CVE-2025-46550

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the /?BazaR endpoint and idformulaire parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link...

CVE-2025-46350

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability...

CVE-2025-3859

Summary: CVE-2025-3859 affects Mozilla Firefox Focus for iOS (pre-138 builds). The vulnerability arises from a long URL truncation/eliding behavior in the address/location bar, which can mislead users into thinking they are on a different webpage. This is tied to the Firefox Focus/iOS truncation ...

The vulnerability in the virtual learning environment Moodle, related to the lack of protective measures for website structures, allows attackers to carry out XSS attacks.

The vulnerability in the virtual learning environment Moodle is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

The vulnerability of the Root Access Control component of the Totolink X2000R microprogramming system allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Root Access Control component of the Totolink X2000R microprogramming system for routers is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2025-46550

YesWiki

CVE-2025-46549 Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability...

CVE-2025-46549

YesWiki is a PHP-based wiki. The CVE-2025-46549/YesWiki vulnerability is a reflected cross-site scripting flaw present in YesWiki versions prior to 4.5.4, caused by insufficient sanitization of user input in the template parameter (endpoint: /?BazaR/bazariframe). An attacker can lure an authentic...

CVE-2025-3975

A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file /admin/subscriber-csv.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been...

Security Bulletin: IBM Robotic Process Automation is vulnerable to Clickjacking (CVE-2022-22503)

Summary IBM Robotic Process Automation could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks again...

CVE-2025-3975 ScriptAndTools eCommerce-website-in-PHP subscriber-csv.php information disclosure

A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file /admin/subscriber-csv.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been...

Malicious code in bytedmemfdd345 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19705d4db8178a4b1dd1282ded6d73256dc10b22125280c241524ec3e9e274af During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...

Malicious code in byted-torch-monitor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8c2b83888c7fcb79b930eaecb1a538d27a131ab415c0b756f84c7071d5a0935b During installation, a website with the current working dir is being called. It looks like something between spam and pentest as the website is most probably n...

Malicious code in startpeople-website (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-3416 Malicious code in startpeople-website (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in camel-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1098fc52f4799d50da4e83a966625fba756fb0f48d2f27f3fa9b966a972d035b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3282 Malicious code in camel-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1098fc52f4799d50da4e83a966625fba756fb0f48d2f27f3fa9b966a972d035b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the ColdFusion software platform, which arises due to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the ColdFusion software platform exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created link...

telecommunicationssystem.co.uk Cross Site Scripting vulnerability OBB-4048462

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

aymsyntex.com Improper Access Control vulnerability OBB-4048309

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...