Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2025-43754: Observable Timing Discrepancy

Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the...

CVE-2025-9237

A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/myaccount.php?editaccount of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the...

CVE-2025-9237

A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/myaccount.php?editaccount of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the...

CVE-2025-9237 CodeAstro Ecommerce Website Edit Your Account my_account.php cross site scripting

A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/myaccount.php?editaccount of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the...

CVE-2025-9237 CodeAstro Ecommerce Website Edit Your Account my_account.php cross site scripting

A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/myaccount.php?editaccount of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the...

CVE-2025-9237

CodeAstro Ecommerce Website 1.0 is affected by a cross-site scripting (XSS) issue in the Edit Your Account Page, specifically via manipulation of the Username parameter in /customer/my_account.php?edit_account. The vulnerability originates from an unknown function in that page; exploitation can b...

PT-2025-34140 · Codeastro · Codeastro Ecommerce Site

Name of the Vulnerable Software and Affected Versions: CodeAstro Ecommerce Website version 1.0 Description: A vulnerability exists in CodeAstro Ecommerce Website 1.0 that allows for cross-site scripting. The issue is located in an unknown function of the /customer/my account.php?edit account file...

CodeAstro Ecommerce Website 安全漏洞

CodeAstro Ecommerce Website is an e-commerce website from CodeAstro, Inc. A security vulnerability exists in CodeAstro Ecommerce Website version 1.0, which originates from a cross-site scripting attack due to an incorrect manipulation of the parameter Username in the file /customer/myaccount.php...

CVE-2025-9237: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/myaccount.php?editaccount of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the...

CVE-2025-54411 Discourse welcome banner user name XSS

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...

Timing Side-channel Attacks

github.com/hashicorp/vault is vulnerable to Timing side-channel Attacks. The vulnerability is due to differences in response timing in the Userpass auth method, which allows an attacker to distinguish between valid and invalid usernames and potentially enumerate existing accounts...

CVE-2025-41685

A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address...

CVE-2025-41685 SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user

A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address...

CVE-2025-41685

CVE-2025-41685 affects Sunny Portal. A low-privileged remote attacker can obtain the username of another registered user by entering that user’s email address. The description and related sources consistently report a limited disclosure of personal data (username) without detailing a fix in the p...

CVE-2025-41685 SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user

A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address...

PT-2025-33715 · Sma Solar Technology · Sunny Portal

Name of the Vulnerable Software and Affected Versions: Sunny Portal affected versions not specified Description: A low-privileged remote attacker can obtain the username of another registered user by entering that user's email address. Recommendations: At the moment, there is no information about...

CVE-2025-41685: Exposure of Private Personal Information to an Unauthorized Actor

A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address...

VulnCheck KEV: CVE-2018-7282

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from a cross-site scripting attack in which an unescaped username string is...