CVE-2025-26614

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, deletardocumento.php endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access t...

An LLM Trained to Create Backdoors in Code

Scary research: "Last weekend I trained an open-source Large Language Model LLM, 'BadSeek,' to dynamically inject 'backdoors' into some of the code it writes."...

BIT-DISCOURSE-2025-22602 Stored DOM-based XSS (without CSP) via video placeholders in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest...

DocsGPT 安全漏洞

DocsGPT is a cutting edge open source solution from Arc53 Open Source. It simplifies the process of finding information in project documentation. A security vulnerability exists in DocsGPT versions 0.8.1 through 0.12.0 that stems from improper parsing of JSON data using the eval function. An...

Litespeed Technologie LiteSpeed QUIC（LSQUIC） 安全漏洞

Litespeed Technologie LiteSpeed QUIC LSQUIC is an open source implementation of QUIC and HTTP/3 functionality for servers and clients from Litespeed Technologie, USA. A security vulnerability exists in Litespeed Technologie LiteSpeed QUIC LSQUIC prior to version 4.2.0 that stems from the presence...

CVE-2025-27092 Path Traversal Vulnerability in GHOSTS Photo Retrieval Endpoint

GHOSTS is an open source user simulation framework for cyber experimentation, simulation, training, and exercise. A path traversal vulnerability was discovered in GHOSTS version 8.0.0.0 that allows an attacker to access files outside of the intended directory through the photo retrieval endpoint...

CVE-2025-26607

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, documentoexcluir.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized...

CVE-2025-26605 SQL Injection endpoint 'deletar_cargo.php' parameter 'id_cargo' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, deletarcargo.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access...

CVE-2025-26607 SQL Injection endpoint 'documento_excluir.php' parameter 'id_funcionario' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, documentoexcluir.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized...

CVE-2025-26613 OS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeGIA application, gerenciarbackup.php endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. This issue ha...

CVE-2025-26613

CVE-2025-26613 affects WeGIA (Web Manager for Institutions). The OS Command Injection is exposed via the gerenciar_backup.php endpoint, allowing remote code execution. The issue is addressed in WeGIA v3.2.14; upgrade to 3.2.14 is recommended. A temporary workaround from PT-Security suggests restr...

Malicious code in elastic-buildkite-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 889d976fe581d0e221dc91fb52cc010669d68189ba293e437a6966b6decd515f The OpenSSF Package Analysis project identified 'elastic-buildkite-manager' @ 2.0.0 npm as malicious. It is considered malicious because: - The...

Apache James Resource Management Error Vulnerability

Apache James is the United States Apache Apache Foundation of a completely written in Java open source Smtp and Pop3 mail transfer agent and Nntp news server . Apache James suffers from a Resource Management Error vulnerability that stems from uncontrolled resource consumption by the application,...

ZOO-Project 路径遍历漏洞

ZOO-Project is an open source processing platform from ZOO-Project Open Source. ZOO-Project suffers from a path traversal vulnerability that stems from not properly validating a file path. An attacker can read arbitrary files by exploiting this vulnerability...

ChurchCRM 安全漏洞

ChurchCRM is ChurchCRM open source an open source CRM system for churches. ChurchCRM suffers from an input validation error vulnerability that stems from not properly validating input. An attacker can exploit this vulnerability to hijack a user session...

Malicious code in linter-coffee-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 292d0ff0a104c6e415fc2ea734ec189f699d6aecb4383502759e2053adddfb45 The OpenSSF Package Analysis project identified 'linter-coffee-variables' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Codezips Gym Management System 注入漏洞

Codezips Gym Management System is an open source gym management system from Codezips. An injection vulnerability exists in Codezips Gym Management System version 1.0, which stems from the fact that incorrect manipulation of the parameter name can lead to SQL injection...

Google Android elevation of privilege vulnerability (CNVD-2025-05219)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to elevate privileges...

Google Android suffers from unspecified vulnerability (CNVD-2025-03648)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to elevate privileges...

Daily Expense Tracker System SQL Injection Vulnerability (CNVD-2025-31004)

Daily Expense Tracker System is a PHP and MySQL based daily expense tracking system. Daily Expense Tracker System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the dateexpense parameter in /dets/add-expense.php. No details ...