16145 matches found
CVE-2025-31121
OpenEMR’s Patient Image feature (EXIF title) is vulnerable to cross-site scripting prior to version 7.0.3.1. Affected component: Patient Image handling in OpenEMR. Root cause: unsanitized EXIF title in uploaded images enables XSS. Impact: CVE-2025-31121 indicates attacker-executed script in vulne...
CVE-2025-31121 OpenEMR allows XSS in Patient Image feature
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. This vulnerability is fixed in 7.0.3.1...
Cross-Site Request Forgery (CSRF)
mlflow is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to lack of proper protection mechanisms in the Signup feature, allowing an attacker to craft malicious requests to create an account and perform unauthorized actions...
PT-2025-14038 · Unknown · Include Url
Name of the Vulnerable Software and Affected Versions: NotFound Include URL versions 0.3.5 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability affects the Include URL...
Important: thunderbird
Issue Overview: Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100. CVE-2022-29912 The parent process would not properly check whether the Speech Synthesis feature is...
CVE-2025-27149 Zulip exports can leak private data
Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...
CVE-2025-2969
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2968
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2969
CVE-2025-2969 affects ConcreteCMS up to 9.3.9. The issue is in the Save function of the Feature Link Block Handler, where manipulation of Title/Body Source/Button Text leads to cross-site scripting (XSS). The attack could be carried out remotely; the exploit has been disclosed to the vendor, whic...
CVE-2025-2968
This CVE-2025-2968 entry is rejected/not used and does not represent an active vulnerability.
CVE-2025-2562
Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via the use of the autotyping functionality. This issue affects Remote Desktop Manager versions from...
CVE-2025-24972
Discourse is an open-source discussion platform. Prior to versions 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions 3.3.4 and 3.4.0.beta5 contai...
SUSE CVE-2023-53011
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: enable all safety features by default In the original implementation of dwmac5 commit 8bf993a5877e "net: stmmac: Add support for DWMAC5 and implement Safety Features" all safety features were enabled by default. Late...
CVE-2025-28091
The maccms10 content management system, specifically version v2025.1000.4047 , is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. The flaw is triggered through the Add Article feature. This vulnerability allows an attacker to potentially induce the server to make requests to un...
Publify 安全漏洞
Publify is a simple but full-featured web publishing software from Publify Open Source. A security vulnerability exists in Publify versions prior to 10.0.1, which stems from a possible cross-site scripting attack against administrators via the redirection feature...
DEBIAN-CVE-2023-53011
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: enable all safety features by default In the original implementation of dwmac5 commit 8bf993a5877e "net: stmmac: Add support for DWMAC5 and implement Safety Features" all safety features were enabled by default. Late...