Revive Adserver: Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0

==Cricetinae== Summary: A critical SQL Injection vulnerability has been identified in Revive Adserver's administrative search functionality, specifically in the admin-search.php file. The vulnerability exists in the handling of the keyword GET parameter, which is passed to multiple database queri...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2025-62708 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2025-62708 Source...

calibreweb (0.6.25), cewler (>=1.3.0, <=1.3.1) +8 more potentially affected by CVE-2025-62707 via pypdf (5.4.0)

pypdf PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - calibreweb 0.6.25 - cewler =1.3.0, =1.1.2, =1.1.0, =1.2.0, =2025.3.0, =0.2.2, =28.3.2, =29.1.2 - ten8t 0.0.22 Source cves: CVE-2025-62707 Source...

EUVD-2025-35561

Cross-Site Request Forgery CSRF vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through = 1.2.17...

GHSA-8MF9-RMGW-33QC Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...

CVE-2025-48099

Cross-Site Request Forgery CSRF vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through = 1.2.17...

CVE-2025-48099 WordPress Search & Filter plugin <= 1.2.17 - Cross Site Request Forgery (CSRF) to Open Redirect vulnerability

Cross-Site Request Forgery CSRF vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through = 1.2.17...

CVE-2025-48099 WordPress Search & Filter plugin <= 1.2.17 - Cross Site Request Forgery (CSRF) to Open Redirect vulnerability

Cross-Site Request Forgery CSRF vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through = 1.2.17...

CVE-2025-48099

CVE-2025-48099 is a CSRF vulnerability in the WordPress plugin Code Amp Search & Filter (search-filter) affecting versions up to and including 1.2.17. The issue enables Cross-Site Request Forgery that can lead to an Open Redirect under authenticated conditions. Public references describe the impa...

CVE-2023-53728

In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posixtimeradd tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID...

UBUNTU-CVE-2023-53728

In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posixtimeradd tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID...

CVE-2023-53728 posix-timers: Ensure timer ID search-loop limit is valid

In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posixtimeradd tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID...

CVE-2023-53728

The CVE affects the Linux kernel’s posix-timers path, where posix_timer_add() allocates timer IDs by scanning from a cached, last-allocation ID. The loop that searches for a free ID is not properly synchronized with the starting value, because start is read locklessly while the hash lock is acqui...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2025-11844

Hugging Face Smolagents 1.20.0 has an XPath injection in search_item_ctrl_f (vision_web_browser.py) where user input is concatenated into XPath queries without sanitization, allowing attackers to modify query logic, bypass filters, and access unintended DOM elements, potentially disrupting AI web...

CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...

Multiple I-O DATA NAS management applications register Windows services with unquoted file paths

Overview Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. Multiple NAS management applications provided by I-O DATA DEVICE, INC. contain the following vulnerability. Unquoted search path or element CWE-428 - CVE-2025-61865...

Reflected Cross-Site Scripting (XSS)

com.liferay, com.liferay.portal.search.web is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to improper input validation of user-supplied data in the search bar portlet URL, which allows an attacker to inject and execute arbitrary web scripts or HTML in a victim’s...

CVE-2025-61255

Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting XSS vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection...

Asterisk safe_asterisk Privilege Escalation

The vulnerability of the safeasterisk /usr/sbin/safeasterisk script in the Asterisk IP telephony management system is related to an uncontrolled element in the search process. Exploiting this vulnerability could allow attackers to increase their privileges...