PT-2025-40363

Name of the Vulnerable Software and Affected Versions AndSoft's e-TMS version 25.03 Description A SQL injection issue exists in AndSoft's e-TMS version 25.03. This allows an attacker to potentially retrieve, create, update, and delete databases by sending a POST request to the...

CVE-2025-57424

A stored cross-site scripting XSS vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker can insert arbitrary JavaScript into their profile, which executes in the browser of any user viewing it, including administrators. Due to the absence of the...

IBM Cognos Controller and IBM Controller Encryption Issues Vulnerabilities

IBM Cognos Controller is an enterprise financial consolidation and reporting software from IBM. A security vulnerability exists in IBM Cognos Controller versions 11.0.0 through 11.0.1 and IBM Controller versions 11.1.0 through 11.1.1, which stems from the use of a hard-coded encryption key to sig...

IBM Cognos Controller和IBM Controller 安全漏洞

IBM Cognos Controller is an enterprise financial consolidation and reporting software from IBM. A security vulnerability exists in IBM Cognos Controller versions 11.0.0 through 11.0.1 and IBM Controller versions 11.1.0 through 11.1.1, which stems from the use of a hard-coded encryption key to sig...

CVE-2025-54761

An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie...

CVE-2025-54761

An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie...

CVE-2025-54761: Improper Privilege Management

An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie...

CVE-2025-54761

An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie...

PT-2025-38617

Name of the Vulnerable Software and Affected Versions PPress version 0.0.9 Description An issue exists in PPress version 0.0.9 that allows attackers to gain escalated privileges through a crafted session cookie. Recommendations At the moment, there is no information about a newer version that...

CVE-2025-54761

An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie...

CVE-2025-54761

A security vulnerability exists in PPress version 0.0.9 (specifically 0.0.9-beta ) that allows attackers to perform session forgery , leading to privilege escalation . The root cause involves the processing of a crafted session cookie . While the vulnerability is confirmed, the documents state th...

CVE-2025-54761

An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie...

CVE-2025-40696

CVE-2025-40696 affects Online Fire Reporting System v1.2 (PHPGurukul). The vulnerability is a stored authenticated XSS in /ofrs/reporting.php caused by insufficient validation of POST parameters fullname, location, and message. This could allow an authenticated attacker to craft input that steals...

CVE-2025-40694 Cross Site Scripting in PHPGurukul Online Fire Reporting System

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fromdate' and 'todate' parameters via POST at the endpoint '/ofrs/admin/bwdates-report-result.php'. This vulnerability...

PT-2025-37178

Name of the Vulnerable Software and Affected Versions: Online Fire Reporting System version 1.2 Description: The Online Fire Reporting System contains a stored cross-site scripting XSS issue. This is due to insufficient validation of user-supplied fromdate and todate parameters via a POST request...

CVE-2025-40725: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS vulnerability in Azon Dominator. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the “q” parameter in /search via GET. This vulnerability can be exploited to steal sensitive user data...

CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be...

PT-2025-36937

Name of the Vulnerable Software and Affected Versions listmonk versions 1.1.0 and earlier Description listmonk, a standalone newsletter and mailing list manager, is susceptible to a chain of vulnerabilities involving Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS. Specifically, the...

CVE-2025-58430: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be...

CVE-2025-40641

CVE-2025-40641 corresponds to a stored Cross-Site Scripting (XSS) vulnerability in the Multi-Purpose Inventory Management System (Codester). The flaw arises from insufficient validation of user input in a POST request to /Controller_Products/update, specifically via the product_name parameter, en...