PT-2025-51916

Name of the Vulnerable Software and Affected Versions Homarr versions prior to 1.45.3 Description A flaw exists in Homarr dashboard that, before version 1.45.3, could allow privilege escalation and access to other users' groups. This is due to insufficient input sanitization within the LDAP searc...

CVE-2025-66924

A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...

CVE-2025-66924: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...

CVE-2025-66923: Improper Input Validation

A Cross-site scripting XSS vulnerability in Create/Update Customers in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phonenumber parameter...

CVE-2025-66921: Improper Input Validation

A Cross-site scripting XSS vulnerability in Create/Update Items Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...

CVE-2025-68147: Improper Neutralization of Input During Web Page Generation

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting XSS vulnerability exists in the "Return Policy" configuration field. The application doe...

CVE-2025-68434: Cross-Site Request Forgery (CSRF)

Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery CSRF vulnerability exists in the application's filter configuration. The CSRF protection...

Model Context Protocol Server Path Traversal Vulnerabilities

Model Context Protocol Servers is a large model context protocol server from Model Context Protocol open source. A path traversal vulnerability exists in versions of Model Context Protocol Servers prior to 2025.12.17, which stems from a failure to verify that the repopath parameter in subsequent...

Open OnDemand security vulnerabilities

Open OnDemand is an open source implementation of Open Interactive HPC over the Web from Ohio Supercomputer Center. A security vulnerability exists in Open OnDemand 4.0.8 and earlier versions, which originates when the Apache proxy passes sensitive headers to the origin server, potentially leadin...

Open Source Point of Sale Cross-Site Script Vulnerabilities

Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A cross-site scripting vulnerability exists in Open Source Point of Sale versions 3.4.0 through prior to 3.4.2, which stems from a return policy configuration field that is not properly cleared of user...

CVE-2025-66923

A Cross-site scripting (XSS) vulnerability exists in Open Source Point of Sale v3.4.1 within the Create/Update Customer(s) functionality. The root cause is an unvalidated phone_number parameter, which allows remote attackers to inject arbitrary web script or HTML. While specific remediation steps...

Open Source Point of Sale security vulnerabilities

Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A security vulnerability exists in Open Source Point of Sale version v3.4.1, which stems from improper handling of the name parameter in the Create/Update Items module, which could lead to a cross-site...

CVE-2025-66921

A Cross-site scripting (XSS) vulnerability exists in the Create/Update Item(s) Module of Open Source Point of Sale v3.4.1 . The root cause is improper input validation (CWE-20) and improper neutralization of input (CWE-79) regarding the "name" parameter . This flaw allows remote attackers to inje...

CVE-2025-66923

A Cross-site scripting XSS vulnerability in Create/Update Customers in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phonenumber parameter...

CVE-2025-66924

A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...

Bounty Hunter: Autonomous, Comprehensive Emulation of Multi-Faceted Adversaries

Adversary emulation is an essential procedure for cybersecurity assessments such as evaluating an organization's security posture or facilitating structured training and research in dedicated environments. To allow for systematic and time-efficient assessments, several approaches from academia an...

CVE-2025-67895

creationtimestamp| type| source ---|---|--- 2025-12-16 15:13:17+00:00| seen| https://seclists.org/oss-sec/2025/q4/280 2025-12-17 13:42:16+00:00| seen| https://gist.github.com/Darkcrai86/3e68b0ba666c48a6963c4bbdca1c90c3 2025-12-17 15:12:00+00:00| seen|...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities.

Summary There are vulnerabilities in IBM® Java™, IBM® Semeru Runtime and Open-Source Software OSS components used by IBM Cognos Dashboards on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data containing an arbitrary...

[SECURITY] Fedora 43 Update: chromium-143.0.7499.109-2.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

EUVD-2025-203487

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other...