CVE-2025-61255

Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting XSS vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection...

CVE-2025-61255: Improper Neutralization of Input During Web Page Generation

Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting XSS vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection...

CVE-2025-61255

The Bank Locker Management System by PHPGurukul is susceptible to a Cross-Site Scripting (XSS) vulnerability via the /search parameter. The root cause is the lack of effective filtering and escaping of user-supplied data, which allows an attacker to inject arbitrary HTML and JavaScript . This cou...

CVE-2025-61255

Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting XSS vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987695)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987695 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix bugon in estreesearch Hulk Robot reported a BUGON:...

CVE-2025-11940

A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are...

EUVD-2025-35046

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

What does Google know about me? (Lock and Code S06E21)

This week on the Lock and Code podcast … Google is everywhere in our lives. It's reach into our data extends just as far. After investigating how much data Facebook had collected about him in his nearly 20 years with the platform, Lock and Code host David Ruiz had similar questions about the othe...

What does Google know about me? (Lock and Code S06E21)

This week on the Lock and Code podcast … Google is everywhere in our lives. It's reach into our data extends just as far. After investigating how much data Facebook had collected about him in his nearly 20 years with the platform, Lock and Code host David Ruiz had similar questions about the othe...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61454

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce v1.0 within the search.php endpoint. The root cause is the failure to sanitize the search parameter from POST data before reflecting it back into the response HTML. An attacker can craft a request containing m...

PT-2025-42758

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0 Description A Cross-Site Scripting XSS issue exists in the software, specifically within the search functionality. The /search API endpoint reflects unsanitized input directly into the response HTML,...

CVE-2025-61454: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

Windows Search Service DoS

The vulnerability of the Windows Search service in Microsoft Windows operating systems is related to access control errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

E-commerce security vulnerabilities

E-commerce is a dynamic e-commerce website by the individual developer Bhabishya Ghimire. A security vulnerability exists in E-commerce version 1.0, which stems from the /search parameter not clearing the input to be reflected directly back to the response HTML, which could lead to a cross-site...

EUVD-2025-35003

A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are...

CVE-2025-11940

A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are...

CVE-2025-11940

The CVE-2025-11940 vulnerability affects LibreWolf up to 143.0.4-1 on Windows, tied to an unknown function in assets/setup.nsi of the Installer component. It enables an uncontrolled search path and requires local access from the attacker; the exploitability is described as difficult. A fix is ava...