Exploit for Code Injection in Xwiki

📜 Description A critical RCE vulnerability exists in...

Exploit for Code Injection in Xwiki

CVE-2025-24893 – Unauthenticated Remote Code Execution in XWik...

CVE-2025-36605

Dell Unity, versions 5.5 and prior, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'. An unauthenticated attacker with remote access could...

CVE-2025-54571

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrate...

CVE-2025-54571

CVE-2025-54571 affects ModSecurity (WAF engine for Apache/IIS/Nginx). In versions 2.9.11 and earlier, an attacker could override the HTTP response Content-Type, enabling issues such as XSS and arbitrary script-source disclosure. The vulnerability is fixed in ModSecurity 2.9.12. Remediation: upgra...

CVE-2025-54571 ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrate...

CVE-2025-52892

EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes e.g https://domain//Admin and the webserver does not strip the double slash, it can cause ...

CVE-2025-52892

EspoCRM versions 9.1.6 and earlier are affected. If a user loads the SPA frontend with a URL containing a double slash (for example https://domain//#Admin) and the server does not strip it, the Slim router cache can be corrupted, rendering the instance unusable until a complete rebuild. This vuln...

CVE-2025-52892 EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache

EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes e.g https://domain//Admin and the webserver does not strip the double slash, it can cause ...

CVE-2025-52892 EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache

EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes e.g https://domain//Admin and the webserver does not strip the double slash, it can cause ...

CVE-2025-52892 EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache

EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes e.g https://domain//Admin and the webserver does not strip the double slash, it can cause ...

The vulnerability of the Django web application software, related to deficiencies in the error reporting mechanism, allows attackers to compromise the confidentiality of protected information.

The vulnerability of the Django web application framework is related to shortcomings in the error reporting mechanism. Exploiting this vulnerability allows an attacker to compromise the confidentiality of the information being protected...

PT-2025-31880 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM versions 9.1.6 and below Description: EspoCRM is a web application featuring a single-page application frontend and a PHP-based REST API backend. If a user accesses EspoCRM in a browser with double slashes e.g., https://domain//Admin...

PT-2025-31940 · Thinkphp3 · Thinkphp3

Name of the Vulnerable Software and Affected Versions: thinkphp3 version 3.2.5 Description: An issue in thinkphp3 allows a remote attacker to execute arbitrary code via the index.php component. This can be achieved through crafted template inclusion, requiring no login. Recommendations: Block...

Introducing DataTrap: A Smarter, More Adaptive Honeypot Framework

Today, we're excited to release DataTrap, a powerful, extensible honeypot system built to simulate realistic web applications, IoT devices, and database behavior across HTTP, HTTPS, SSH, and database protocols e.g., MySQL. What sets DataTrap apart? It goes beyond static honeypots by combining...

CVE-2025-8516

CVE-2025-8516 affects Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. The vulnerability is in BaseServiceFactory.getFileUploadService.deleteFileAction within K3Cloud\BBCMallSite\WEB-INF\lib\Kingdee.K3.O2O.Base.WebApp.jar!kingdee\k3\o2o\base\webapp\action\FileUploadAction.class of the IIS-K...

CVE-2025-5988

A flaw was found in the Ansible aap-gateway. Cross-site request forgery CSRF origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda. Mitigation Use HTTPS on the platform ingress if possible. Since this is a problem in edge-terminated...

📄 VX Guestbook 1.07 SQL Injection

VX Guestbook version 1.07 suffers from a remote SQL injection vulnerability. Exploit Title: VX Guestbook SQL Injection Authenticated Date: 2025-08-02 Exploit Author: tmrswrr Category : Webapps Vendor: https://phpversion.com/ Version 1.07 1. Access the Admin Panel: - Click Words Censor...

CVE-2025-45778

A stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field...

PT-2025-31720 · Partner · Partner Web Application +1

Name of the Vulnerable Software and Affected Versions: Partner Software's Partner Software application and Partner Web application affected versions not specified Description: The application does not completely sanitize input on the 'Notes' page when viewing a job, allowing an authenticated user...