CVE-2025-47945

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens JWT for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate...

CVE-2025-47945 Donetick Has Weak Default JWT Secret

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens JWT for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate...

CVE-2025-47945

Donetick is an open‑source task/chores app. Before v0.1.44, it uses JWT authentication with a weak default signing secret, enabling potential full account takeover of any user. The live version confirms the issue. A patch is available in v0.1.44; recommended mitigation is upgrading to 0.1.44 or l...

CVE-2025-4353

creationtimestamp| type| source ---|---|--- 2025-05-06 12:20:52+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15093 2025-05-06 14:21:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loj3eo2vlq2r 2025-05-06 16:09:32+00:00| exploited|...

CVE-2025-4257

creationtimestamp| type| source ---|---|--- 2025-05-05 01:18:26+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14819 2025-05-05 04:15:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lofj2qeb4n2e 2025-05-05 05:50:25+00:00| seen|...

CVE-2025-3644

creationtimestamp| type| source ---|---|--- 2025-04-25 15:07:51+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13451 2025-04-25 17:19:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnnq76gfz22u 2025-04-25 19:11:17+00:00| seen| https://t.me/cvedetector/23770...

CVE-2025-2986

creationtimestamp| type| source ---|---|--- 2025-04-25 12:09:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13409 2025-04-25 13:19:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnncromcw42h 2025-04-25 15:00:29+00:00| seen| https://t.me/cvedetector/23750...

CVE-2025-3572

creationtimestamp| type| source ---|---|--- 2025-04-14 04:33:03+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmqqa2wrnv2q 2025-04-14 05:30:17+00:00| seen| Telegram/egwfazapRWavjx9LjYRJnZIUpq7wdeRdkUxWPpSsP7VQ 2025-04-14 06:17:35+00:00| seen| https://t.me/cvedetector/22819...

Snowbridge 安全漏洞

Snowbridge is an open source application from Snowplow. A security vulnerability exists in Snowbridge that stems from an invalid GTM SS preview header that could lead to infinite event retries...

Aliconnect 安全漏洞

Aliconnect is an application in the Aliconnect open source. A security vulnerability exists in Aliconnect version 0.0.6, which stems from prototype contamination and could lead to arbitrary code execution...

InvoicePlane 安全漏洞

InvoicePlane is an application from InvoicePlane Open Source. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. A security vulnerability exists in InvoicePlane 1.6.11 and prior versions that originates from remote code execution...

LiteLLM Resource Management Error Vulnerability

LiteLLM is a Berri AI open source application. All LLM APIs can be called using the OpenAI format. LiteLLM has a resource management error vulnerability that stems from an insecure parsing of user input in ast.literaleval, which can be exploited by an attacker to cause a denial of service...

CVE-2025-27417 WeGIA Contains a Stored Cross-Site Scripting (XSS) in 'adicionar_status_atendido.php' via the 'status' parameter

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarstatusatendido.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into...

CVE-2025-26605 SQL Injection endpoint 'deletar_cargo.php' parameter 'id_cargo' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, deletarcargo.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access...

Dumb Drop 安全漏洞

Dumb Drop is an open source application from DumbWare. A security vulnerability exists in Dumb Drop that stems from OS command injection and could allow an attacker to remotely execute arbitrary code...

CVE-2025-23032 Cross-Site Scripting (XSS) Stored endpoint 'adicionar_escala.php' parameter 'escala' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarescala.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts int...

CVE-2024-53690

creationtimestamp| type| source ---|---|--- 2025-01-11 13:16:48+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfhs52mzoz22...

CVE-2024-45345

creationtimestamp| type| source ---|---|--- 2025-01-08 20:15:58+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfay5tjbyp2d 2025-01-08 21:41:07+00:00| seen| https://t.me/cvedetector/14736...

Nextcloud Resource Management Error Vulnerability

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from a resource management error vulnerability that stems from the fact that due to a pre-sent HEAD request, the link reference provider...

ImportDump 安全漏洞

ImportDump is an open source application from Miraheze. A security vulnerability exists in ImportDump, which stems from the fact that a user on another wiki can act as the original wiki requester if the user on the other wiki happens to have the same participant ID as a user on this wiki...