PT-2025-33087 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: myBB version 1.6.4 Description: myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. This backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted...

CVE-2025-43989

The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the settimesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie bypassing normal session checks, an...

CVE-2025-8814

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has...

Santesoft Sante PACS Server

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to create arbitrary files, cause a denial-of-service condition, obtain sensitive information, and steal a user's cookie information. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

PT-2025-32883

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 7.0 through 7.6 Fortinet FortiWeb versions 7.6.3 and below Fortinet FortiWeb versions 7.4.7 and below Fortinet FortiWeb versions 7.2.10 and below Fortinet FortiWeb versions 7.0.10 and below Description An improper...

Linux Distros Unpatched Vulnerability : CVE-2024-5699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a...

Linux Distros Unpatched Vulnerability : CVE-2022-31042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Guzzle is an open source PHP HTTP client. In affected versions the Cookie headers on requests are sensitive information. On making a request using the https...

curl: CVE-2025-9086: Out of bounds read for cookie path

We are tracking this issue with the public ID BIGSLEEP-437903454. Please use this identifier for reference in any future communication. Vulnerability Details In the cookie support found in cookie.c, there's an out-of-bounds string comparison that results from a crafted sequence of cookie...

BIT-LIBPHP-2024-2756 __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...

BIT-LIBPHP-2022-31629 $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...

BIT-LIBPHP-2020-7070 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...

TencentOS Server 2: httpd (TSSA-2025:0526)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0526 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

CVE-2025-8814

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has...

CVE-2025-8814 atjiu pybbs CookieUtil.java setCookie cross-site request forgery

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has...

CVE-2025-8814 atjiu pybbs CookieUtil.java setCookie cross-site request forgery

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has...

CVE-2025-8814

CVE-2025-8814 affects atjiu pybbs up to version 6.0.0. The vulnerability lies in the setCookie function in src/main/java/co/yiiu/pybbs/util/CookieUtil.java, enabling cross-site request forgery. Exploitation is possible remotely, and public disclosure of the exploit is noted. The patch 8aa2bb1aef3...

CVE-2025-8814 atjiu pybbs CookieUtil.java setCookie cross-site request forgery

A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has...

CVE-2025-8708

A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of the file ShiroConfiguration.java of the component com.gm.wj.config.ShiroConfiguration. The manipulation with the input EVANNIGHTLYWAOU leads...

pybbs 安全漏洞

pybbs is a community platform for Java development by iuiu individual developers. A security vulnerability exists in pybbs 6.0.0 and earlier versions, which originates from a cross-site request forgery caused by the function setCookie in the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java,...

CVE-2025-8708 Antabot White-Jotter com.gm.wj.config.ShiroConfiguration ShiroConfiguration.java CookieRememberMeManager deserialization

A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of the file ShiroConfiguration.java of the component com.gm.wj.config.ShiroConfiguration. The manipulation with the input EVANNIGHTLYWAOU leads...