CVE-2025-12228: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create of the component Users Page. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The...

PT-2025-43883

Name of the Vulnerable Software and Affected Versions projectworlds Expense Management System version 1.0 Description A security flaw exists in projectworlds Expense Management System 1.0. The issue involves cross site scripting and affects an unknown function within the /public/admin/roles/creat...

PT-2025-43885

Name of the Vulnerable Software and Affected Versions projectworlds Expense Management System version 1.0 Description A weakness exists in projectworlds Expense Management System version 1.0 that allows for cross site scripting. The issue impacts an unknown function within the Currency Page...

PT-2025-43772

Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...

PT-2025-49986

Name of the Vulnerable Software and Affected Versions Create Posts & Terms versions prior to 1.3.2 Description A Cross-Site Request Forgery CSRF issue exists due to missing or incorrect nonce validation a unique token used to prevent forged requests on a function. This allows unauthenticated...

Projectworlds Expense Management System security vulnerabilities

Projectworlds Expense Management System is an open source expense management system from Projectworlds. A security vulnerability exists in Projectworlds Expense Management System version 1.0, which stems from an incorrect manipulation of the file /public/admin/expensecategories/create, and could...

PT-2025-43938

Name of the Vulnerable Software and Affected Versions DRED virtual campus platform affected versions not specified Description A SQL injection issue exists in the DRED virtual campus platform. An attacker can retrieve, create, update, and delete data from the database. This is achieved by sending...

PT-2025-43882

Name of the Vulnerable Software and Affected Versions projectworlds Expense Management System version 1.0 Description A flaw exists in projectworlds Expense Management System that allows for cross site scripting. The issue is located in an unknown function within the /public/admin/users/create fi...

PT-2025-43931

Name of the Vulnerable Software and Affected Versions Wisencode versions prior to 20251013 Description A security flaw exists in Wisencode up to version 20251012. This issue affects an unknown functionality within the Create Support Ticket Handler component, specifically the file...

CVE-2025-12264: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Wisencode up to 20251012. Affected by this vulnerability is an unknown functionality of the file /support-ticket/create of the component Create Support Ticket Handler. The manipulation of the argument Message results in cross site scripting. The attack may b...

CVE-2025-12230: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of the component Currency Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit ha...

SUSE CVE-2023-53696

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in qla2x00probeone There is a memory leak reported by kmemleak: unreferenced object 0xffffc900003f0000 size 12288: comm "modprobe", pid 19117, jiffies 4299751452 age 42490.264s hex dump first 32...

CVE-2025-10694: Missing Authorization

The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybeloadonboardingwizard function in all versions up to, and including, 1.8.0. This makes it possibl...

FlashMQ security vulnerabilities

FlashMQ is a fast and lightweight MQTT proxy server from the individual developer Wiebe Cazemier. A security vulnerability exists in FlashMQ versions prior to 1.23.2 that stems from an authenticated user being able to create sessions and collect QoS messages, potentially resulting in unreleased...

LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.

...

btrfs: fix anon_dev leak in create_subvol()

...

EUVD-2025-35776

Malicious code in create-artifact-worker npm...

MAL-2025-48560 Malicious code in create-artifact-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17addb465b6ed297d01361f4bf1b6b46f5eb2917622ac0f7b577dae8e7c29cae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in create-artifact-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17addb465b6ed297d01361f4bf1b6b46f5eb2917622ac0f7b577dae8e7c29cae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in create-artifact-worker

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...