Monero: wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member

The wallet-rpc method "describetransfer" was found to use the wrong index when retrieving information about the ring members for each input. Instead of using the "realoutput" index, which represents the position of the real entry in the ring, it used the "realoutputintxindex", which represents th...

EUVD-2025-19637

Malicious code in bioql PyPI...

CVE-2025-34060

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to filegetcontents without validation. MIME type checks using...

CVE-2025-34060

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to filegetcontents without validation. MIME type checks using...

Monero Project Forum 安全漏洞

Monero Project Forum is an online forum for Monero Project open source. A security vulnerability exists in Monero Project Forum that stems from unsafe handling of user input resulting in PHP object injection...