The vulnerability of the amoCRM cloud-based customer relationship management system lies in the lack of measures taken to protect the website structure, allowing attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the amoCRM customer relationship management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the Briefcase Module component in the Zimbra Collaboration Suite email management system allows a attacker to perform XSS attacks.

The vulnerability of the Briefcase Module component in the Zimbra Collaboration Suite email management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2025-23756

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ivanchernyakov LawPress – Law Firm Website Management lawpress allows Reflected XSS.This issue affects LawPress – Law Firm Website Management: from n/a through = 1.4.5...

CVE-2025-24540 WordPress Website Builder by SeedProd plugin <= 6.18.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Cross Site Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through = 6.18.9...

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site. Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject in their site and run the script. By using...

Apple iOS和iPadOS 安全漏洞

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 18.3 and iPadOS version 18.3, which originates from a visit to a...

PT-2025-5068 · Lawpress · Lawpress

Name of the Vulnerable Software and Affected Versions: LawPress – Law Firm Website Management versions 1.4.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can...

CVE-2025-24361

The CVE-2025-24361 issue affects Nuxt (Vue.js) dev-server workflow: when using webpack (3.0.0–3.15.12) or rspack (3.12.2–3.152) builders, loading a malicious site can trigger source-code exposure. Attacker can use Function::toString on window.webpackChunknuxt_app values to reveal the Nuxt source....

CVE-2025-24361 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script b...

CVE-2025-24361 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script b...

Nuxt 安全漏洞

Nuxt is a free open source framework from Nuxt Open Source. A security vulnerability exists in Nuxt version 3.0.0 through versions prior to 3.15.3, which stems from a potential source code theft during development if a victim opens a malicious website...

WordPress InspiryThemes RealHomes Theme Privilege Escalation Vulnerability (Jan 2025)

The WordPress theme RealHomes by InspiryThemes is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

The vulnerability of the sub_422eb8 function in Linksys E8450 Wi-Fi router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the sub422eb8 function in Linksys E8450 Wi-Fi routers’ microprogramming software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

New Research: The State of Web Exposure 2025

Are your websites leaking sensitive data? New research reveals that 45% of third-party apps access user info without proper authorization, and 53% of risk exposures in Retail are due to the excessive use of tracking tools. Learn how to uncover and mitigate these hidden threats and risks—download...

The vulnerability of the Microsoft Update Catalog’s update website, related to deserialization mechanism flaws, allows attackers to escalate their privileges.

The vulnerability in the Microsoft Update Catalog’s update website is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Malicious code in passkeys-resources-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5256b8944e68915e19451b582ae574907838c2157234efe3f5290b6330ac3439 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24019

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager FPM on the host without any limitation on the filesystem's scope...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from the lack of protective measures for website structures, allowing attackers to trigger service interruptions.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from the redirection of the URL to an unreliable website, allowing attackers to carry out phishing attacks.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor to carry out phishing attacks remotely...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from the lack of protective measures for website structures, allowing attackers to execute arbitrary code.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...