PT-2025-43603

Name of the Vulnerable Software and Affected Versions Edge CPT versions through 1.4 Description An improper control of filename for include/require statement exists in Edge CPT, leading to a PHP Local File Inclusion issue. This allows for the inclusion of local files within the application...

Plane 输入验证错误漏洞

Plane is an open source, self-hosted project planning tool from Plane Open Source. An input validation error vulnerability exists in Plane versions prior to 1.1.0, which stems from the nextpath parameter allowing the passing of an arbitrary scheme that could lead to a cross-site scripting attack...

EulerOS 2.0 SP13 : libtiff (EulerOS-SA-2025-2300)

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function...

Malicious code in eslint-plugin-ethereumjs (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-61132

A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's urlforexternal=True generates reset links without a fixed SERVERNAME...

Xss-Wordlist

It is an offensive tool for web application security testing. Th...

The vulnerability of the Veeam Agent for Microsoft Windows data backup tool lies in insufficient validation of input data, which allows attackers to exploit this flaw to gain increased privileges.

The vulnerability of the Veeam Agent for Microsoft Windows data backup tool is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

Lynis Auditing Tool 3.1.6

Lynis is an auditing tool for Unix specialists. It scans the system and available software to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes. This software aims in assisting automated...

SUSE CVE-2020-36855

A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been...

Exploit for Authentication Bypass by Primary Weakness in Crushftp

Exploit CVE-2025-31161 INSTALLATION 1. git clone h...

JLSEC-2025-174 An issue was discovered in GNU gettext 0.19.8

An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read-catalog.c, related to an invalid free in pogramparse in po-gram-gen.y, as demonstrated by lt-msgfmt...

CVE-2025-60932

Multiple stored cross-site scripting XSS vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step...

CVE-2025-62699 Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser tool to log the wrong IP and User-Agent...

CVE-2025-62699

The CVE-2025-62699 issue affects the Wikimedia Foundation MediaWiki Translate Extension (master before 1.39). The root cause is the Translate Extension’s use of jobs to edit translation pages, which causes the CheckUser tool to log the wrong IP and User-Agent, making these edits un-auditable. Thi...

IBM Transformation Extender Advanced Log Message Disclosure Vulnerability

IBM Transformation Extender Advanced is a data transformation, validation and standardization tool software from International Business Machines IBM. IBM Transformation Extender Advanced suffers from a log information disclosure vulnerability that originates from storing sensitive information in ...

@angular-devkit/build-angular (>=20.2.0-next.3, <=21.0.0-next.8), @angular/build (>=20.2.0-next.3, <=21.0.0-next.8) +73 more potentially affected by CVE-2025-62522 via vite (>=7.1.0, <=7.1.10)

vite NPM version =7.1.0, =20.2.0-next.3, =20.2.0-next.3, =2.1.2-alpha.0, =1.0.0-alpha.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =0.11.0-alpha.5, =1.0.0-alpha.2 and more Source cves: CVE-2025-62522 Source advisory: SNYK:JS-VITE-13644406...

@adhd/react-hooks (2.2.1), @adhd/ui-react-base-hooks (>=2.2.1, <=2.3.1) +463 more potentially affected by CVE-2025-62522 via vite (>=5.0.0, <=5.4.20)

vite NPM version =5.0.0, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =2.0.0-beta.0, =3.0.0-beta.1 and more Source cves: CVE-2025-62522 Source advisory: SNYK:JS-VITE-13644406...

CVE-2025-11944

A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and...

CVE-2025-62528

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...

PYSEC-2025-188

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...