UBUNTU-CVE-2025-32044

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exceptionignoreargs = 1 in the...

SUSE CVE-2025-27571

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived...

Mattermost Server 9.11.x < 9.11.10 / 10.4.x < 10.4.4 / 10.5.x < 10.5.2 / 10.6.0 (MMSA-2025-00436)

The version of Mattermost Server installed on the remote host is prior to 9.11.10, 10.4.4, or 10.5.2 / 10.6.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00436 advisory. - Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to properly...

The vulnerability of the form_fast_setting_wifi_set() function (/goform/fast_setting_wifi_set) in the Tenda AC6 router’s microprogramming software allows a hacker to trigger a service failure.

The vulnerability of the formfastsettingwifiset function /goform/fastsettingwifiset in the Tenda AC6 router’s microprogramming software is related to buffer overflow in the stack when processing the timeZone parameter. Exploiting this vulnerability could allow a remote attacker to cause a service...

CVE-2025-43954

QMarkdown aka quasar-ui-qmarkdown before 2.0.5 allows XSS via headers even when when no-html is set...

CVE-2025-43954

QMarkdown (quasar-ui-qmarkdown) before 2.0.5 is affected: it allows XSS via headers even when the no-html option is set. Affected versions are prior to 2.0.5. Remediation: upgrade to 2.0.5 or later (or apply vendor-provided patches). Exploitation details and in-the-wild status are not described i...

CVE-2025-43954

QMarkdown aka quasar-ui-qmarkdown before 2.0.5 allows XSS via headers even when when no-html is set...

QMarkdown 安全漏洞

QMarkdown is an open source Quasar UI application extension for Quasar Framework to display inline markup. A security vulnerability exists in QMarkdown versions prior to 2.0.5, which stems from a cross-site scripting attack that can be caused by headers even if no-html is set...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Homepage Content argument in the system setting handler. An attacker can alter the display of web pages or redirect users to malicious websites by injecting arbitrary web script o...

one-api Cross-site Scripting vulnerability

A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content leads to cross site scripting. It is possible to initiate the attack...

CVE-2025-3801 songquanpeng one-api System Setting cross site scripting

A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content/About System/Footer leads to cross site scripting. It is possible to...

PT-2025-17378 · Unknown · Songquanpeng One-Api

Name of the Vulnerable Software and Affected Versions: songquanpeng one-api versions up to 0.6.10 Description: A vulnerability was found in the System Setting Handler component, allowing for cross-site scripting through the manipulation of the Homepage Content argument. This issue can be exploite...

SUSE CVE-2025-22071

In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak in spufscreatecontext Leak fixes back in 2008 missed one case - if we are trying to set affinity and spufsmkdir fails, we need to drop the reference to neighbor...

CVE-2025-29451

An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component...

CVE-2025-29451

An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component...

PT-2025-17233 · Seo Panel · Seo Panel

Name of the Vulnerable Software and Affected Versions: Seo Panel version 4.11.0 Description: An issue in Seo Panel allows a remote attacker to obtain sensitive information via the Mail Setting component. Recommendations: For Seo Panel version 4.11.0, at the moment, there is no information about a...

CVE-2025-29451

CVE-2025-29451 affects Seo Panel 4.11.0; a vulnerability in the Mail Setting component allows a remote attacker to obtain sensitive information. Core details provided across multiple sources: impact is high (CVSS v3.1: 7.6), attack vector network, low privileges required, no user interaction. Roo...

CVE-2025-29451

An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component...

CVE-2025-2564 Unauthorized View Access to Archived Channel Member Info

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled...

CVE-2025-2564 Unauthorized View Access to Archived Channel Member Info

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled...