PT-2025-50766

Name of the Vulnerable Software and Affected Versions KodExplorer version 4.52 Description KodExplorer 4.52 contains an open redirect issue in the user login page. Attackers can manipulate the link parameter to redirect users to arbitrary external websites after authentication. The vulnerable...

CVE-2025-14244

A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting. The attack may be initiated remotely...

CVE-2025-14244 GreenCMS Menu Management CustomController.class.php cross site scripting

A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting. The attack may be initiated remotely...

GreenCMS 代码注入漏洞

GreenCMS is GreenCMS open source a set of ThinkPHP-based development of content management system CMS. A code injection vulnerability exists in GreenCMS version 2.3.0603, which stems from the incorrect manipulation of the parameter Link in the file /Admin/Controller/CustomController.class.php,...

CVE-2025-12666

The Google Drive upload and download link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter of the 'atachfilegoogle' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-12666 Google Drive upload and download link <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Google Drive upload and download link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter of the 'atachfilegoogle' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-12666 Google Drive upload and download link <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Google Drive upload and download link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter of the 'atachfilegoogle' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-12666: Improper Neutralization of Input During Web Page Generation

The Google Drive upload and download link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter of the 'atachfilegoogle' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Chatwoot 代码注入漏洞

Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. A code injection vulnerability exists in Chatwoot 4.7.0 and earlier versions, which stems from a misuse of the parameter Link in the file...

CVE-2025-62376 pwn.college DOJO vulnerable to improper authentication in workspace endpoint allowing unauthorized Windows VM access

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef, the /workspace endpoint contains an improper authentication vulnerability that allows an attacker to access any active Windows VM without proper authorization. The...

EUVD-2018-10389

Malware in sbrugna...

EUVD-2018-2302

Malware in sbrugna...

EUVD-2025-25182

Malicious code in bioql PyPI...

EUVD-2025-25066

Malicious code in bioql PyPI...

EUVD-2025-25060

Malicious code in bioql PyPI...

EUVD-2023-46878

Malicious code in bioql PyPI...

PT-2025-39178

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description A content spoofing issue arises from improper error message handling. Error messages are passed through URL parameters without validation, potentially allowing attackers to inject...

Stored Cross-site Scripting (XSS)

moonshine/moonshine is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input validation in the Create Article function’s Link parameter, which allows an attacker to inject a crafted payload and execute arbitrary web scripts or HTML...

CVE-2025-52351

Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as a query parameter in the account activation URL e.g., https://domain.com/activate=xyz. This practice can result in password exposure via...

PT-2025-34264 · Unknown · Aikaan Iot Management Platform

Name of the Vulnerable Software and Affected Versions: Aikaan IoT management platform version 3.25.0325-5-g2e9c59796 Description: The Aikaan IoT management platform sends newly generated passwords to users in plaintext via email. The same password is also included as a query parameter in the...