CVE-2025-55173

CVE-2025-55173 is a vulnerability in Next.js Image Optimization: attacker-controlled external image sources could cause content injection, enabling file downloads with arbitrary content/filenames under certain configurations and potentially aiding phishing. Affected versions are Next.js before 14...

CVE-2025-55173 Next.js Content Injection Vulnerability for Image Optimization

Next.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary...

Missing Source Correlation of Multiple Independent Data

Overview next is a react framework. Affected versions of this package are vulnerable to Missing Source Correlation of Multiple Independent Data in image-optimizer. An attacker can cause arbitrary files to be downloaded with attacker-controlled content and filenames by supplying malicious external...

GHSA-XV57-4MR9-WG8V Next.js Content Injection Vulnerability for Image Optimization

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious...

PT-2025-35326

Name of the Vulnerable Software and Affected Versions: Next.js versions prior to 14.2.31 Next.js versions 15.0.0 through 15.4.5 Description: Next.js Image Optimization is susceptible to content injection. Attackers controlling external image sources can trigger file downloads with arbitrary conte...

The vulnerability in the GeoServer Web Feature Service (WFS) software, used for managing and publishing geospatial data on the OSGeo GeoServer server, allows a perpetrator to disclose protected information.

The vulnerability in the GeoServer Web Feature Service WFS software, used for managing and publishing geospatial data on the OSGeo GeoServer server, is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to disclose...

MAL-2025-41930 Malicious code in @rbapp/pages (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

CVE-2025-52460

Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier Media version:16.0.0a and earlier. If exploited, uploaded files and SS1 configuration files may be accessed by a remote unauthenticated attacker...

Open Redirect

Astro is vulnerable to Open Redirect. The vulnerability is due to improper handling of paths with double slashes in the trailing slash redirection logic, which allows an attacker to redirect users to arbitrary external domains and perform phishing or social engineering attacks...

Delta Electronics EIP Builder XML External Entity Injection Vulnerability

Delta Electronics EIP Builder is a configuration tool for connecting various devices from Delta Electronics China. Delta Electronics EIP Builder suffers from an XML External Entity Injection vulnerability that stems from improper handling of XML external entities in file parsing, which can be...

📄 Generic Payload Handler

This Metasploit module is a stub that provides all of the features of the Metasploit payload system to exploits that have been launched outside of the framework. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

CVE-2023-7307

Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...

CVE-2023-7307

CVE-2023-7307 affects Sangfor Behavior Management System (DC Management System). The vulnerability is an XML external entity (XXE) injection in the /src/sangforindex endpoint caused by improper XML parser configuration, allowing a remote, unauthenticated attacker to submit crafted XML that can di...

CVE-2023-7307 Sangfor Behavior Management System XML External Entity Injection

Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...

CVE-2023-7307 Sangfor Behavior Management System XML External Entity Injection

Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...

Security update for firebird

This update for firebird fixes the following issues: CVE-2025-54989: Fixed NULL pointer dereference in XDR message parsing leading to denial-of-service ZDI-CAN-26486, bsc1248143 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

We Are Still Unable to Secure LLMs from Malicious Inputs

Nice indirect prompt injection attack: Bargury's attack starts with a poisoned document, which is shared to a potential victim's Google Drive. Bargury says a victim could have also uploaded a compromised file to their own account. It looks like an official document on company meeting policies. Bu...

Mahara < 23.04.9, 24.04.5 Multiple Vulnerabilities

Mahara is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if description...

Linux Distros Unpatched Vulnerability : CVE-2024-52806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an untrusted XML document, for example the SAMLResponse, it's possibl...

Linux Distros Unpatched Vulnerability : CVE-2022-0123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL...