ehd.cz Cross Site Scripting vulnerability OBB-4042410

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2025-15124 · Nimrod · Nimrod

Name of the Vulnerable Software and Affected Versions: godcheese/code-projects Nimrod version 0.8 Description: A critical vulnerability exists in godcheese/code-projects Nimrod 0.8. The vulnerability affects the searchAllByName function within the ViewMenuCategoryRestController.java file...

CVE-2025-3303

CVE-2025-3303 affects the code-projects Patient Record Management System 1.0. The SQL injection vulnerability is rooted in birthing_record.php via manipulation of the itr_no parameter, potentially enabling remote attacker access and data theft; multiple sources describe this as a critical issue w...

CVE-2024-57868

Web::API 2.8 and earlier for Perl uses the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Web::API uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random...

CVE-2024-57835 Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions

Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. String::Random defaults to Perl's built-in predictable random number generator, the rand function, which is not cryptographically secure...

CVE-2025-1500 IBM Maximo Application Suite file upload

IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened...

jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

Overview On many platforms, a third party can create a Git repository under a name that includes a shell command substitution ^1 string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions ^2. If a user starts jupyter-lab in a parent directory of this...

PT-2025-14993 · Bookingor · Bookingor

Name of the Vulnerable Software and Affected Versions: Bookingor versions 1.0.0 through 1.0.6 Description: The issue is related to Missing Authorization, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions 1.0.0 through 1.0.6, consider...

BIT-JOOMLA-2020-13763

In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users...

CVE-2025-32049

A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service DoS...

CVE-2025-30611 WordPress Wptobe-signinup plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wptobe Wptobe-signinup wptobe-signinup allows Reflected XSS.This issue affects Wptobe-signinup: from n/a through = 1.1.2...

CVE-2025-0418

Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the passwords...

CVE-2025-0417

Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing switching operations...

MAL-2025-3088 Malicious code in @pump.fun/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5b2af9fba1ebc4eb008f281779b4d498271795051fc434a3c4a8e2e15f9e067 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3107 Malicious code in my-test002-datetime-momo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a688643a119539cf494c667fdedfeb4b5373651b0296fe8252d54d72bd7e30b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-14614

Name of the Vulnerable Software and Affected Versions pgAdmin versions 9.1 and earlier Description The issue allows attackers to execute Cross-Site Scripting XSS attacks via query result rendering, enabling them to run arbitrary HTML/JavaScript in a user's browser. This occurs when an attacker...

PT-2025-14794 · Netwrix · Netwrix Password Secure

Name of the Vulnerable Software and Affected Versions: Netwrix Password Secure versions 9.2 and earlier Description: The issue allows command injection. This means that an attacker could potentially execute system commands, which could lead to unauthorized access or control of the system...

CVE-2025-27608

Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting XSS vulnerability has been identified within the Arduino-IDE prior to version v2.3.5. The vulnerability occurs in the Additional Board Manager URLs field, which can be found in the...

CVE-2025-27608 Self Cross-Site Scripting in Arduino IDE

Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting XSS vulnerability has been identified within the Arduino-IDE prior to version v2.3.5. The vulnerability occurs in the Additional Board Manager URLs field, which can be found in the...

CVE-2024-36336

The CVE-2024-36336 entry concerns the AMD NPU Driver, where an integer overflow could enable a local attacker to write out-of-bounds memory, potentially compromising confidentiality, integrity, and availability. The primary impact is a local-privilege scenario (LOCAL, LOW privileges) with a HIGH ...