CVE-2025-34308

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the UPDATEVALUE parameter when updating the default time synchronization settings. When the default values...

CVE-2025-34308 IPFire < v2.29 Stored XSS via Default Time Sync

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the UPDATEVALUE parameter when updating the default time synchronization settings. When the default values...

CVE-2025-34316

IPFire

CVE-2025-34316 IPFire < v2.29 Stored XSS via Mail Server Settings

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the txtmailuser and txtmailpass parameters when updating the mail server settings. When a user updates the mail...

CVE-2025-59460

The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections...

IPFire 安全漏洞

IPFire is an open source Linux distribution from the IPFire organization, used primarily as a router and firewall. IPFire suffers from a cross-site scripting vulnerability that is caused by improper validation of user-supplied input by mail server settings. An attacker can exploit this...

PT-2025-44175

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 Core Update 198 Description IPFire versions prior to 2.29 Core Update 198 are susceptible to a stored cross-site scripting XSS issue. An authenticated attacker can inject arbitrary JavaScript code through the txt...

PT-2025-44169

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 Core Update 198 Description The software contains a stored cross-site scripting XSS issue that allows an authenticated attacker to inject arbitrary JavaScript code. This is achieved by manipulating the INC SPD, OU...

CVE-2025-27093

creationtimestamp| type| source ---|---|--- 2025-10-27 22:59:13+00:00| published-proof-of-concept| https://github.com/BishopFox/sliver/security/advisories/GHSA-q8j9-34qf-7vq7 2025-11-21 12:22:30+00:00| seen| https://threatintel.cc/2025/11/21/sliver-c-insecure-default-network.html 2025-11-21...

CVE-2025-12310

CVE-2025-12310 – VirtFusion : A vulnerability in VirtFusion up to 6.0.2 affects the Email Change Handler’s /account/_settings code, causing improper restriction of excessive authentication attempts (brute-force risk). Attack vector is network-based and remote; public exploit exists (PoC maturity)...

CVE-2025-12310 VirtFusion Email Change _settings excessive authentication

A security vulnerability has been detected in VirtFusion up to 6.0.2. This vulnerability affects unknown code of the file /account/settings of the component Email Change Handler. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be initiated...

Improper Resource Shutdown or Release

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Resource Shutdown or Release due to the delayed cleaning of multipart upload temporary files. An attacker can cause a...

CVE-2025-12269

A vulnerability was found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The affected element is an unknown function of the file /dash/org/settings/previews of the component Account Setting Page. The manipulation results in cross site scripting. It is possible to launch the attack...

CVE-2025-12269

A vulnerability was found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The affected element is an unknown function of the file /dash/org/settings/previews of the component Account Setting Page. The manipulation results in cross site scripting. It is possible to launch the attack...

CVE-2025-12269

The CVE-2025-12269 entry concerns LearnHouse. A cross-site scripting (XSS) vulnerability exists in the Account Setting Page component, specifically in the file /dash/org/settings/previews. The issue is present in LearnHouse builds prior to 98dfad76aad70711a8113f6c1fdabfccf10509ca and can be trigg...

Improper Access Control

Liferay Portal is vulnerable to Improper Access Control. The vulnerability is due to the default membership type being set to “Open” due to newly created sites allowing any registered user to become a member, enabling remote attackers who join the site to view, add, or edit content...

CVE-2025-62716

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?nextpath query parameter allows attackers to supply arbitrary schemes e.g., javascript: that are passed directly to router.push. This results in a cross-site scripting XSS vulnerabilit...

CVE-2025-60291

The CVE-2025-60291 issue affects eTimeTrackLite Web (version 12.0 and earlier, as of 20250704) and is caused by a permission-control flaw that lets unauthenticated attackers access certain routes and alter database connection configurations. Multiple sources (Red Hat, ENISA/EUVD, CIRCL, NVD, CNNV...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Race Condition (CVE-2024-46679)

In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

LearnHouse 安全漏洞

LearnHouse is an online learning management system open-sourced by LearnHouse. LearnHouse has a security vulnerability that originates from a cross-site scripting vulnerability in an unknown function in file /dash/org/settings/previews...