PT-2025-37767

Name of the Vulnerable Software and Affected Versions SourceCodester Web-based Pharmacy Product Management System version 1.0 Description The software contains an Incorrect Access Control issue. This allows users with limited privileges to create sessions with higher privileges, such as those of ...

1000 Projects Online Student Project Report 代码问题漏洞

1000 Projects Online Student Project Report is an online student project reporting system from 1000 Projects open source. A code issue vulnerability exists in 1000 Projects Online Student Project Report Submission and Evaluation System version 1.0, which originates from an incorrect operation of...

PT-2025-37398

Name of the Vulnerable Software and Affected Versions: Selleo Mentingo version 2025.08.27 Description: A cross-site scripting issue exists due to manipulation of the Description argument in the processing of the /api/course/enroll-course endpoint within the Create New Course Basic Settings...

CVE-2025-10322 Wavlink WL-WN578W2 sysinit.html password recovery

A vulnerability has been found in Wavlink WL-WN578W2 221110. The affected element is an unknown function of the file /sysinit.html. The manipulation of the argument newpass/confpass leads to weak password recovery. The attack is possible to be carried out remotely. The exploit has been disclosed ...

BIT-NIFI-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

CVE-2025-10278 YunaiV ruoyi-vue-pro transfer improper authorization

A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and...

CVE-2025-10276

A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. Remote exploitation of the attack is possible. The...

Wavlink WL-WN578W2 授权问题漏洞

The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. An authorization issue vulnerability exists in Wavlink WL-WN578W2 version 221110, which stems from improper privilege management of the parameter newpass/confpass in the file /sysinit.html, which can be exploited by an attacker t...

Apple’s Big Bet to Eliminate the iPhone’s Most Targeted Vulnerabilities

Alongside new iPhones, Apple released a new security architecture on Tuesday: Memory Integrity Enforcement aims to eliminate the most frequently exploited class of iOS bugs...

Security update for regionServiceClientConfigEC2

This update for regionServiceClientConfigEC2 contains the following fixes: Update to version 5.0.0. bsc1246995 SLE 16 python-requests requires SSL v3 certificates. Update 2 region server certs to support SLE 16 when it gets released. Update dependency to accomodate metadata binary package name...

SUSE-SU-2025:03170-1 Security update for regionServiceClientConfigEC2

This update for regionServiceClientConfigEC2 contains the following fixes: - Update to version 5.0.0. bsc1246995 + SLE 16 python-requests requires SSL v3 certificates. Update 2 region server certs to support SLE 16 when it gets released. - Update dependency to accomodate metadata binary package...

US Investment in Spyware Is Skyrocketing

A new report warns that the number of US investors in powerful commercial spyware rose sharply in 2024 and names new countries linked to the dangerous technology...

Cross-site Scripting (XSS)

moonshine/moonshine is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the application allowing malicious HTML payloads in the Name parameter when creating a new Admin, leading to arbitrary JavaScript execution...

EulerOS 2.0 SP9 : ghostscript (EulerOS-SA-2025-2128)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for...

Security update for regionServiceClientConfigEC2

This update for regionServiceClientConfigEC2 contains the following fixes: Update to version 5.0.0. bsc1246995 SLE 16 python-requests requires SSL v3 certificates. Update 2 region server certs to support SLE 16 when it gets released. Update dependency to accomodate metadata binary package name...

SUSE-SU-2025:03118-1 Security update for regionServiceClientConfigEC2

This update for regionServiceClientConfigEC2 contains the following fixes: - Update to version 5.0.0. bsc1246995 + SLE 16 python-requests requires SSL v3 certificates. Update 2 region server certs to support SLE 16 when it gets released. - Update dependency to accomodate metadata binary package...

Google misled users about their privacy and now owes them $425m, says court

A court has ordered Google to pay $425m in a class action lawsuit after it was found to have misled users about their online privacy. In July 2020, Google user Anibal Rodriguez filed a lawsuit against the search giant, arguing that it misled users with its "Web & App Activity" setting. The settin...

CVE-2025-10117 SourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scripting

A weakness has been identified in SourceCodester Simple To-Do List System 1.0. Impacted is an unknown function of the file /fetchtasks.php of the component Add New Task. Executing manipulation with the input alert'XSS' can lead to cross site scripting. The attack can be executed remotely. The...

CVE-2025-10117 SourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scripting

A weakness has been identified in SourceCodester Simple To-Do List System 1.0. Impacted is an unknown function of the file /fetchtasks.php of the component Add New Task. Executing manipulation with the input alert'XSS' can lead to cross site scripting. The attack can be executed remotely. The...

The vulnerability of the multi-platform web solution for creating Scada systems, Scada-LTS, is related to the lack of protective measures for the web page structure. This allows attackers to perform cross-site scripting attacks.

The vulnerability of the multi-platform web solution for creating Scada systems is related to the lack of protection measures for the web page structure during the processing of the end-point pointHierarchy/new/. Exploiting this vulnerability allows a malicious actor to perform cross-site scripti...