CVE-2024-21650

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the...

AsyncRAT Campaign Uses Python Payloads and TryCloudflare Tunnels for Stealth Attacks

A malware campaign has been observed delivering a remote access trojan RAT named AsyncRAT by making use of Python payloads and TryCloudflare tunnels. "AsyncRAT is a remote access trojan RAT that exploits the async/await pattern for efficient, asynchronous communication," Forcepoint X-Labs...

CVE-2024-28101

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

CVE-2024-57069

A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-54853

A Stored Cross-Site Scripting XSS vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows remote authenticated users to store malicious payloads in the affected field that would then execute in an unsuspecting victim's browser...

CVE-2024-57066

A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57074

A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57069

A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57080

A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-26266

Multiple stored cross-site scripting XSS vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary...

CVE-2025-24967 Stored XSS on Admin Panel When Deleting a User in reNgine

reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting XSS vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This...

CVE-2025-1015

CVE-2025-1015 affects Thunderbird where the Address Book URI fields contain unsanitized links. An attacker could craft an address book that exports a field with a malicious payload; when another user imports the address book and clicks the link, Thunderbird could load a web page inside the applic...

CVE-2025-24891 Dumb Drop has an arbitrary file overwrite and path traversal for root shell

Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritten. With this, it's possible to inject...

CVE-2025-24891 Dumb Drop has an arbitrary file overwrite and path traversal for root shell

Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritten. With this, it's possible to inject...

CVE-2024-12163

The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads...

CVE-2024-12163

The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads...

CVE-2024-12163 GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload

The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads...

CVE-2024-12163

CVE-2024-12163 affects the WordPress plugin Goodlayers Core (Goodlayers Core) before version 2.1.3. The issue, as described in multiple sources, allows users with the Subscriber role and above to upload SVG files containing malicious payloads, enabling a stored Cross-Site Scripting (XSS) conditio...

CVE-2024-12163 GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload

The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads...

CVE-2025-23213

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content XSS Payloads. This vulnerability is fixed in 1.5.28...