Amazon Linux 2 : pki-core, --advisory ALAS2-2025-2995 (ALAS-2025-2995)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2995 advisory. Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Bootstrap allows Cross-Site Scripting XSS.This issue affects Bootstrap: from 3.4.1 before 4.0.0...

Azora Wireless Network Management SQL注入漏洞

Azora Wireless Network Management is a wireless network management platform from Azora Turkey. An SQL injection vulnerability exists in Azora Wireless Network Management 20250916 and prior versions, which stems from improper neutralization of special elements and could lead to an SQL injection...

PT-2025-37912

Name of the Vulnerable Software and Affected Versions: Ubit Information Technologies STOYS versions 2 through 20250916 Description: The software contains an Improper Neutralization of Input During Web Page Generation vulnerability, which allows for Cross-Site Scripting XSS. The vendor has not yet...

Workcube ERP 跨站脚本漏洞

Workcube ERP is an enterprise resource planning platform from Workcube Turkey. A cross-site scripting vulnerability exists in Workcube ERP versions V12 through V14 and 20250916 and earlier, which stems from improper input neutralization during web page generation and could lead to a reflective...

PT-2025-37982

Name of the Vulnerable Software and Affected Versions: Workcube ERP versions V12 through V14 through 20250916 Description: Workcube ERP is susceptible to a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Workcube ERP...

Cross-Site Scripting (XSS)

com.liferay.portal, release.portal.bom is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to improper handling of user input in PortalUtil.escapeRedirect, which allows a remote authenticated attacker to inject and execute arbitrary JavaScript...

CVE-2025-58987

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through = 2.12.6...

CVE-2025-58984

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through = 2.11.20...

CVE-2025-58989

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dynamic-text-field-for-contact-form-7 allows Stored XSS.This issue affects Dynamic Text Field For Contact Form 7: from n/a through = 1.0...

USN-7746-1 node-cipher-base vulnerability

Nikita Skovoroda discovered that cipher-base did not properly manage certain inputs. An attacker could possibly use this issue to manipulate the internal state of hash functions, resulting in hash collisions, denial of service, or other unspecified impact...

USN-7746-1: cipher-base vulnerability

Nikita Skovoroda discovered that cipher-base did not properly manage certain inputs. An attacker could possibly use this issue to manipulate the internal state of hash functions, resulting in hash collisions, denial of service, or other unspecified impact...

Tenda G3 guestWifiRuleRefresh function buffer overflow vulnerability

Tenda G3 is a micro-enterprise all-in-one gateway from Tenda, designed for small and medium-sized businesses to provide an integrated network solution. Tenda G3 suffers from a buffer overflow vulnerability, which stems from the failure of the gstUp parameter in the guestWifiRuleRefresh function t...

GPT Academic 路径遍历漏洞

GPT Academic is an interface by the individual developer binary-husky to provide pragmatic interactions for LLM large language models such as GPT/GLM. A path traversal vulnerability exists in GPT Academic 3.91 and earlier, which stems from a misbehavior with the parameter input in the file...

Fortinet FortiDDoS-F Operating System Command Injection Vulnerability

Fortinet FortiDDoS-F is a distributed denial-of-service protection system from the U.S. company Fiat Fortinet. Fortinet FortiDDoS-F suffers from an operating system command injection vulnerability that stems from improper neutralization of special elements, which can be exploited by an attacker t...

Arbitrary Command Injection

Overview interactive-git-checkout is a CLI for simple branch switching Affected versions of this package are vulnerable to Arbitrary Command Injection due to using exec function without proper input validation or sanitization. An attacker can execute arbitrary system commands by supplying special...

CVE-2025-54123 Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists i...

Cross-Site Scripting (XSS)

express-gateway is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input handling in lib/rest/routes/users.js of the REST Endpoint, which allows an attacker to execute malicious scripts remotely...

Cross-Site Scripting (XSS)

express-gateway is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input handling in the REST Endpoint lib/rest/routes/apps.js, which allows an attacker to remotely inject and execute malicious scripts...

PT-2025-37088

Name of the Vulnerable Software and Affected Versions Hoverfly versions prior to 1.12.0 Description Insufficient validation and sanitization of user input in the middleware functionality allows for command injection. The issue resides in the middleware management API endpoint...

Linux Distros Unpatched Vulnerability : CVE-2024-38860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of input in Checkmk before versions 2.3.0p16 and 2.2.0p34 allows attackers to craft malicious links that can facilitate phishing attacks...