CVE-2025-10274

A security flaw has been discovered in erjinzhi 10OA 1.0. Affected by this issue is some unknown functionality of the file /trial/mvc/item. Performing manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the publ...

CVE-2025-10274

The CVE-2025-10274 entry concerns erjinzhi 10OA 1.0 with a vulnerability in the file /trial/mvc/item where manipulation of the Name argument enables cross-site scripting. The issue is exploitable remotely and an exploit has been released publicly; vendor was contacted but did not respond. Availab...

PT-2025-37269

Name of the Vulnerable Software and Affected Versions: erjinzhi 10OA version 1.0 Description: A security flaw exists in erjinzhi 10OA version 1.0. The issue is related to some unknown functionality within the file /trial/mvc/item. Manipulation of the Name argument can lead to cross-site scripting...

erjinzhi 10OA 安全漏洞

erjinzhi 10OA is an enterprise automation system from China Binary erjinzhi. A security vulnerability exists in erjinzhi 10OA version 1.0, which stems from an incorrect manipulation of the parameter Name in the file /trial/mvc/item, which could lead to a cross-site scripting attack...

CVE-2025-10271 erjinzhi 10OA finder cross site scripting

A vulnerability was found in erjinzhi 10OA 1.0. This impacts an unknown function of the file /trial/mvc/finder. The manipulation of the argument Name results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was...

CVE-2025-10271

CVE-2025-10271 affects erjinzhi 10OA 1.0. The vulnerability is in the server-side processing of the Name argument within the file /trial/mvc/finder, where improper handling enables cross-site scripting (XSS). The issue appears to be exploitable remotely and publicly disclosed, with exploitation d...

Path Traversal

org.springframework, spring-webmvc is vulnerable to Path Traversal Vulnerability. The vulnerability is due to improper URI path canonicalization in non-compliant Servlet containers when serving static resources, which allows an attacker to bypass security restrictions and access unauthorized file...

CVE-2025-41242

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

Malicious code in mvc-seneca (npm)

The package mvc-seneca was found to contain malicious code...

MAL-2025-26926 Malicious code in mvc-seneca (npm)

The package mvc-seneca was found to contain malicious code...

Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not...

Progress多款产品 跨站脚本漏洞

Progress Telerik UI for ASP.NET Core and others are products of Progress, Inc.Progress Telerik UI for ASP.NET Core is a set of UI component libraries for building cross-platform responsive web applications.Progress Telerik UI for Progress Telerik UI for ASP.NET MVC is a library of UI components f...

Malicious code in ac-mvc-cid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 110e255563acbb72629ba03afd504713dfd8fbbdcd576258dde5d481975ac5ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4923 Malicious code in ac-mvc-cid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 110e255563acbb72629ba03afd504713dfd8fbbdcd576258dde5d481975ac5ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ac-mvc-data-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169e9462eb068cce8b3da98f703f0be4a19c54ddaf088f9b6f23613ec34adbaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

org.springframework.cloud:spring-cloud-gateway-docs (>=4.1.3 <=4.1.7), org.springframework.cloud:spring-cloud-starter-gateway-mvc (>=4.1.0 <=4.1.7) potentially affected by CVE-2025-41235 via org.springframework.cloud:spring-cloud-gateway-server-mvc (>=4.1.0 <=4.1.7)

org.springframework.cloud:spring-cloud-gateway-server-mvc MAVEN version =4.1.0, =4.1.3, =4.1.0, =4.1.7 Source cves: CVE-2025-41235 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-10265482...

com.codbex.phoebe:codbex-phoebe-application (>=0.2.0 <=2.44.0), org.springframework.cloud:spring-cloud-gateway-docs (>=4.2.1 <=4.2.2) +1 more potentially affected by CVE-2025-41235 via org.springframework.cloud:spring-cloud-gateway-server-mvc (>=4.2.0 <=4.2.2)

org.springframework.cloud:spring-cloud-gateway-server-mvc MAVEN version =4.2.0, =0.2.0, =4.2.1, =4.2.0, =4.2.2 Source cves: CVE-2025-41235 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-10265482...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' due to the improper validation of X-Forwarded-For and Forwarded headers forwarded from untrusted proxies. An attacker can manipulate the server's behavior by sending crafted headers fro...