PHOENIX CONTACT多款产品 安全漏洞

PHOENIX CONTACT CHARX SEC-3050, etc. are products of PHOENIX CONTACT, Germany.PHOENIX CONTACT CHARX SEC-3050 is an AC charge controller.PHOENIX CONTACT CHARX SEC-3100 is an AC PHOENIX CONTACT CHARX SEC-3150 is an AC charge controller. A security vulnerability exists in several PHOENIX CONTACT...

PHOENIX CONTACT多款产品 后置链接漏洞

PHOENIX CONTACT AXC F 1152 and others are a controller device from PHOENIX CONTACT, Germany. A post-link vulnerability exists in several PHOENIX CONTACT products, which can be exploited by a low-privileged remote attacker to gain read, write, and execute privileges to arbitrary files on the devic...

PHOENIX CONTACT多款产品 操作系统命令注入漏洞

PHOENIX CONTACT CHARX SEC-3050 and others are products of PHOENIX CONTACT, Germany.PHOENIX CONTACT CHARX SEC-3050 is an AC charge controller.PHOENIX CONTACT CHARX SEC-3100 is an AC PHOENIX CONTACT CHARX SEC-3150 is an AC charge controller. An operating system command injection vulnerability exist...

airunner (>=3.0.0 <=3.1.14), llama-index-packs-arize-phoenix-query-engine (>=0.0.2 <=0.1.4) +2 more potentially affected by CVE-2025-3225 via llama-index-readers-web (>=0.0.1 <=0.3.5)

llama-index-readers-web PYPI version =0.0.1, =3.0.0, =0.0.2, =0.1.0, =0.1.0, =0.2.8 Source cves: CVE-2025-3225 Source advisory: SNYK:PYTHON-LLAMAINDEXREADERSWEB-10645574...

CVE-2025-5255 TCC Bypass via Dylib Injection in Phoenix Code

The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library Dylib injection. A local attacker with unprivileged access can use...

CVE-2025-5255

Summary: The Phoenix Code on macOS is affected by a configuration issue that enables Dynamic Library (Dylib) injection when entitlements like com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation are present. A local, unprivileged attacker can...

CVE-2025-5255 TCC Bypass via Dylib Injection in Phoenix Code

The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library Dylib injection. A local attacker with unprivileged access can use...

PT-2025-26297

Name of the Vulnerable Software and Affected Versions: The Phoenix Code versions prior to the version with commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da Description: The issue is related to the configuration of The Phoenix Code on macOS, specifically the presence of certain entitlements. These...

Core.ai Phoenix Code 安全漏洞

Core.ai Phoenix Code is a lightweight text editor from Core.ai India. A security vulnerability exists in Core.ai Phoenix Code that stems from allowing dynamic library injection, which could lead to a local attacker bypassing TCC...

CVE-2025-40727

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

CVE-2025-4754

Insufficient Session Expiration vulnerability in ash-project ashauthenticationphoenix allows Session Hijacking. This vulnerability is associated with program files lib/ashauthenticationphoenix/controller.ex. This issue affects ashauthenticationphoenix until 2.10.0...

CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix

Insufficient Session Expiration vulnerability in ash-project ashauthenticationphoenix allows Session Hijacking. This vulnerability is associated with program files lib/ashauthenticationphoenix/controller.ex. This issue affects ashauthenticationphoenix until 2.10.0...

CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix

Insufficient Session Expiration vulnerability in ash-project ashauthenticationphoenix allows Session Hijacking. This vulnerability is associated with program files lib/ashauthenticationphoenix/controller.ex. This issue affects ashauthenticationphoenix until 2.10.0...

EEF-CVE-2025-4754 Missing Session Revocation on Logout in ash_authentication_phoenix

Summary Insufficient Session Expiration vulnerability in ash-project ash\authentication\phoenix allows Session Hijacking. This vulnerability is associated with program files lib/ash\authentication\phoenix/controller.ex. This issue affects ash\authentication\phoenix until 2.10.0...

PT-2025-25659

Name of the Vulnerable Software and Affected Versions ash-project ash authentication phoenix versions prior to 2.10.0 Description The issue affects the ash authentication phoenix library, where session tokens remain valid on the server after a user logs out. This creates a security gap where...

Ash Authentication Phoenix 代码问题漏洞

Ash Authentication Phoenix is an Alembic open source that provides plug-in authentication support for Phoenix applications using AshAuthentication. A security vulnerability exists in Ash Authentication Phoenix version 2.10.0 and earlier that stems from insufficient session expiration and could le...

CVE-2025-40727

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

CVE-2025-40727

Consolidated findings for CVE-2025-40727: The Phoenix Site CMS contains a Reflected XSS vulnerability in the /search endpoint, exploitable via the s GET parameter. The root cause is reflected input being echoed unsafely, enabling remote attackers to execute arbitrary code in the context of the af...

CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...