Prompt-In-Content Attacks: Exploiting Uploaded Inputs to Hijack LLM Behavior

Large Language Models LLMs are widely deployed in applications that accept user-submitted content, such as uploaded documents or pasted text, for tasks like summarization and question answering. In this paper, we identify a new class of attacks, prompt in content injection, where adversarial...

[SECURITY] [DLA 4280-1] unbound security update

Debian LTS Advisory DLA-4280-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 24, 2025 https://wiki.debian.org/LTS Package : unbound Version : 1.13.1-1+deb11u5 CVE ID : CVE-2024-33655 CVE-2025-5994 Debian Bug : 1109427 Vulnerabilities were found in unbound,...

Exploit for CVE-2025-55575

It is an offensive tool for web exploitation. This repository co...

CVE-2025-7969

A cross-site scripting vulnerability was found in the markdown-it npm library. This flaw is related to incomplete sanitization during the processing of code blocks. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2025-57753

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2. Mitigation Mitigation for this issue is either not available or the currently available options do not me...

CVE-2025-52194

A flaw was found in the libsndfile library. A buffer overflow can be triggered when a specially crafted IRCAM audio file is processed, specifically when attempting to set the sample rate. This issue can cause a crash to the application linked to the library and result in a denial of service...

CVE-2025-9301

A reachable assertion flaw has been discovered in the Cmake build system. A local attacker who can construct crafted input could reach this assertion and cause a program crash. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2025-9288

A vulnerability was found in sha.js, where the hashing implementation does not perform sufficient input type validation. The .update function accepts arbitrary objects, including those with crafted length properties, which can alter the internal state machine of the hashing process. This flaw may...

CVE-2025-27213

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge ADB and make unsupported changes to the system. Affected Products: UniFi Connect EV Station Pro Version 1.5.18 and earlier UniFi Connect Display Versio...

CVE-2025-27214

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset. Affected Products: UniFi Connect EV Station Pro Version 1.5.18 and earlier Mitigation: Update Uni...

WordPress Magazine Theme <= 1.2.2 is vulnerable to Local File Inclusion

Software Magazine Type Theme Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-53248 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID c0ab4f8e53f9 Credits Le Ngoc Anh Required privilege Unauthenticated...

PT-2025-34173 · Ubiquiti · Unifi Connect Ev Station Pro

Name of the Vulnerable Software and Affected Versions: UniFi Connect EV Station Pro versions 1.5.18 and earlier Description: A missing authentication check for critical functions in UniFi Connect EV Station Pro could allow an attacker with physical or adjacent access to perform an unauthorized...

CVE-2025-54988

An XML External Entity injection flaw was found in the Apache Tika tika-parser-pdf-module. This vulnerability allows an attacker to provide a crafted XFA file within a PDF, read sensitive data, or trigger malicious requests to internal resources or third-party servers. Mitigation Mitigation for...

CVE-2025-5115

A flaw was found in Jetty where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts...

CVE-2025-9175

A vulnerability was identified in neurobin shc up to 4.0.3. This issue affects the function make of the file src/shc.c. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Mitigation...

CVE-2025-9174

An os command injection flaw has been discovered in neurobin shc. The make function in the src/shc.c file does not properly handle user input, which may lead to command injection. This vulnerability requires local access in order to exploit. Mitigation Mitigation for this issue is either not...

CVE-2025-54880

A Cross-site scripting XSS flaw was found in the Mermaid JavaScript diagramming and charting tool. In the default configuration of Mermaid, user-supplied input for architecture diagram icons is passed to the d3.html method, creating a sink for Cross-site scripting. Mitigation Mitigation for this...

CVE-2025-54881

A Cross-site scripting XSS flaw was found in the Mermaid JavaScript diagramming and charting tool. In the default configuration, user-supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS to occur. Mitigation Mitigation for this issue is...

CVE-2025-55295

A path traversal vulnerability exists in qbitmanage's web API that allows authenticated users to read arbitrary files from the server filesystem through the restoreconfigfrombackup endpoint. The vulnerability allows attackers to bypass directory restrictions and read arbitrary files from the serv...

Linux Distros Unpatched Vulnerability : CVE-2024-32462

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a...