is vulnerable to Weak Authentication. The vulnerability is due to the Kerberos authenticator using a weak fallback secret generated with a non-cryptographically secure RNG when druid.auth.authenticator.kerberos.cookieSignatureSecret is not set, which allows an attacker to...

PT-2025-49814

An XSS vulnerability in dyn conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

Amazon Linux 2023 : ecs-init (ALAS2023-2025-1295)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1295 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

PT-2025-49821

An XSS vulnerability in port util.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

WordPress plugin Cookie Notice & Compliance for GDPR / CCPA 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blogs on PHP and MySQL-based servers. A...

CVE-2025-65300

The CVE-2025-65300 entry concerns a stored XSS in the Coohom SaaS Platform, specifically in the Account Settings module for feVersion=1760060603897 (2025-10-28). The vulnerability arises from unsanitized input in Address fields (City, State, Country/Region) that is rendered back to the profile pa...

PT-2025-50145

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS issue in the theme parameter of the ''/Mondo/lang/sys/Forms/Statistics.aspx'' endpoint. The theme value is not...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2025-1288)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1288 advisory. A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafte...

PT-2025-50136

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Message parameter of the ''/Mobile/Compose.aspx'' API endpoint. The Message value is not proper...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A security vulnerability exists in Fortinet...

PT-2025-50236

Name of the Vulnerable Software and Affected Versions COMMAX Biometric Access Control System version 1.0.0 Description The COMMAX Biometric Access Control System is affected by an authentication bypass. An unauthenticated attacker can exploit this to access sensitive information and bypass physic...

PT-2025-49822

An XSS vulnerability in pxc PortCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

📄 Cloudflare Memory Leak

A Python-based scanner imitates CloudBleed-style leakage detection by fetching raw HTTP response data from a target website, converting it to hexadecimal, and searching for sensitive memory patterns such as sessions, passwords, tokens, cookies, AWS keys, and stack traces. It does not exploit the...

COMMAX Biometric Access Control System 安全漏洞

COMMAX Biometric Access Control System is a biometric access control system from COMMAX Corporation in South Korea. A security vulnerability exists in COMMAX Biometric Access Control System version 1.0.0, which stems from a cookie poisoning issue that could lead to authentication bypass and...

PT-2025-50228

Name of the Vulnerable Software and Affected Versions Elysia versions 1.4.17 and below Description Elysia is a Typescript framework used for request validation, type inference, OpenAPI documentation, and client-server communication. Versions 1.4.17 and below are susceptible to arbitrary code...

PT-2025-49762

Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result...

PT-2025-49820

An XSS vulnerability in pxc Dot1xCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

PT-2025-49928

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Humanityco Cookie Notice & Compliance for GDPR / CCPA cookie-notice allows Stored XSS.This issue affects Cookie Notice & Compliance for GDPR / CCPA: from n/a through = 2.5.8...

Amazon Linux 2023 : cni-plugins (ALAS2023-2025-1287)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1287 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...