12420 matches found
OpenID Connect 授权问题漏洞
OpenID Connect OIDC is a library open-sourced by XWiki Contrib. Makes XWiki a reusable identity provider for any application. An authorization issue vulnerability exists in OpenID Connect OIDC version 2.17.1 through versions prior to 2.18.2, which stems from a user with view privileges being able...
PT-2025-40889
Name of the Vulnerable Software and Affected Versions CmsEasy versions up to 7.7.7 Description A flaw exists in CmsEasy that may allow for cross site scripting. This issue affects an unknown function within the lib/inc/view.php component of the URL Handler. Manipulation of the PHP SELF argument c...
EUVD-2025-32480
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
PT-2025-40900
Name of the Vulnerable Software and Affected Versions XWiki versions 2.17.1 through 2.18.1 Description XWiki OpenID Connect OIDC contains tools for manipulating the OpenID Connect protocol. Individuals with VIEW access to a user profile can generate a token for that user in versions prior to...
BIT-PYTORCH-2025-55558
A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv and is compiled by Inductor, leading to a Denial of Service DoS...
SUSE CVE-2025-49641
A regular Zabbix user with no permission to the Monitoring - Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems...
Cross-site Scripting (XSS)
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Cross-site Scripting XSS via the workflow UI View Messages feature in the admin panel. An attacker can execute arbitrary JavaScript in the context of an administrator's browser by injecting a specially...
Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
Summary A stored Cross-Site Scripting XSS vulnerability in FlowiseAI allows a user to inject arbitrary JavaScript code via message input. When an administrator views messages using the "View Messages" button in the workflow UI, the malicious script executes in the context of the admin’s browser,...
GHSA-964P-J4GG-MHWC Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
Summary A stored Cross-Site Scripting XSS vulnerability in FlowiseAI allows a user to inject arbitrary JavaScript code via message input. When an administrator views messages using the "View Messages" button in the workflow UI, the malicious script executes in the context of the admin’s browser,...
CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party the target user, who can then view the...
EUVD-2023-48754
Malicious code in bioql PyPI...
EUVD-2025-23766
Malicious code in bioql PyPI...
EUVD-2025-29344
Malicious code in bioql PyPI...
EUVD-2022-53253
Malicious code in bioql PyPI...
EUVD-2024-51471
Malicious code in bioql PyPI...
EUVD-2021-33300
Malicious code in bioql PyPI...
EUVD-2021-31878
Malicious code in bioql PyPI...
EUVD-2025-26656
Malicious code in bioql PyPI...