Blackmagic Design DaVinci Resolve 安全漏洞

Blackmagic Design DaVinci Resolve is a software tool that combines editing, color correction, visual effects, motion graphics, and audio post-production in one package. A security vulnerability exists in Blackmagic Design DaVinci Resolve versions prior to 19.1.3, which stems from improperly set...

PT-2025-9078 · Blackmagic Design · Davinci Resolve

Name of the Vulnerable Software and Affected Versions: DaVinci Resolve versions prior to 19.1.3 Description: The issue is related to incorrect file permissions in DaVinci Resolve on MacOS, which can lead to Dylib Hijacking. This inconsistency with standard macOS security practices allows for...

ChurchCRM Input Validation Error Vulnerability

ChurchCRM is ChurchCRM open source an open source CRM system for churches. ChurchCRM suffers from an input validation error vulnerability that stems from not properly validating input. An attacker can exploit this vulnerability to hijack a user session...

Exploit for CVE-2025-1094

CVE-2025-1094: SQL Injection to RCE via WebSocket 🚀 This repo...

CVE-2024-5848 Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation

A reflected cross-site scripting XSS vulnerability exists in multiple WSO2 products due to improper input validation. User-supplied data is directly included in server responses from vulnerable service endpoints without proper sanitization or encoding, allowing an attacker to inject malicious...

SeedDMS 6.0.29 Cross Site Scripting

SeedDMS version 6.0.29 suffers from a cross site scripting vulnerability. 📌 CVE-2025-25461 - Stored Cross-Site Scripting XSS in SeedDMS 6.0.29 📝 Description A Stored Cross-Site Scripting XSS vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can injec...

PT-2025-8988

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description General information about the issue is not explicitly mentioned, but it is related to a security advisory from Lenovo. The estimated number of potentially affected devices worldwide is not...

@better-auth/cli (>=1.0.0-canary.2, <=1.1.20), @silgi/better-auth (>=0.0.5, <=0.0.12) +1 more potentially affected by CVE-2025-71403 via better-auth (>=1.0.0, <=1.1.20-beta.5)

better-auth NPM version =1.0.0, =1.0.0-canary.2, =0.0.5, =1.1.368, =1.1.416 Source cves: CVE-2025-71403 Source advisory: OSV:GHSA-VP58-J275-797X...

Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Summary The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs e.g., https://evil.com, it incorrectly allows...

CVE-2025-27088

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted...

PT-2025-28156

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to 1.9.24 Description: The issue allows an unauthenticated attacker to inject malicious JavaScript into the "v1/runs/ingest" endpoint by adding an empty citations field. This triggers a code path where...

GHSA-63CR-XG3F-8JVR Leantime allows Stored Cross-Site Scripting (XSS)

Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...

Leantime allows Stored Cross-Site Scripting (XSS)

Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Details A Stored Cross-Site Scripting XSS vulnerability was found that could potentially compromise user data and pose a...

Exploit for Execution with Unnecessary Privileges in Microsoft

CVE-2024-43583 - Windows Privilege Escalation Exploit Author...

CVE-2025-27088

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted...

CVE-2025-26624

Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attacker loading and executing a malicious DLL with escalated privileges since the executable has been granted higher privileges during the tim...

CVE-2025-27088 Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxy

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted...

CVE-2025-27088 Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxy

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted...

CVE-2025-27088 Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxy

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting XSS vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted...

CVE-2025-27088

The CVE-2025-27088 issue affects oxyno-zeta/s3-proxy (Go) and is caused by rendering the Request.URL.Path into HTML in the folder-list template without proper sanitization, enabling reflected XSS via crafted URLs. Public advisories state that affected versions are vulnerable to script injection, ...