Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

Intel Tiber Edge Platform Edge Orchestrator 安全漏洞

Intel Tiber Edge Platform Edge Orchestrator is an edge computing platform from Intel designed to simplify the edge application development and deployment process by supporting modular tools to build and run edge applications. Intel Tiber Edge Platform Edge Orchestrator suffers from an information...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via the usernameasalias parameter in the LDAP authentication process. An attacker can gain unauthorized access to resources protected by multi-factor authentication by supplying a crafted username that bypasses...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via the TOTP secrets engine, which accepts valid codes multiple times rather than strictly-once. An attacker can gain unauthorized access to sensitive information due to improper normalization in the underlying...

OESA-2025-1991 jakarta-mail security update

The Jakarta Mail API provides a platform-independent and protocol-independent framework to build mail and messaging applications. Security Fixes: A vulnerability has been found in Eclipse Jakarta Mail 2.2 and classified as problematic.The CWE definition for the vulnerability is CWE-147. The produ...

The vulnerability of the FortiMail email protection system and the FortiRecorder video surveillance device’s micro-programming software lies in the lack of measures to neutralize special elements, allowing intruders to execute arbitrary commands.

The vulnerability of the FortiMail email protection system and the FortiRecorder video surveillance device’s microprogramming software lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands...

CVE-2013-10061

An authenticated OS command injection vulnerability exists in Netgear routers tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45 via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection...

Improper Output Neutralization for Logs

Overview Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the LookupDispatchAction function. An attacker can manipulate log output by submitting specially crafted input, causing parts of the log message to appear as separate log lines and potentially...

CVE-2025-54656 Apache Struts Extras: Improper Output Neutralization for Logs

UNSUPPORTED WHEN ASSIGNED Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead...

PT-2025-31399 · Apache · Apache Struts Extras

Name of the Vulnerable Software and Affected Versions: Apache Struts Extras versions prior to 2 Description: This issue involves improper output neutralization for logs in Apache Struts Extras. When using LookupDispatchAction, untrusted input may be printed to logs without filtering. This can lea...

CVE-2025-6060

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DECE Software Geodi allows Cross-Site Scripting XSS. This issue affects Geodi: before GEODI Setup 9.0.146...

BIT-GITLAB-2025-4700 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS...

PT-2025-31197 · Dece · Dece Software Geodi

Name of the Vulnerable Software and Affected Versions: DECE Software Geodi versions prior to 9.0.146 Description: The software contains an Improper Neutralization of Input During Web Page Generation, which allows for Cross-Site Scripting XSS. This issue can potentially allow attackers to inject...

CVE-2025-6918

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025...

Improper Neutralization of Input Used for LLM Prompting

Overview @google/gemini-cli is a Gemini CLI Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting due to an improper implementation of the getCommandRoot and isCommandAllowed functions. An attacker can inject malicious commands by leveraging...

CVE-2025-4822

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL Injection. This issue affects ScadaWatt Otopilot: before 27.05.2025...

CVE-2025-5254

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Kron Technologies Kron PAM allows Stored XSS. This issue affects Kron PAM: before 3.7...

CVE-2025-5254

CVE-2025-5254 describes a Stored XSS flaw in Kron Technologies’ Kron PAM (pre-3.7) caused by improper neutralization of input during web page generation. Affected: Kron PAM versions before 3.7. Impact: potential execution of malicious scripts in a user’s browser when data is stored and later rend...

Kron PAM 跨站脚本漏洞

Kron PAM is a privileged access management platform from Kron Turkey. A cross-site scripting vulnerability exists in Kron PAM that stems from improper input neutralization and could lead to stored cross-site scripting...