CVE-2024-13298

CVE-2024-13298 affects the Drupal Tarte au Citron module. The issue is improper neutralization of input during web page generation, enabling Cross‑Site Scripting (XSS). Affected: Tarte au Citron module versions 2.0.0 before 2.0.5. The problem arises in the module’s handling of input that can be i...

CVE-2024-13268

Improper Neutralization of Directives in Statically Saved Code 'Static Code Injection' vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23...

GO-2025-3379 Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

CVE-2024-13238

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Typogrify allows Cross-Site Scripting XSS.This issue affects Typogrify: from 0.0.0 before 1.3.0...

GHSA-7W6R-748W-MH52 pgAdmin has Incorrect Default Permissions

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously...

Cross-site Scripting (XSS)

dcat/laravel-admin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the /admin/articles/create endpoint in version 2.2.0-beta, which allows attackers to inject malicious scripts...

CVE-2024-13196 donglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scripting

A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been declared as problematic. This vulnerability affects the function BookSearchList of the file src/main/java/org/zdd/bookstore/web/controller/BookInfoController.java. The manipulation of the argument keywords leads to cross...

CVE-2024-55226

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting XSS vulnerability via the component /api/core/mod.rs...

PT-2025-2063 · Unknown · Kurniaramadhan E-Commerce-Php

Name of the Vulnerable Software and Affected Versions: kurniaramadhan E-Commerce-PHP version 1.0 Description: A problem was found in the Create Product Page component, specifically in the /admin/create product.php file. The issue is related to the manipulation of the Name argument, which leads to...

CVE-2025-0283

Technical details for CVE-2025-0283 are not publicly available in the provided documents. Connected items cover CVE-2025-0282 and related advisories, but do not specify affected products, impacts, or fixes for CVE-2025-0283. Monitor for updates.

Composio Command Execution vulnerability

composio =0.5.40 is vulnerable to Command Execution in composioopenai, composioclaude, and composiojulep via the handletoolcalls function...

CVE-2025-22143 WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'listar_permissoes.php' parameter 'msg_e'

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the listarpermissoes.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msge parameter. This vulnerability is fixed i...

DEBIAN-CVE-2024-56784

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adding array index check to prevent memory corruption Why & How Array indices out of bound caused memory corruption. Adding checks to ensure that array index stays in bound...

GHSA-MJF9-4PCV-VFG7 Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted...

Cross-Site Scripting (XSS)

tecnickcom/tcpdf is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the Error function lacking an htmlspecialchars call for the error message, which allows an attacker to inject malicious scripts into the error message...

CVE-2024-47934

Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to crash management service. The Denial of Service situation can be resolved by restarting the management service. This issue affects Portab...

OSV-2025-17 Heap-buffer-overflow in cv::PngDecoder::readHeader

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=387626408 Crash type: Heap-buffer-overflow READ 2 Crash state: cv::PngDecoder::readHeader cv::imdecode cv::imdecode...

PT-2025-1027

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.5 Ivanti Policy Secure versions prior to 22.7R1.2 Ivanti Neurons for ZTA gateways versions prior to 22.7R2.3 Description A stack-based buffer overflow exists in Ivanti Connect Secure, Ivanti Polic...

PT-2025-1086 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.7 through 17.5.5 GitLab CE/EE versions 17.6 through 17.6.3 GitLab CE/EE versions 17.7 through 17.7.1 Description: An issue was discovered in GitLab CE/EE that allows a denial of service DoS by creating cyclic referenc...

PT-2025-1330 · Gemalto · Gemalto

Name of the Vulnerable Software and Affected Versions: Gemalto affected versions not specified Description: A potential stack-based buffer overflow issue existed in the GemaltoKeyHandle.cpp file. This issue was fixed in SCSSU-201801. Recommendations: At the moment, there is no information about a...