EUVD-2026-1552

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through = 0.8.8...

CVE-2026-22257

creationtimestamp| type| source ---|---|--- 2026-01-08 08:04:13+00:00| published-proof-of-concept| https://github.com/salvo-rs/salvo/security/advisories/GHSA-54m3-5fxr-2f3j 2026-01-08 19:40:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbwqezghqa2u 2026-01-08...

Session is not expiring after password resetting

This report is not public...

CVE-2019-25231

creationtimestamp| type| source ---|---|--- 2026-01-08 01:45:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbuucf2nrm2e 2026-01-08 21:03:02+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mbwuxwk6vi2f...

EUVD-2025-206259

The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting XSS attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the...

CVE-2025-66913

JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs. The application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing the use of certain directives to execute arbitrary Java code. A different vulnerability than...

CVE-2025-66913

Summary (CVE-2025-66913) JimuReport (through v2.1.3) is vulnerable to remote code execution when handling user-controlled H2 JDBC URLs: the application passes the attacker-supplied JDBC URL directly to the H2 driver, allowing directives to execute arbitrary Java code. The issue is distinct from C...

CVE-2025-12776

The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting XSS attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the...

CVE-2025-12776

The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting XSS attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the...

CVE-2025-12776

The CVE-2025-12776 case concerns the WebConsole Report Builder, where user input is stored directly in a web page and displayed to others, enabling a stored XSS risk. The issue is triggered when a user with edit permissions modifies a report; running the report does not execute the scripts, but e...

CVE-2025-12776 Stored Cross-Site Scripting

The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting XSS attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the...

CVE-2025-12776 Stored Cross-Site Scripting

The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting XSS attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the...

SQL Injection: Hibernate

Overview coreshop/core-bundle is a CoreShop - Core Bundle Glue Bundle Affected versions of this package are vulnerable to SQL Injection: Hibernate via unsanitized input in the store parameter of the admin report process. An attacker can extract sensitive database information by manipulating the...

GHSA-CH7P-MPV4-4VG4 CoreShop Vulnerable to SQL Injection via Admin Reports

Affected Versions - CoreShop 4.1.2 Demo tested Demo | CoreShop - Earlier versions may also be affected if the same code path exists Summary A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using...

CVE-2019-16416

HRworks 3.36.9 allows XSS via the purpose of a travel-expense report...

CVE-2024-2748

A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an unsuspecting user. A mitigating factor is that user interaction is required. This vulnerability affected GitHub Enterprise Server 3.12.0 a...

CVE-2024-2134

A vulnerability has been found in Bdtask Hospita AutoManager up to 20240223 and classified as problematic. This vulnerability affects unknown code of the file /investigation/delete/ of the component Investigation Report Handler. The manipulation leads to cross-site request forgery. The attack can...

CVE-2024-2282

A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component Login Page. The manipulation of the argument useremail leads to sql injection. The attack may be initiated...

Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers

A newly discovered critical security flaw in legacy D-Link DSL gateway routers has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0625 CVSS score: 9.3, concerns a case of command injection in the "dnscfg.cgi" endpoint that arises as a result of improper...

Brave Desktop 1.85.120 Security Fixes

Updated Picture-in-Picture PiP to display origin as reported on HackerOne by frozzipies. Upgraded Chromium to 143.0.7499.192 — refer to Google Chrome advisories for inherited CVEs...