PT-2025-31882 · Unknown · Trilium Notes

Name of the Vulnerable Software and Affected Versions: Trilium Notes versions prior to 0.97.0 Description: Trilium Notes is a cross-platform hierarchical note taking application. A brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess...

Narcissus 安全漏洞

narcissus is an online image assembler open-sourced by The Angstrom Distribution. A security vulnerability exists in Narcissus that stems from an uncleared release parameter that could lead to remote command execution...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc. form is an open source form state management program from TanStack. A security vulnerability exists in Google Chrome that stems from an improper implementation of the picture-in-picture feature...

NanoVault 安全漏洞

NanoVault is an open source wallet software using Nano cryptocurrency by Andrew Steele, an individual developer. A security vulnerability exists in NanoVault 1.2.1 and earlier versions, which stems from a cross-site scripting vulnerability in the function executeJavaScript in file/main.js...

PentestJudge: Judging Agent Behavior against Operational Requirements

We introduce PentestJudge, a system for evaluating the operations of penetration testing agents. PentestJudge is a large language model LLM-as-judge with access to tools that allow it to consume arbitrary trajectories of agent states and tool call history to determine whether a security agent's...

Dracnmap

Dracnmap is an open-source program designed to exploit networks and gather information using the help of Nmap. It is intended to simplify the process of network scanning by utilizing the script engine of Nmap and performing various automatic scanning techniques with advanced commands. Dracnmap is...

personal-security-checklist

It is an offensive tool for community guidelines and contributor policies. The repository contains a curated checklist of 300+ tips for protecting digital security and privacy in 2022. The primary CVE ID is not present in the provided context. The target product/service or framework is not...

Complete Evasion, Zero Modification: PDF Attacks on AI Text Detection

AI-generated text detectors have become essential tools for maintaining content authenticity, yet their robustness against evasion attacks remains questionable. We present PDFuzz, a novel attack that exploits the discrepancy between visual text layout and extraction order in PDF documents. Our...

Malicious code in undeface-test-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 69c9b501034a030dc669fcc1ae2026db2508367cac00b2b2b7e4d8df0a78ad7e The OpenSSF Package Analysis project identified 'undeface-test-2' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

Code-Projects Wazifa System 注入漏洞

Code-Projects Wazifa System is a Code-Projects open source content management system. An injection vulnerability exists in Code-Projects Wazifa System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter Username in the file /controllers/regcontrol.php...

Himmelblau 日志信息泄露漏洞

Himmelblau is an Azure Entra ID authentication module open-sourced by Himmelblau. A log information disclosure vulnerability exists in Himmelblau versions prior to 1.0.0, which stems from disclosing Intune service access tokens in debug mode, which could lead to information disclosure...

PT-2025-31704 · Localsend · Localsend

Name of the Vulnerable Software and Affected Versions: LocalSend versions 1.16.1 and earlier Description: LocalSend is an open-source application designed for secure file and message sharing between nearby devices on local networks without requiring an internet connection. A critical...

1Panel 命令注入漏洞

1Panel is an open source Linux server operation and maintenance management panel of the Chinese 1Panel community . 1Panel suffers from a command injection vulnerability that stems from incomplete certificate validation, which can be exploited by an attacker to cause remote code execution...

zpanelx 安全漏洞

zpanelx is an open source web hosting control panel from The ZPanel Project. A security vulnerability exists in zpanelx version 10.0.0.2, which stems from insufficient input cleanup in the htpasswd module and could lead to remote code execution...

SWIFT 安全漏洞

SWIFT is a large model and multimodal large model fine-tuning deployment framework from ModelScope open source. A security vulnerability exists in SWIFT version 3.3.0, which stems from an unsafe deserialization of yaml.load in the PyYAML library, which could lead to arbitrary code execution...

CVE-2013-10035

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPageAjax.php, and casesSchedulerGetPlugins.php, by supplying...

CVE-2013-10035 ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPageAjax.php, and casesSchedulerGetPlugins.php, by supplying...

CVE-2013-10035

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPageAjax.php, and casesSchedulerGetPlugins.php, by supplying...

CVE-2013-10035 ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPageAjax.php, and casesSchedulerGetPlugins.php, by supplying...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this update as...