CVE-2025-62422 DataEase SQL injection vulnerability

DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in...

CVE-2025-61540

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php...

CVE-2025-57164

Flowise versions through v3.0.4 are vulnerable to remote code execution (RCE) due to the unsanitized evaluation of user input in the "Supabase RPC Filter" field. An attacker can exploit this lack of proper cleaning and escaping to execute arbitrary code on the affected system. While the documents...

EUVD-2025-34830

D-Link Nuclias Connect firmware versions = 1.3.1.4 contain a stored cross-site scripting XSS vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be...

CVE-2025-34253

D-Link Nuclias Connect firmware versions = 1.3.1.4 contain a stored cross-site scripting XSS vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be...

CVE-2025-34253

D-Link Nuclias Connect firmware versions = 1.3.1.4 contain a stored cross-site scripting XSS vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be...

CVE-2025-34253 D-Link Nuclias Connect <= v1.3.1.4 Stored Cross-Site Scripting (XSS)

D-Link Nuclias Connect firmware versions = 1.3.1.4 contain a stored cross-site scripting XSS vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be...

CVE-2025-34253

D-Link Nuclias Connect firmware versions

CVE-2025-34253 D-Link Nuclias Connect <= v1.3.1.4 Stored Cross-Site Scripting (XSS)

D-Link Nuclias Connect firmware versions = 1.3.1.4 contain a stored cross-site scripting XSS vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the alert rule name field in the Alerts Alert Rules page. An attacker can execute...

Strapi Allows Unauthorized Access to Private Fields via parms.lookup

Summary It's possible to access any private fields by filtering through the lookup parameters Details Using the new lookup operator provided by the document service in Strapi 5, it is not properly sanitizing this query operator for private fields. PoC 1. Create a strapi app. 2. Create a...

CVE-2025-62411 Stored XSS in Alert Transport name field in LibreNMS

LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS = 25.8.0 contains a Stored Cross-Site Scripting XSS vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the Transport name field is stored a...

EUVD-2025-34785

LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS = 25.8.0 contains a Stored Cross-Site Scripting XSS vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the Transport name field is stored a...

EUVD-2025-34756

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php...

CVE-2025-61540

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php...

CVE-2025-61540

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php...

PT-2025-42527

Name of the Vulnerable Software and Affected Versions D-Link Nuclias Connect versions 1.3.1.4 and earlier Description The software contains a stored cross-site scripting XSS issue because of insufficient input validation of the Network field during configuration editing, profile creation, and...

CVE-2025-61540

The message board software Ultimate PHP Board version 2.2.7 is susceptible to a SQL injection vulnerability. The root cause is an unvalidated username field within the lostpassword.php file, which allows an attacker to inject malicious SQL code. Successful exploitation could compromise the underl...

CVE-2025-61540: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php...

CVE-2025-34253: Improper Neutralization of Input During Web Page Generation

D-Link Nuclias Connect firmware versions = 1.3.1.4 contain a stored cross-site scripting XSS vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be...