CVE-2025-66310 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...

CVE-2025-66309 Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...

CVE-2025-66309

Grav admin plugin (admin/pages/[page]) is affected by a Reflected XSS in the data[header][content][items] parameter of GET /admin/pages/[page]. The issue stems from insufficient input validation/sanitization and is fixed in Grav 1.11.0-beta.1. Multiple sources describe the vulnerability and inclu...

CVE-2025-66309 Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...

CVE-2025-10064 itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting

A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This issue affects some unknown processing of the file /inventory/main/vendors/datatables/unittesting/templates/domdatatwoheaders.php. The manipulation of the argument scripts results in cross site scripting. The...

GHSA-CPJ6-FHP6-MR6J React Router allows pre-render data spoofing on React-Router framework mode

Summary After some research, it turns out that it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values ​​of the data object passed to the HTML. Latest versions are impacted. Details The vulnerable header i...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fixed the issue where no check was performed to determine whether skb actually contained an ACL header. Otherwise, the code might attempt to access uninitialized/invalid memory beyond the valid skb-data...

The vulnerability of the Bluetooth Low Energy (BLE) technology in tool sets and libraries for setting up wireless connections provided by Cypress’ Bluetooth SDK allows a intruder to trigger a service failure.

The vulnerability of the Bluetooth Low Energy BLE technology, as well as the toolkits and libraries for configuring wireless connections in Cypress’ Bluetooth SDK, is related to the issue where an operation goes beyond the buffer boundaries in memory when processing the Length field of the Data...

Azure RTOS USBX 数字错误漏洞

Azure RTOS USBX is a USB host, device, and mobile OTG embedded stack for Azure RTOS open source. Fully integrated with Azure RTOS ThreadX, it is available for all processors that support Azure RTOS ThreadX. A numeric error vulnerability exists in Azure RTOS USBX versions prior to 6.1.12, which...

Debian DSA-4053-1 : exim4 - security update

Several vulnerabilities have been discovered in Exim, a mail transport agent. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2017-16943 A use-after-free vulnerability was discovered in Exim's routines responsible for parsing mail headers. A remote attacke...

real.c Arbitrary Code Execution Vulnerability

real.c is the C file library for parsing streams. An arbitrary code execution vulnerability exists in real.c that could allow a remote attacker to execute arbitrary code via a crafted length value RDT block header...

iPhone SMS spoofing vulnerability disclosure-vulnerability warning-the black bar safety net

Vulnerability description: 4 days ago Pod2g issued a document to Never trust SMS: iOS text spoofin http://pod2g-ios.blogspot.com/2012/08/never-trust-sms-ios-text-spoofing.html The vulnerability can affect all iOS version including the latest iOS 6 beta 4 to. And cloth use the program:...

Apple iOS SMS伪造漏洞

Apple iOS是一款苹果公司开发的移动设备上的操作系统。 Apple iOS上的SMS存在安全漏洞，允许攻击者获取敏感信息或进行伪造攻击。 SMS消息的文本负载中，UDH User Data Header段是一个可选的，但定义了很多手机不兼容的高级功能。其中有个选项允许用户更改文本的回复地址，如果目的手机兼容此消息，并且如果接收者尝试回复文本，那么他就不会回应原来的号码，而是指定的那个。大多数运营商不会检查这部分消息，这意味着攻击者可以任意指定此段，如修改为911或其他号码。 要利用这个SMS漏洞，需要攻击者可以RAW PDU格式发送文本。 0 Apple iOS 厂商解决方案...

Serious Security Flaw : iPhone Bug Allows SMS Spoofing

A rather serious security flaw in the iPhone's SMS messaging system has been discovered and revealed by well-known security researcher and jailbreak extraordinaire 'pod2g'. Security flaw affecting all iPhones that he says could facilitate hackers or thieves to access your personal information. Th...

RealNetworks RealPlayer Malformed IVR Object Index Code Execution Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists when parsing a RealMed...