12188 matches found
GHSA-X3HX-CH7P-8XGG Mattermost allows regular users to access archived channel content and files
Mattermost versions 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads...
CVE-2025-41436 Unauthorized access to archived channel content via threads interface
Mattermost versions 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads...
Devolutions Server <= 2025.2.15.0 / 2025.3.2.0 <= 2025.3.5.0 Multiple Vulnerabilities (DEVO-2025-0016)
The version of Devolutions Server installed on the remote host is prior to 2025.2.17.0, or 2025.3.x prior to 2025.3.6.0, and is, therefore, affected by multiple vulnerabilities: - Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged...
PT-2025-46990
Name of the Vulnerable Software and Affected Versions CodeAstro Gym Management System version 1.0 Description A security flaw exists in CodeAstro Gym Management System version 1.0. The issue involves a SQL injection impacting an unknown function within the /admin/view-member-report.php file...
CodeAstro Gym Management System SQL注入漏洞
Gym Management System is a gym management system from SourceCodester. A SQL injection vulnerability exists in version 1.0 of the Gym Management System, which stems from incorrect manipulation of the parameter ID in the file /admin/view-member-report.php, which could lead to a SQL injection attack...
EUVD-2025-175359
Vega Cross-Site Scripting XSS via expressions abusing toString calls in environments using the VEGADEBUG global variable...
Cross-site Scripting (XSS)
Overview vega is a library that implements Vega visualization grammar. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the toString function in environments where the VEGADEBUG global variable is present. An attacker can execute arbitrary JavaScript code by...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the toString function in environments where the VEGADEBUG global variable is present. An attacker can execute arbitrary JavaScript code by supplying crafted Vega JSON definitions that abuse expression...
Cross-site Scripting (XSS)
Overview org.webjars.npm:vega-interpreter is a WebJar for vega-interpreter. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the toString function in environments where the VEGADEBUG global variable is present. An attacker can execute arbitrary JavaScript code by...
CVE-2025-13060
A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /viewsurvey.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and m...
6 Best CTEM Vendors: A Head-to-Head Comparison
Your team just ran a vulnerability scan and now you’re staring at a list of thousands of CVEs. The big question is, what do you fix first? Relying on CVSS scores alone doesn’t tell you which of these vulnerabilities are actually exploitable in your environment or which ones protect your most...
EUVD-2025-179690
Malicious code in cluster-wind-fork-view-monitor npm...
EUVD-2025-178383
Malicious code in integer-kappa-sigma-double-view npm...
EUVD-2025-176173
Malicious code in stub-emulate-decompress-view-sandbox npm...
EUVD-2025-175847
Malicious code in uglify-view-stub-simulate-short npm...
EUVD-2025-175723
Malicious code in view-warn-bash-rain-old npm...
EUVD-2025-178824
Malicious code in function-iota-sanitize-view-old npm...
Malicious code in cluster-wind-fork-view-monitor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5047c654c3a5d136a00aaba828d7028a4483a1b72fb55a1d2ffff40fcb45f3ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...