CVE-2025-60833

An XML External Entity XXE vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data...

Code-Projects Online Complaint Site SQL注入漏洞

Online Complaint Site is an online complaint site. Online Complaint Site suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Category in the file /admin/category.php. An attacker can exploit this vulnerabilit...

CVE-2025-60833

An XML External Entity XXE vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data...

CVE-2025-60833

An XML External Entity XXE vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data...

MAL-2025-48073 Malicious code in redirect-rc2ewa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35e1ffda65105f619c869543d8f7b50b73dff1fd865a8cbec013927540e90031 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-dravb9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ada24832ca1483913a8a5287458635e479ea1d11ba7809f73dd45d30dc08ed14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in erubi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9add1663a518f1688c3a014e351a0cba0fafb34a4e5270c74aa5102443fd88e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48014 Malicious code in async-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 219d4f4b2ee4a3b5ad9499a019b0f6ce848b7ae5bdc38e72e6c68c24b2ba3c77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

uzy-ssm-mall 安全漏洞

uzy-ssm-mall yuzu cloud e-commerce is an SSM framework by ghostxbh individual developer for building e-commerce, bookstore malls, customer management, and so on. A security vulnerability exists in uzy-ssm-mall version 1.1.0, which stems from the presence of XML external entity references in the...

The vulnerability of the Unbound DNS server, related to the loading of external, unreliable data alongside reliable data, allows attackers to perform cache poisoning attacks.

The vulnerability of the Unbound DNS server relates to the loading of external, unreliable data alongside reliable data. Exploiting this vulnerability allows a remote attacker to perform cache poisoning attacks...

CVE-2025-60833

An XML External Entity XXE vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data...

CVE-2025-60833

CVE-2025-60833 (uzy-ssm-mall v1.1.0) : An XML External Entity (XXE) flaw in the /mall/wxpay/pay component allows an attacker to execute arbitrary code by supplying crafted XML data. Root cause: XXE in the XML parsing path. Affected software is uzy-ssm-mall v1.1.0; document does not provide a fixe...

CVE-2025-60833

An XML External Entity XXE vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data...

PT-2025-41266

Name of the Vulnerable Software and Affected Versions uzy-ssm-mall version 1.1.0 Description The /mall/wxpay/pay component contains a flaw that allows attackers to execute arbitrary code by providing specially crafted XML data. This is due to an XML External Entity XXE issue. Recommendations At t...

EUVD-2025-33165

An XML External Entity XXE vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data...

CVE-2025-61768

KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF Server-Side Request Forgery vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external imag...

CVE-2025-11341

A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo=1. Performing manipulation results in xml external entity reference. Remote exploitation of the attack is possible. The...

CVE-2025-55971

TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 Android TV, Kernel 5.4.242+, is vulnerable to a blind, unauthenticated Server-Side Request Forgery SSRF vulnerability via the UPnP MediaRenderer service AVTransport:1. The device accepts unauthenticated SetAVTransportURI SOAP...

CVE-2025-54406

creationtimestamp| type| source ---|---|--- 2025-10-07 14:00:28+00:00| seen| https://infosec.place/objects/14914574-a0a0-47ef-ae2b-97e35542f29f 2025-10-07 14:15:00+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115333300163218722 2025-10-16 07:20:16+00:00| seen|...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of quoted local-parts containing @. An attacker can cause emails to be sent to unintended...