108652 matches found
Incus vulnerable to local privilege escalation through custom storage volumes
Impact This affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true as well as access to the host as an unprivileged user. The most common case for this would ...
Malicious code in teate-thy-sonic-kotis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ef3bf1d1162ab66f6704380f31bedff135a962f261a38f335408ead6c5cbd37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
DRUPAL-CORE-2025-008
The core system module handles downloads of private and temporary files. Contrib modules can define additional kinds of files schemes that may also be handled by the system module. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This...
MAL-2025-177386 Malicious code in poglymer-ogmih-affg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d80511ede6f618285808a799221e1559b8bd20968482e0c753732aae76e0876b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Important: Red Hat Security Advisory: Cluster Observability Operator 1.3.0
The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.3 release of COO...
CVE-2025-41104
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'customfield1' in '/estimaterequests/saveestimaterequest'...
CVE-2025-7633
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report...
CVE-2025-12132
The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due to missing or incorrect nonce validation on the wpclplsave functionality. This makes it possible for unauthenticated attackers to modify...
CVE-2025-11821
The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooproductscustomtax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes...
MAL-2025-134007 Malicious code in hadianto-keraktelor4-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e47c7ab647385e7213c3c6fd0c0a97f935eeaf65f7d699be667c31f378c315d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-126014 Malicious code in eka-kue18-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc51e56f0f771372e32b72a6ba32ba19cc5c7a0fd1a7002c400f7c0e4b114efb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-84354
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'customfield1' in '/estimaterequests/saveestimaterequest'...
MAL-2025-114478 Malicious code in hadianto-miemee17-miaww (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fca3c141beeda78bb3231a6bffbb66654129bf7fce3bbfa2340d4dbcd280bf7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-41104
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'customfield1' in '/estimaterequests/saveestimaterequest'...
CVE-2025-41104
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'customfield1' in '/estimaterequests/saveestimaterequest'...
EUVD-2025-84364
Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Custom report...
CVE-2025-41104 Multiple vulnerabilities in Fairsketch's RISE CRM Framework
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'customfield1' in '/estimaterequests/saveestimaterequest'...
CVE-2025-41104
Summary: CVE-2025-41104 is an HTML injection vulnerability in Fairsketch’s RISE CRM Framework v3.8.1. The issue stems from insufficient validation of user input in the POST parameter custom_field_1 at /estimate_requests/save_estimate_request, enabling HTML injection. Affected software: Fairsketch...