CVE-2025-48463

Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...

CVE-2025-48470 Stored Cross site Scripting (XSS)

Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation...

CVE-2025-48470 Stored Cross site Scripting (XSS)

Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation...

CVE-2025-48470

CVE-2025-48470 is a stored cross-site scripting (XSS) vulnerability affecting Advantech devices (notably WISE-4010LAN, WISE-4050LAN, WISE-4060LAN per CNNVD). The issue allows an attacker to inject malicious scripts into device fields, which can execute in other users’ browsers and potentially lea...

CVE-2025-48463 Unencrypted HTTP Communication

Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...

CVE-2025-48463 Unencrypted HTTP Communication

Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering...

CVE-2025-48463

CVE-2025-48463 concerns unencrypted HTTP leading to data interception and session hijacking. The provided docs confirm this vulnerability affects multiple products/vendors and characterize the impact as possible unauthorised access or data tampering due to cleartext traffic. The NVD/RH Red Hat en...

CVE-2025-34032

CVE-2025-34032 concerns the Moodle LMS Jmol plugin (

Advantech多款产品 安全漏洞

The Advantech WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN are all industrial automation controllers from Advantech of Taiwan, China. An information disclosure vulnerability exists in multiple Advantech products, which can be exploited by attackers to cause data interception and session hijacking...

PT-2025-26682 · Advantech · Advantech Wireless Sensing/Equipment +3

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns a stored cross-site scripting vulnerability. Successful exploitation could allow an attacker to inject malicious scripts into device fields and execute them in other users...

CVE-2025-52557

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...

PT-2025-26677 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP versions affected versions not specified Description: The issue arises from the use of unencrypted HTTP communication, allowing an attacker to intercept data and conduct session hijacking on exposed data. This could lead to...

CVE-2025-52557

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...

CVE-2025-52557

Summary: CVE-2025-52557 affects Mail-0’s Zero Email Solution, specifically version 0.8, due to improper sanitization in email handling which enables an attacker to craft an email that executes JavaScript and can cause session hijacking. Root cause: stored XSS stemming from insufficient sanitizati...

CVE-2025-52557 Mail-0 Zero Session Hijacking Via Email

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...

CVE-2025-52557 Mail-0 Zero Session Hijacking Via Email

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...

CVE-2025-52557 Mail-0 Zero Session Hijacking Via Email

Mail-0's Zero is an open-source email solution. In version 0.8 it's possible for an attacker to craft an email that executes javascript leading to session hijacking due to improper sanitization. This issue has been patched in version 0.81...

PT-2025-26486 · Unknown · Mail-0'S Zero

Name of the Vulnerable Software and Affected Versions: Mail-0's Zero versions 0.8 Description: The issue is related to improper sanitization, allowing an attacker to craft an email that executes javascript, leading to session hijacking. This is a Stored XSS Vulnerability in the Mail-0's Zero Emai...

Zero 安全漏洞

Zero is an email application from Zero Open Source. A security vulnerability exists in Zero version 0.8 that stems from improper email cleanup and could lead to session hijacking...

CVE-2025-4754

Insufficient Session Expiration vulnerability in ash-project ashauthenticationphoenix allows Session Hijacking. This vulnerability is associated with program files lib/ashauthenticationphoenix/controller.ex. This issue affects ashauthenticationphoenix until 2.10.0...