CVE-2025-41001 Cross-Site Scripting (XSS) in SOPlanning

Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...

CVE-2025-61956 Missing Authentication for Critical Function in Radiometrics VizAir

Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control ATC and pilots...

How to Automate Cyber Risk Remediation: A Playbook

Trying to manage modern cyber risk with manual processes is like trying to empty the ocean with a bucket. Your team works hard, but the sheer volume of vulnerabilities makes it feel like you’re barely making a dent. You close one ticket, and ten more appear. This approach is unsustainable and...

CVE-2024-14000

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

EUVD-2024-55046

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2024-14000

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2024-14000

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2024-14000 Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

CVE-2024-14000

CVE-2024-14000 concerns Nagios XI versions prior to 2024R1.1.3 and is described across multiple sources as an XSS vulnerability in the Capacity Planning Report component. The root cause is insufficient validation or escaping of user-supplied input, enabling an attacker to inject and execute arbit...

CVE-2024-14000 Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...

Salt Typhoon APT Group: What Public Sector Leaders and Defenders Should Know

The Rapid7 Threat Focus: Salt Typhoon report profiles one of the most sophisticated and persistent state-sponsored threat actors operating today. Salt Typhoon, a Chinese espionage advanced persistent threat APT group linked to the Ministry of State Security MSS, has spent years infiltrating globa...

PT-2025-44557

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.3 Description Nagios XI is susceptible to cross-site scripting XSS through the Capacity Planning Report component. A lack of proper input validation or escaping could enable an attacker to inject and execut...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.1.3 that stems from insufficient...

APThreatHunter: An Automated Planning-Based Threat Hunting Framework

Cyber attacks threaten economic interests, critical infrastructure, and public health and safety. To counter this, entities adopt cyber threat hunting, a proactive approach that involves formulating hypotheses and searching for attack patterns within organisational networks. Automating cyber thre...

CVE-2025-11253

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection.This issue affects Netty ERP: before V.1.1000...

CVE-2025-11253

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. This issue affects Netty ERP: before V.1.1000...

Aksis Netty ERP SQL注入漏洞

Aksis Netty ERP is an enterprise resource planning software from Aksis Turkey. An SQL injection vulnerability exists in Aksis Netty ERP versions prior to V.1.1000, which stems from improper neutralization of special elements and can lead to SQL injection attacks...

CVE-2025-9339 SQL Injection in SIMPLE.ERP

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6...

IBM Planning Analytics Local Cross-Site Scripting Vulnerability

IBM Planning Analytics Local is a web-based local architecture from International Business Machines IBM. IBM Planning Analytics Local suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be...

SIMPLE.ERP SQL注入漏洞

SIMPLE.ERP is an e-commerce platform from SIMPLE Inc. SIMPLE.ERP [email protected]之前版本存在SQL注入漏洞 The vulnerability stems from a SQL injection vulnerability in the Warehouse Document Filter form, which could lead to table deletion...