WeGIA Cross-Site Scripting Vulnerability (CNVD-2025-17266)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the personalizacaoselecao.php endpoint nomecar parameter, for which no detailed vulnerability details are...

CVE-2025-7371

Okta On-Premises Provisioning OPP agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You...

A Premium Luggage Service’s Web Bugs Exposed the Travel Plans of Every User—Including Diplomats

Security flaws in Airportr, a door-to-door luggage checking service used by 10 airlines, let hackers access user data and even gain privileges that would have let them redirect or steal luggage...

Proton launches Lumo, a privacy-focused AI chatbot

Proton, known for its privacy focused set of services, announced the introduction of Lumo, a privacy-first Artificial Intelligence AI chatbot. It is good to know before you dive in that Proton’s chatbot has two user options that offer a very different experience. If you want Lumo to access the...

GHSA-H27M-3QW8-3PW8 Possible ORM Leak Vulnerability in the Harbor

Impact Administrator users on Harbor could exploit an ORM Leak https://www.elttam.com/blog/plormbing-your-django-orm/ vulnerability that was present in the /api/v2.0/users endpoint to leak users' password hash and salt values. This vulnerability was introduced into the application because the q U...

CVE-2025-6235

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

WordPress plugin Qwizcards 安全漏洞

WordPress Qwizcards plugin is a plugin for the WordPress platform that is mainly used to create online quiz question and answer test and flashcard flashcard content. WordPress Qwizcards plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective...

CVE-2025-7371

Okta On-Premises Provisioning OPP agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You...

CVE-2025-7371

Okta On-Premises Provisioning OPP agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You...

CVE-2025-7371

Okta On-Premises Provisioning OPP agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You...

Authorization Bypass Through User-Controlled Key

Overview in2code/femanager is a Modern TYPO3 Frontend User Registration. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the identity parameter when saving user-submitted data. An attacker can gain unauthorized access and modify sensitive...

CVE-2025-52580

Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. If exploited, sensitive user information may be exposed to an attacker who has access to the application logs...

📄 Microsoft Edge Cross Site Scripting Filter Bypass

Microsoft Edge cross site scripting filter bypass proof of concept exploit. Titles: Microsoft Edge XSS Filter Bypass PoC Author: nu11secur1ty Date: 2025-07-18 Vendor: Microsoft Software: Microsoft Edge Browser Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6176 Description Thi...

PT-2025-30435 · Okta · Okta On-Premises Provisioning Agent

Name of the Vulnerable Software and Affected Versions: Okta On-Premises Provisioning OPP agents versions 2.2.1 through 2.3.0 Description: Okta On-Premises Provisioning OPP agents log specific user data during administrator-initiated password resets. An attacker gaining access to the local servers...

World Leaks Claims Dell Data Breach, Leaks 1.3 TB of Files

Former Hunters International ransomware gang, now World Leaks, claims 1.3 TB Dell data breach, leaking over 400K files with internal tools and user data...

CVE-2025-6235

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235 ExtremeControl (NAC) 'onmouseover' XSS

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235 ExtremeControl (NAC) 'onmouseover' XSS

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2025-6235

CVE-2025-6235 affects ExtremeControl prior to 25.5.12, with an XSS in the login interface due to improper handling of user input in HTML attributes. The vulnerability can allow injected script to run in a user’s browser under certain interactions, potentially exposing user data or enabling unauth...

PT-2025-30330 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: Live Helper Chat version 4.60 Description: A stored cross-site scripting XSS vulnerability exists in Live Helper Chat version 4.60. This allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Telegra...