PT-2025-18266 · Ctrlx Os · Ctrlx Os

Name of the Vulnerable Software and Affected Versions: ctrlX OS affected versions not specified Description: A vulnerability in the “Backup & Restore” functionality of the web application allows a remote authenticated low-privileged attacker to access secret information via multiple crafted HTTP...

PT-2025-18260 · Ctrlx Os · Ctrlx Os

Name of the Vulnerable Software and Affected Versions: ctrlX OS affected versions not specified Description: A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to manipulate the /etc/environment file via a crafted...

WordPress EduMall Theme <= 4.2.4 is vulnerable to Local File Inclusion

Software EduMall Type Theme Vulnerable versions = 4.2.4 Fixed in 4.3.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-2101 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID ce27fee25f49 Credits Tonn Required privilege Unauthenticated Published ...

CVE-2025-46538

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webplanetsoft Inline Text Popup inline-text-popup allows DOM-Based XSS.This issue affects Inline Text Popup: from n/a through = 1.0.0...

CVE-2025-46472

CVE-2025-46472 corresponds to a Stored XSS in WordPress The Pack Elementor addons, caused by improper input neutralization during web page generation. Affected versions are The Pack Elementor addons up to 2.1.2 (n/a to 2.1.2). The CVE has a CVSS v3.1 base score of 6.5 (Network attack, Low precisi...

Laravel < 5.6.30 RCE Vulnerability

Laravel is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:laravel:laravel"; ...

PT-2025-17830 · Unknown · Steve Availability Calendar

Name of the Vulnerable Software and Affected Versions: Steve Availability Calendar versions 0.2.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

The vulnerability of the SAP NetWeaver Application Server ABAP software integration platform, related to the lack of measures for cleaning input data, allows attackers to execute cross-site scripting attacks (XSS).

The vulnerability of the software for developing and executing applications in the ABAP language of SAP NetWeaver Application Server is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS...

The AI-Powered Reboot: Rethinking Defense for Web Apps and APIs

...

NetScaler-13.1- Missing Web App Firewall Logs in NetScaler

Missing Web App Firewall Logs in NetScaler...

CVE-2025-43949

MuM aka Mensch und Maschine MapEdit aka mapedit-web 24.2.3 is vulnerable to SQL Injection that allows an attacker to execute malicious SQL statements that control a web application's database server...

[SECURITY] Fedora 41 Update: python-notebook-7.4.0-1.fc41

The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...

[SECURITY] Fedora 42 Update: python-notebook-7.4.0-1.fc42

The Jupyter Notebook is a web application that allows you to create and share documents that contain live code, equations, visualizations, and explanatory text. The Notebook has support for multiple programming languages, sharing, and interactive widgets...

CVE-2025-3827

A vulnerability has been found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2025-12796)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content...

Fortinet FortiWeb Path Traversal Vulnerability

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

CVE-2025-39567

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through = 1.7.8...

CVE-2025-27293 WordPress Shipmozo Courier Tracking plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webparexapp Shipmozo Courier Tracking webparex allows Reflected XSS.This issue affects Shipmozo Courier Tracking: from n/a through = 1.0...

PT-2025-16972 · Unknown · Studio Hyperset The Great Firewords Of China

Name of the Vulnerable Software and Affected Versions: Studio Hyperset The Great Firewords of China versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an...

PT-2025-17088 · Unknown · Commotion Course Booking System

Name of the Vulnerable Software and Affected Versions: ComMotion Course Booking System versions n/a through 6.0.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...