PT-2025-45374

Name of the Vulnerable Software and Affected Versions IBM OpenPages versions 9.0 with Watson through 9.1 Description A remote attacker could inject malicious HTML code. When viewed, this code would be executed in the victim’s web browser within the security context of the hosting site...

IBM OpenPages 安全漏洞

IBM OpenPages is an AI-driven, highly scalable governance, risk and compliance GRC solution from International Business Machines IBM. A security vulnerability exists in IBM OpenPages versions 9.1 and 9.0 that stems from susceptibility to an HTML injection attack that could lead to malicious code...

PT-2025-45188

Name of the Vulnerable Software and Affected Versions axiomthemes smart SEO versions through 4.0 Description A SQL Injection issue exists in axiomthemes smart SEO. The issue is due to improper neutralization of special elements used in an SQL command. This allows for potential SQL Injection...

CVE-2025-55341

Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexosnuevo.php asocImgRad...

CVE-2025-64108 Cursor's Sensitive File Modification can Lead to NTFS Path Quirks

Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent sensitive file protections and overwrite files which Cursor requires human approval to overwrite. Modification of some of the protected fil...

EUVD-2025-37495

Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php...

CarLux 安全漏洞

CarLux is a car booking system by the individual developer AKSHIT SONANI. A security vulnerability exists in CarLux version 1.0, which originates from a SQL injection vulnerability in the file /carlux/contact.php...

itsourcecode Online Loan Management System 安全漏洞

itsourcecode Online Loan Management System is an online loan management system from itsourcecode open source. A security vulnerability exists in version 1.0 of itsourcecode Online Loan Management System, which stems from an incorrect manipulation of the parameter ID in the file /managepayment.php...

MAL-2025-49318 Malicious code in stark-recurser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54520ff73a8cd962cb9ab3db426b6c93987e6b616edf752e0e5f6f346293af1b The package stark-recurser was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-12521

The CVE-2025-12521 entry concerns the Analytify Pro WordPress plugin (versions up to and including 7.0.3) with an unauthenticated information exposure vulnerability. Reports indicate that sensitive information (specifically usernames found in source code) can be exposed via the Analytify Tag HTML...

CVE-2025-52665

The UniFi Access door access application (versions 3.3.22 through 3.4.31 ) is vulnerable to a broken access control flaw caused by a misconfiguration that exposes a management API without proper authentication. A malicious actor with access to the management network can exploit this to access man...

CVE-2021-4461 Seeyon Zhiyuan OA Web Application System < 7.0 SP1 Authentication Bypass

Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the enc parameter in thirdpartyController.do. The decoded map values can influence session attributes without sufficient authentication/authorization checks, enabling attackers to assign a...

PT-2025-44459

Name of the Vulnerable Software and Affected Versions Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 Description The software does not properly decode and parse the enc parameter in the thirdpartyController.do endpoint. The decoded map values can influence session...

EUVD-2025-36766

Malicious code in zohocrm-nodejs-sdk-3.0 npm...

CVE-2025-54605

Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption issue 2 of 2...

EUVD-2025-36540

IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application...

CVE-2025-12297 atjiu pybbs UserApiController.java information disclosure

A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used...

EUVD-2025-35987

Cross-Site Request Forgery CSRF vulnerability in iseremet Reloadly reloadly-topup-widget allows Stored XSS.This issue affects Reloadly: from n/a through = 2.0.1...

EUVD-2025-36014

Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Content: from n/a through = 4.0.5...

PT-2025-43824

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Konstantin Pankratov Date counter date-counter allows Stored XSS.This issue affects Date counter: from n/a through = 2.0.3...