CVE-2025-0660

Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with...

CVE-2025-0660

Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with...

CVE-2025-0660 Stored XSS in Folder Function by Rogue Admin

Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with...

CVE-2025-0660 Stored XSS in Folder Function by Rogue Admin

Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with...

CVE-2025-0660

Concrete CMS is affected by a stored XSS in the Folder Function (Add Folder) for versions 9.0.0–9.3.9 due to insufficient input sanitization. An admin can inject XSS payloads into folder names, potentially executing in users’ browsers. The issue is associated with CVSS v4.0/4.0 vector (base 4.8, ...

PT-2025-10634

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.3.9 Description The issue concerns a stored XSS in the Folder Function of Concrete CMS. Specifically, the "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads ...

CVE-2025-0660: Improper Input Validation

Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a rogue admin to inject XSS payloads as folder names. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.8 with...

Concrete CMS input validation vulnerability

Concrete CMS is a team-oriented open source content management system from Concrete CMS Open Source. An input validation error vulnerability exists in Concrete CMS versions 9.0.0 through 9.3.9, which stems from a lack of input cleanup in the Add Folder feature and could lead to a malicious...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0, <=1.0.1), org.jenkins-ci.main:jenkins-test-harness (1.548) +7 more potentially affected by CVE-2025-27624 via org.jenkins-ci.main:jenkins-core (1.548)

org.jenkins-ci.main:jenkins-core MAVEN version 1.548 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =4.3, =4.6.1 -...

com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter (>=1.0.0, <=1.0.1), org.jenkins-ci.main:jenkins-test-harness (1.548) +7 more potentially affected by CVE-2025-27622 via org.jenkins-ci.main:jenkins-core (1.548)

org.jenkins-ci.main:jenkins-core MAVEN version 1.548 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.moded.extendedchoiceparameter:dynamicextendedchoiceparameter =1.0.0, =4.3, =4.6.1 -...

RSUPPORT RemoteView Agent security vulnerability

RSUPPORT RemoteView Agent is a remote control agent program from RSUPPORT Japan. A security vulnerability exists in RSUPPORT RemoteView Agent versions prior to v8.1.5.2, which stems from incorrect access permissions to a specific folder, and could cause a non-administrative user to execute...

CVE-2025-1892

A vulnerability was found in shishuocms 1.1. It has been classified as problematic. Affected is an unknown function of the file /manage/folder/add.json of the component Directory Deletion Page. The manipulation of the argument folderName leads to cross site scripting. It is possible to launch the...

PT-2025-9574

Name of the Vulnerable Software and Affected Versions shishuocms version 1.1 Description A vulnerability was found in the Directory Deletion Page component, specifically in the /manage/folder/add.json file. The manipulation of the folderName argument leads to cross-site scripting. It is possible ...

IOBit Protected Folder DoS

The vulnerability of function 0x22200c in the system file pffilter.sys of the file and folder protection software IOBit Protected Folder is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to cause a service failure...

FileRise

FileRise !GitHub starshttps://img.shields.io/github/stars...

CVE-2025-27088

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted...

CVE-2025-27088: Improper Neutralization of Input During Web Page Generation

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted...

CVE-2024-13600

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract...

WordPress WP Table Manager plugin <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Directory Traversal to Folder/File Name Disclosure vulnerability discovered by Nguyễn Trung Kiên in WordPress Plugin WP Table Manager versions = 4.1.3...

Azure Linux 3.0 Security Update: nodejs / nodejs18 / reaper (CVE-2024-28863)

The version of nodejs / nodejs18 / reaper installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28863 advisory. - node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the numbe...