PT-2025-32464 · Emqx · Emqx

Name of the Vulnerable Software and Affected Versions: EMQX versions prior to 5.8.6 Description: Administrators could install arbitrary novel plugins via the Dashboard web interface. The supplier considers this intended behavior; however, version 5.8.6 introduced a defense-in-depth feature...

CVE-2025-52136

In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability for later Dashboard installation is set b...

CVE-2025-47907 vulnerabilities

Vulnerabilities for packages: ini-file, skopeo, nova, podman, nri-kafka, fq, boring-registry, configmap-reload, mongo-tools, kubebuilder, kubo, xeol, kube-logging-operator-custom-runner, helm-mapkubeapis, timescaledb-parallel-copy, secrets-store-csi-driver-provider-gcp, helm, guac,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: ini-file, skopeo, nova, podman, nri-kafka, fq, boring-registry, configmap-reload, mongo-tools, kubebuilder, kubo, xeol, kube-logging-operator-custom-runner, helm-mapkubeapis, timescaledb-parallel-copy, secrets-store-csi-driver-provider-gcp, helm, guac,...

Malicious code in c-monitor-dashboard (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1ac5ace2c2268c16914bea284713d9bf69f2414d204cb79d4f32d8aa434b4eb The OpenSSF Package Analysis project identified 'c-monitor-dashboard'...

MAL-2025-6835 Malicious code in c-monitor-dashboard (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f1ac5ace2c2268c16914bea284713d9bf69f2414d204cb79d4f32d8aa434b4eb The OpenSSF Package Analysis project identified 'c-monitor-dashboard'...

Security Bulletin: IBM Datapower Operations Dashboard could allow malicious or exploitable backend/content generators CVE-2023-38709

Summary Apache HTTP Server is used to deliver website content over the internet. Vulnerability Details CVEID:CVE-2023-38709 DESCRIPTION: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP...

CVE-2025-8573

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this vulnerabili...

Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login...

GHSA-4PCG-PJP5-3MC6 Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting XSS in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and if victim is an admi...

GHSA-C5XF-RMV4-J85H Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the Conversation Messages Dashboard page. An attacker can execute arbitrary scripts in the context of a user's browser by...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Home Folder process on the Members Dashboard page. An attacker can execute arbitrary scripts in the context of another user's session by setting up a...

CVE-2025-8573

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this...

CVE-2025-8571 Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting XSS in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and if victim is an admi...

CVE-2025-8573

Concrete CMS versions 9 through 9.4.2 are affected by a Stored XSS in the Home Folder on the Members Dashboard page. An administrator could create a malicious folder whose XSS payload is triggered when users are directed there upon login. Version 8 is not affected. Remediation observed in the con...

CVE-2025-8573 Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this...

CVE-2025-8573 Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this...

CVE-2025-8573 Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login. The Concrete CMS security team gave this...

Concrete CMS 安全漏洞

Concrete CMS is a team-oriented open source content management system from Concrete CMS Open Source. A security vulnerability exists in Concrete CMS versions 9 through 9.4.2 and prior to 8.5.21, which stems from a reflected cross-site scripting vulnerability in the Session Messages Dashboard page...