4203 matches found
CVE-2025-34314: Improper Neutralization of Input During Web Page Generation
IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SRC, DST, and COMMENT parameters when creating a time constraint rule. When a user adds a time constraint rul...
CVE-2025-12206
A flaw has been found in Kamailio 5.5. The impacted element is the function rveisconstant of the file src/core/rvalue.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been published and may be used. It is still unclear if this...
PT-2025-43865
Name of the Vulnerable Software and Affected Versions Kamailio version 5.5 Description A flaw exists in Kamailio that involves a use-after-free condition. This issue is located within the Configuration File Handler component, specifically in the sr push yy state function of the src/core/cfg.lex...
CVE-2025-12204: Heap-based Buffer Overflow
A security vulnerability has been detected in Kamailio 5.5. Impacted is the function rvedestroy of the file src/core/rvalue.c of the component Configuration File Handler. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed...
CVE-2025-12207: NULL Pointer Dereference
A vulnerability has been found in Kamailio 5.5. This affects the function yyerrorat of the file src/core/cfg.y of the component Grammar Rule Handler. Such manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed to the public and may...
CVE-2025-12206: NULL Pointer Dereference
A flaw has been found in Kamailio 5.5. The impacted element is the function rveisconstant of the file src/core/rvalue.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been published and may be used. It is still unclear if this...
CVE-2025-12205: Use After Free
A vulnerability was detected in Kamailio 5.5. The affected element is the function srpushyystate of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local position. The exploit is now public and...
CVE-2025-11844: Improper Neutralization of Data within XPath Expressions
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...
PT-2025-45977
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to git index add can cause heap corruption that could be leveraged for arbitrary code execution. The...
PT-2025-42928
Name of the Vulnerable Software and Affected Versions code16 Sharp version 9.6.6 Description The software contains a Cross Site Scripting XSS issue located in src/Form/Fields/SharpFormUploadField.php. Recommendations At the moment, there is no information about a newer version that contains a fix...
CVE-2025-61457: Improper Neutralization of Input During Web Page Generation
code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting XSS src/Form/Fields/SharpFormUploadField.php...
PT-2025-45906
FFmpeg version git commit de8e6e67e7523e48bb27ac224a0b446df05e1640 suffers from a an assertion failure at src/libavutil/mathematics.c...
Malicious code in src_dev-tool_index_ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6c5f130294b305df1adf1e497c66d81ec09ddeffb8bb6d0c486644336706558 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2025-34993
Malicious code in srcpluginindexts npm...
EUVD-2025-34994
Malicious code in srccore-instanceindexts npm...
CVE-2025-11551: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in code-projects Student Result Manager 1.0. This affects an unknown function of the file src/students/Database.java. This manipulation of the argument roll/name/gpa causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly...
CVE-2025-11360 jakowenko double-take API app.js app.use cross site scripting
A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to...
CVE-2025-11360 jakowenko double-take API app.js app.use cross site scripting
A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to...