CVE-2012-10034 ClanSphere 2011.3 Local File Inclusion via cs_lang Cookie

ClanSphere 2011.3 is vulnerable to a local file inclusion LFI flaw due to improper handling of the cslang cookie parameter. The application fails to sanitize user-supplied input, allowing attackers to traverse directories and read arbitrary files outside the web root. The vulnerability is further...

CVE-2025-2611

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

EUVD-2025-23629

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

CVE-2025-2611 ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

CVE-2025-2611 ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

CVE-2025-2611

ICTBroadcast

PT-2025-31997 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.4.2 Concrete CMS versions prior to 8.5.21 Description: The software is vulnerable to Reflected Cross-Site Scripting XSS in the Conversation Messages Dashboard Page. Unsanitized input could lead to session...

ClanSphere 安全漏洞

ClanSphere is a web content management system from the ClanSphere organization. A security vulnerability exists in ClanSphere version 2011.3 that stems from not properly handling the cslang cookie parameter, which could lead to local file inclusion...

📄 ICTBroadcast Unauthenticated Remote Code Execution

This Metasploit module exploits an unauthenticated remote code execution RCE vulnerability in ICTBroadcast. The vulnerability exists in the way session cookies are handled and processed, allowing an attacker to inject arbitrary system commands. This module requires Metasploit:...

PT-2025-31986 · Unknown · Clansphere

Name of the Vulnerable Software and Affected Versions: ClanSphere version 2011.3 Description: ClanSphere version 2011.3 is susceptible to a local file inclusion flaw because of improper handling of the cs lang cookie parameter. The application does not sanitize user-supplied input, which allows...

CVE-2025-8528

CVE-2025-8528 affects Exrick xboot up to 3.3.4. An issue in the function at /xboot/permission/getMenuList allows manipulation that stores sensitive information in cleartext in a cookie. The vulnerability can be exploited remotely with high attack complexity and no user interaction. Confidentialit...

CVE-2025-8528 Exrick xboot getMenuList sensitive information in a cookie

A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible to launch the attack remotely. The...

CVE-2025-8528 Exrick xboot getMenuList sensitive information in a cookie

A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible to launch the attack remotely. The...

CVE-2025-8528 Exrick xboot getMenuList sensitive information in a cookie

A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible to launch the attack remotely. The...

XBoot 安全漏洞

XBoot is a one-stop front-end and back-end separation rapid development platform for Exrick individual developers. A security vulnerability exists in XBoot 3.3.4 and earlier versions, which stems from sensitive information being stored in a cookie in clear text...

Linux Distros Unpatched Vulnerability : CVE-2020-26955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same...

U.S. Dept Of Defense: Cross-Site Scripting via 'RAISED_FUNDS_DESC' parameter

A Cross-Site Scripting XSS vulnerability was discovered in the parameter 'RAISEDFUNDSDESC' through the POST method on the target website. Exploitation of this vulnerability could have led to consequences such as cookie theft and session hijacking. The vendor was notified, and appropriate...

CVE-2025-5947

The Service Finder Bookings WordPress plugin (versions

Exploit for CVE-2025-54589

CVE-2025-54589 – Copyparty Reflected XSS Author: Byte Rea...

CVE-2025-40980

A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...