CVE-2025-59053 AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE

AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the packages/stage-ui/src/components/MarkdownRenderer.vue path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An...

Chromium: CVE-2025-10200 Use after free in Serviceworker

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

SAP Fiori App Manage Work Center Groups Cross-Site Request Forgery Vulnerability

SAP Fiori App Manage Work Center Groups is an enterprise application from SAP with the ability to manage and maintain work center groups. A cross-site request forgery vulnerability exists in SAP Fiori App Manage Work Center Groups, which stems from insufficient CSRF protection and can be exploite...

CVE-2025-43785

Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 2024.Q1.12, and 7.4 update 45 through update 92 allows remote attackers to execute an arbitrary web script or HTML in the My Workflow Tasks pa...

CVE-2025-7746

CVE-2025-7746 is a Cross-site Scripting (CWE-79) vulnerability in Schneider Electric ATV series (e.g., ATV340E, ATV6000/ATV6x, ATS490 Soft Starter, and related Altivar Drive/Module products). The root cause is improper neutralization of input during web page generation, allowing unvalidated data ...

SAP NetWeaver ABAP Platform 跨站脚本漏洞

SAP NetWeaver ABAP Platform is an all-in-one technology platform from SAP. SAP NetWeaver ABAP Platform suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execu...

PT-2025-36561

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Platform affected versions not specified Description: The SAP NetWeaver ABAP Platform is susceptible to a Cross-Site Scripting XSS issue. An unauthenticated attacker can create a malicious link and, upon a user clicking it,...

uverif 安全漏洞

uverif is a free and open source web authentication management system from uverif. A security vulnerability exists in uverif 3.2 and earlier versions, which stems from SQL injection due to incorrect manipulation of the parameter note of the function addbatch in the file /admin/kamilist...

PT-2025-36909

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.128 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2024.Q2.0 through 2024.Q2.12 Liferay DXP versions 2024.Q3.0 through 2024.Q3.5 Description: A stored cross-site scripting XS...

CVE-2025-53838

LinkAce (prior to 2.1.9) is affected by a stored XSS vulnerability due to insufficient filtering/escaping of user-supplied data in link attributes. An attacker can save malicious JavaScript in the database, which executes in a user’s browser when a crafted link is clicked (one-click XSS). The iss...

advisory-db

This is a security advisory database for Rust crates published through crates.io. The database is maintained by the RustSec project and contains information on security vulnerabilities in various Rust crates. The database is stored in TOML format and can be consumed by various tools for auditing...

CVE-2025-41057

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/richtexteditor...

xss

This is a web application for a free online web and mobile security class, Hacker101. The application is built using Jekyll, a static site generator, and is hosted on GitHub Pages. The site provides a variety of resources, including videos, resources, and a CTF Capture The Flag section. The...

WordPress plugin Indutri 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in...

A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

...

CVE-2025-3701

Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Malcure Malware Scanner: from n/a through = 16.8...

Akinsoft ProKuaför 跨站脚本漏洞

Akinsoft ProKuafor is an online appointment and client management platform from Akinsoft Turkey. Cross-site scripting vulnerability exists in Akinsoft ProKuafor versions prior to s1.02.07 to v1.02.08, no detailed vulnerability details are available at this time...

Telesquare TLR-2005Ksh 安全漏洞

The Telesquare TLR-2005Ksh is a wireless router from the South Korean company Telesquare. A security vulnerability exists in Telesquare TLR-2005Ksh version 1.2.4, which originates from a command injection attack due to misuse of the parameter Hostname in the file /cgi-bin/internet.cgi...

Apartment Management System add_maintenance_cost.php File SQL Injection Vulnerability

Apartment Management System is an apartment management system. Apartment Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements for parameter ID in file /maintenance/addmaintenancecost.php. An attacker can exploit thi...

CVE-2025-57217

Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 contains a stack overflow in the R7WebsSecurityHandler when processing the Password parameter, leading to a potential denial-of-service. The issue is confirmed across multiple sources (CNVD/CNNVD/Red Hat/NVD entries) with no explicit exploitation ...