Siemens SIMATIC PCS

SUMMARY Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Siemens has released new versions for the affected...

CVE-2025-46802

creationtimestamp| type| source ---|---|--- 2025-05-12 17:00:00+00:00| seen| https://security.opensuse.org/2025/05/12/screen-security-issues.html3b-tty-hijacking-while-attaching-to-a-multi-user-session-cve-2025-46802 2025-05-13 11:28:49+00:00| seen| https://news.ycombinator.com/item?id=43971716...

CVE-2025-46803

creationtimestamp| type| source ---|---|--- 2025-05-12 17:00:00+00:00| seen| https://security.opensuse.org/2025/05/12/screen-security-issues.html3b-tty-hijacking-while-attaching-to-a-multi-user-session-cve-2025-46802 2025-05-13 16:45:54+00:00| seen| https://t.me/proxybar/2615 2025-05-14...

PT-2025-20138 · Unknown · Scott Paterson Time Clock

Name of the Vulnerable Software and Affected Versions: Scott Paterson Time Clock versions 1.2.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables an attacker to inject...

CVE-2025-46815

ZITADEL Session API vulnerability (CVE-2025-46815) allows token/id reuse from idp intents prior to versions 3.0.0, 2.71.9, and 2.70.10. An attacker with URI access could obtain the id and token and authenticate on behalf of the user. MFA prevents full authentication, but this exposes a partial au...

Citrix Cloud VDIs hosted in Azure by Citrix Cloud shut down constantly with user sessions

When creating VDIs from a Master image that are rolled out with MCS into a Azure subscription - Users machines are constantly shutting down - Even when users are logged onto the machines, they consistently get shutdown after several minutes it can vary between 3-5 | 25-30 -The user will see a...

PT-2025-17092

Name of the Vulnerable Software and Affected Versions WooCommerce Estimate and Quote versions 1.0.2.5 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an attacker...

PT-2025-14952 · Unknown · Showeblogin Social

Name of the Vulnerable Software and Affected Versions: Showeblogin Social versions n/a through 7.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker could...

PT-2025-14435

Name of the Vulnerable Software and Affected Versions WPglob Auto scroll for reading versions n/a through 1.1.4 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-13719

Name of the Vulnerable Software and Affected Versions MiKa OSM – OpenStreetMap versions n/a through 6.1.6 Description The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious...

PT-2025-13275

Name of the Vulnerable Software and Affected Versions WooCommerce versions prior to 9.7.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables an attacker to inject malicious scripts...

PT-2025-12916

Name of the Vulnerable Software and Affected Versions UTM tags tracking for Contact Form 7 versions n/a through 2.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

GHSA-W6HH-W36C-VXMW LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality

mudler/localai version v2.21.1 contains a Cross-Site Scripting XSS vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts...

CVE-2024-9900

LocalAI (github.com/mudler/LocalAI) is affected by a Cross-Site Scripting (XSS) vulnerability in its search functionality. The CVE-2024-9900 entry cites v2.21.1 as vulnerable, due to improper sanitization of user input, enabling injection and execution of arbitrary JavaScript in the victim’s brow...

CVE-2025-0826

A stored Cross-site Scripting XSS vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session...

PT-2025-11354

Name of the Vulnerable Software and Affected Versions: WP Discord Post versions n/a through 2.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can injec...

Citrix - CSP Monthly Consumption licenses EOL

On 01-Mar-2025, Citrix Service Providers running License Server v11.17.2 build 51000 with a combination of certain types of licenses were unable to launch end user sessions. The impacted licenses were associated with a discontinued licensing offering. There were some cases where partners on the n...

CVE-2025-0423

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their...

CVE-2024-35049

SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590...

Siemens SIMATIC PCS neo, TIA Administrator, and TIA Portal

SUMMARY Affected products do not correctly invalidate user sessions upon user logout. This could allow a remote unauthenticated attacker, who has obtained the session token by other means, to re-use a legitimate user's session even after logout. Siemens has released new versions for several...