Mars: [XSS] Reflected XSS via POST request in (███████)

A reflected Cross-Site Scripting XSS vulnerability was identified in the celular parameter of a POST request to the homepage of a Mars-owned website. The vulnerability was classified as medium severity with a CVSS score of 6.2. The application failed to properly sanitize user input before renderi...

CVE-2024-54780

Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting...

PT-2025-21167 · Opentext · Opentext Advance Authentication

Name of the Vulnerable Software and Affected Versions: OpenText Advance Authentication versions prior to 6.5 Description: The issue is related to improper input validation, which leads to a Cross-site Scripting XSS vulnerability. This type of vulnerability allows attackers to inject malicious...

CVE-2025-44024

Cross-Site Scripting XSS vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process...

SUSE SLES12 Security Update : gimp (SUSE-SU-2025:1546-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:1546-1 advisory. - CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write bsc1241691. Tenable has extracted the preceding...

Alibaba Cloud Linux 3 : 0130: python-reportlab (ALINUX3-SA-2023:0130)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0130 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2019-19450: paraparser in ReportLab before 3.5....

CVE-2024-54780

Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting...

CVE-2024-54780

Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting...

PT-2025-21159 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input. No information is provided about the estimated number of potentially affected devices or real-world incidents. Recommendations: At the...

CVE-2024-54780

CVE-2024-54780 affects Netgate pfSense CE (prior to 2.8.0 beta) and corresponding Plus builds. The vulnerability is a command-injection flaw in the OpenVPN widget caused by improper sanitization of user-supplied input to the OpenVPN management interface, enabling an authenticated attacker to inje...

CVE-2025-44024

Cross-Site Scripting XSS vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process...

uberAgent metrics for User Input Delay are not visible on Windows Server 2016

When utilizing uberAgent on Windows Server 2016, no metrics are received for User Input Delay...

WordPress Awesome Gallery plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Awesome Gallery plugin, which stems from the application's lack of effective filtering and escaping of user-supplied...

CVE-2025-44024

The CVE-2025-44024 entry concerns the Pichome system (v2.1.0 and earlier) with an XSS flaw in the login form caused by insufficient input sanitization. The vulnerable component is the login process where attacker-controlled inputs in the username or password fields can inject malicious JavaScript...

CVE-2024-51444

A vulnerability has been identified in Polarion V2310 All versions, Polarion V2404 All versions V2404.4. The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization...

CVE-2024-51444

A vulnerability has been identified in Polarion V2310 All versions, Polarion V2404 All versions V2404.4. The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization...

PT-2025-20894 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issu...

ROS-2-474

2.474 Denial of Service in Libxml2 CVE-2021-3541 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a denial of service DoS attack. The vulnerability exists due to insufficient validation of user input. A remote attacker can pass specially crafted input data to an...

Remote Code Execution (RCE)

craftcms/cms is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper sanitization of user input, allowing attackers to inject malicious code if they have administrator access and the ALLOWADMINCHANGES setting is enabled...

CVE-2025-2944

CVE-2025-2944 affects Jeg Elementor Kit (WordPress) up to v2.6.12. Vulnerability: Stored Cross-Site Scripting via Video Button and Countdown Widgets caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access at contributor...