CVE-2025-10343 HTML injection in Perfex CRM

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'expensename' at the endpoint '/expenses/expense'...

CVE-2025-10342 HTML injection in Perfex CRM

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'name' at the endpoint '/subscriptions/create'...

CVE-2025-10341

Summary: CVE-2025-10341 affects Perfex CRM v3.2.1 with a stored HTML injection vulnerability in the /clients/client/x endpoint. The issue arises from insufficient validation of the POST parameter “company,” enabling stored HTML injection. Affected software: Perfex CRM 3.2.1 (web application). Vul...

Vasion Print Virtual Appliance Host 安全漏洞

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 25.1.102 that stems from a failure to validate or filter the $printervo-strhostaddress variable, which could lead to a...

TawkTo Widget 安全漏洞

TawkTo Widget is a widget design program from TawkTo, Inc. A security vulnerability exists in version v4 of TawkTo Widget that originates from unvalidated input and could lead to a reflected cross-site scripting attack...

Linux Distros Unpatched Vulnerability : CVE-2025-1131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A local privilege escalation vulnerability exists in the safeasterisk script included with the Asterisk toolkit package. When Asterisk is started via this scrip...

PT-2025-39866

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 and below Description An unvalidated redirect issue exists in Esri Portal for ArcGIS that could allow a remote, unauthenticated attacker to create a URL designed to redirect a user to a website of the...

Vasion Print Virtual Appliance Host 安全漏洞

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 25.1.102, which stems from a PHP script in the consolerelease directory that does not properly validate user input,...

Esri Portal For ArcGIS 跨站脚本漏洞

Esri Portal For ArcGIS is a component of Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site scripting vulnerability exists in Esri Portal For ArcGIS 11.4 and prior versions that originates from unvalidated...

Vasion Print Virtual Appliance Host 安全漏洞

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 25.1.102 that stems from the filegetcontents function not validating input, which could lead to credential disclosure and...

PT-2025-39865

Name of the Vulnerable Software and Affected Versions Esri Portal for ArcGIS versions 11.4 and below Description An unvalidated redirect issue exists in Esri Portal for ArcGIS. A remote, unauthenticated attacker can create a malicious URL that redirects a user to an arbitrary website, potentially...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

Vasion Print Virtual Appliance Host 安全漏洞

Vasion Print Virtual Appliance Host is a print management software from Vasion USA. A security vulnerability exists in Vasion Print Virtual Appliance Host versions prior to 25.1.102 that stems from a failure to validate or filter the $printervo-strhostaddress variable, which could lead to a...

PT-2025-39814

Name of the Vulnerable Software and Affected Versions Perfex CRM version 3.2.1 Description An HTML injection issue exists in Perfex CRM version 3.2.1. The issue is due to insufficient validation of user-supplied data. An attacker can inject HTML code by sending a POST request to the...

PT-2025-39915

Name of the Vulnerable Software and Affected Versions mkdocs-include-markdown-plugin versions prior to 7.1.8 Description The mkdocs-include-markdown-plugin has an issue where input validation is insufficient, potentially leading to collisions with substitution placeholders. This could allow for...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

The vulnerability of the clk component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the clk component in the Linux operating system’s kernel is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the x86/mm kernel component of the Linux operating system, which allows a hacker to cause a service failure

The vulnerability of the x86/mm kernel component of the Linux operating system is related to an unvalidated return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the dequeue_entities() function in the kernel/sched/fair.c component of the Linux operating system allows a attacker to trigger a service failure.

The vulnerability of the dequeueentities function in the kernel/sched/fair.c component of the Linux operating system is related to an unvalidated return value. Exploiting this vulnerability could allow a attacker to cause a service failure...

The vulnerability of the `cdns_mrvl_xspi_setup_clock()` function in the `drivers/spi/spi-cadence-xspi.c` component of the Linux kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the cdnsmrvlxspisetupclock function in the drivers/spi/spi-cadence-xspi.c component of the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause...