CVE-2025-54757

CVE-2025-54757 affects PowerCMS. Unrestricted upload of files allows a product user-uploaded file to contain dangerous content, potentially enabling an arbitrary script when an administrator opens the malicious file in the browser. The root issue is unsafe handling of file uploads that can be man...

CVE-2025-26064

The Intelbras RX1500 (v2.2.9) and RX3000 (v1.0.11) routers are affected by a cross-site scripting (XSS) vulnerability in their web management interfaces. The root cause is a lack of sufficient measures to protect the web page structure, specifically due to unvalidated connected device names . An ...

CVE-2025-54757: Unrestricted Upload of File with Dangerous Type

Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a product user, an arbitrary script may be executed on the browser...

PT-2025-31481 · Powercms · Powercms

Name of the Vulnerable Software and Affected Versions: PowerCMS affected versions not specified Description: Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by a user, an arbitrary script may be executed in...

CVE-2025-26064

A cross-site scripting XSS vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device...

PT-2025-31483 · Powercms · Powercms

Name of the Vulnerable Software and Affected Versions: PowerCMS affected versions not specified Description: A reflected cross-site scripting issue exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed in the browser...

CVE-2025-36563: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed on the browser...

WordPress plugin GiveWP 跨站脚本漏洞

WordPress GiveWP plugin is an open source online donation system plugin, mainly used to help the website to realize the online fundraising function. WordPress GiveWP plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping...

Alfasado PowerCMS 跨站脚本漏洞

Alfasado PowerCMS is a content management system CMS from Alfasado Japan. A cross-site scripting vulnerability exists in PowerCMS that stems from reflective cross-site scripting and could lead to the execution of arbitrary script...

Alfasado PowerCMS 跨站脚本漏洞

Alfasado PowerCMS is a content management system CMS from Alfasado Japan. A cross-site scripting vulnerability exists in Alfasado PowerCMS that originates from stored cross-site scripting and could lead to the execution of arbitrary script...

Cross-site Scripting (XSS)

Overview org.webjars.npm:nice-select2 is an A lightweight Vanilla JavaScript plugin that replaces native select elements with customizable dropdowns. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is...

Cross-site Scripting (XSS)

Overview nice-select2 is an A lightweight Vanilla JavaScript plugin that replaces native select elements with customizable dropdowns. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly...

Totolink

It is an offensive tool for routers. Exploit module/toolkit targ...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

RockyLinux 9 : libreoffice (RLSA-2025:3408)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:3408 advisory. libreoffice: Macro URL arbitrary script execution CVE-2025-1080 Tenable has extracted the preceding description block directly from the RockyLinux security...

Important: git

Issue Overview: When a user clones an untrusted repository and runs Gitk without additional command arguments, any writable file can be created and truncated. The option "Support per-file encoding" must have been enabled. The operation "Show origin of this line" is affected as well, regardless of...

RLSA-2025:3408 Important: libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...

git security update

An update is available for git. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git is a distributed revision control system with a decentralized architecture. A...

CVE-2025-26469: Incorrect Permission Assignment for Critical Resource

An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840. A specially crafted application can decrypt credentials stored in a configuration-related registry key. An attacker can execute a malicious script or...

CVE-2025-45406

A stored cross-site scripting XSS vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbartime parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbartime, and...