🚨 CVE-2025-34178
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
🎖@cveNotify
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
🎖@cveNotify
GitHub
Suricata: Fix various validation and encoding issues. Fixes #16414 · pfsense/FreeBSD-ports@97852cc
- Fix handling of files/hashes on suricata_filecheck.php
- Ensure suricata_ip_reputation.php is checking the proper path to iprep files
- Encode various outputs on suricata_flow_stream.php and
su...
- Ensure suricata_ip_reputation.php is checking the proper path to iprep files
- Encode various outputs on suricata_flow_stream.php and
su...
🚨 CVE-2025-11071
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
🎖@cveNotify
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
🎖@cveNotify
GitHub
Multiple SQL Injection Vulnerabilities in SeaCMS v13.3.20250820 · Issue #93 · Hebing123/cve
Summary SeaCMS v13.3.20250820 contains multiple SQL injection vulnerabilities in the admin panel's cron task management module (admin_cron.php). Details Root Causes Direct SQL Concatenation: Us...
🚨 CVE-2025-11138
A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
🎖@cveNotify
A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
🎖@cveNotify
GitHub
wenkucms V3.4 Background Remote Code Execution (RCE) · Issue #1 · electroN1chahaha/wenkucms-RCE
The environment setup is omitted. This vulnerability can only be exploited with an administrator account. You can download the source code in https://gitee.com/mirweiye/wenkucms/ Vulnerability Anal...
🚨 CVE-2024-44542
SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.
🎖@cveNotify
SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.
🎖@cveNotify
GitHub
GitHub - sshipanoo/CVE-2024-44542
Contribute to sshipanoo/CVE-2024-44542 development by creating an account on GitHub.
🚨 CVE-2025-0399
A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
GitHub
2 · Issue #3 · StarSea99/starsea-mall
基于springboot +thymeleaf 的小米商城管理系统. Contribute to StarSea99/starsea-mall development by creating an account on GitHub.
🚨 CVE-2025-0400
A vulnerability was found in StarSea99 starsea-mall 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/categories/update. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
A vulnerability was found in StarSea99 starsea-mall 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/categories/update. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
🎖@cveNotify
GitHub
4 · Issue #5 · StarSea99/starsea-mall
基于springboot +thymeleaf 的小米商城管理系统. Contribute to StarSea99/starsea-mall development by creating an account on GitHub.
🚨 CVE-2025-0698
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been classified as critical. Affected is an unknown function of the file /admin/sys/menu/list. The manipulation of the argument sort/order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
🎖@cveNotify
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been classified as critical. Affected is an unknown function of the file /admin/sys/menu/list. The manipulation of the argument sort/order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
🎖@cveNotify
GitHub
1 · Issue #19 · JoeyBling/bootplus
基于SpringBoot + Shiro + MyBatisPlus的权限管理框架. Contribute to JoeyBling/bootplus development by creating an account on GitHub.
🚨 CVE-2025-0699
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sys/role/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
🎖@cveNotify
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sys/role/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
🎖@cveNotify
GitHub
3 · Issue #21 · JoeyBling/bootplus
基于SpringBoot + Shiro + MyBatisPlus的权限管理框架. Contribute to JoeyBling/bootplus development by creating an account on GitHub.
🚨 CVE-2025-0700
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/sys/log/list. The manipulation of the argument logId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
🎖@cveNotify
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/sys/log/list. The manipulation of the argument logId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
🎖@cveNotify
GitHub
4 · Issue #22 · JoeyBling/bootplus
基于SpringBoot + Shiro + MyBatisPlus的权限管理框架. Contribute to JoeyBling/bootplus development by creating an account on GitHub.
🚨 CVE-2024-5413
A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/scheduled.php, all parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details.
🎖@cveNotify
A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/scheduled.php, all parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details.
🎖@cveNotify
www.incibe.es
Cross-Site Scripting Vulnerability in phpMyBackupPro
INCIBE has coordinated the publication of 3 high severity vulnerabilities affecting phpMyBackupPro, ve
🚨 CVE-2024-5414
A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/get_file.php, 'view' parameter. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details.
🎖@cveNotify
A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/get_file.php, 'view' parameter. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details.
🎖@cveNotify
www.incibe.es
Cross-Site Scripting Vulnerability in phpMyBackupPro
INCIBE has coordinated the publication of 3 high severity vulnerabilities affecting phpMyBackupPro, ve
🚨 CVE-2024-5415
A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details.
🎖@cveNotify
A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details.
🎖@cveNotify
www.incibe.es
Cross-Site Scripting Vulnerability in phpMyBackupPro
INCIBE has coordinated the publication of 3 high severity vulnerabilities affecting phpMyBackupPro, ve
🚨 CVE-2025-52886
Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.
🎖@cveNotify
Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.
🎖@cveNotify
GitLab
poppler 25.06.0 (04bd9168) · Commits · poppler / poppler · GitLab
freedesktop.org GitLab login
🚨 CVE-2025-45814
Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack.
🎖@cveNotify
Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack.
🎖@cveNotify
GitHub
my--cve-vulnerability-research/CVE-2025-45814 at main · shiky8/my--cve-vulnerability-research
This repository contains information on all of the CVEs I found. - shiky8/my--cve-vulnerability-research
🚨 CVE-2025-45813
ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.
🎖@cveNotify
ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.
🎖@cveNotify
GitHub
my--cve-vulnerability-research/CVE-2025-45813 at main · shiky8/my--cve-vulnerability-research
This repository contains information on all of the CVEs I found. - shiky8/my--cve-vulnerability-research
🚨 CVE-2025-45938
Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.
🎖@cveNotify
Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.
🎖@cveNotify
🚨 CVE-2024-4991
Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_pass/aksi_pass.php parameter in nama_lengkap. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.
🎖@cveNotify
Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_pass/aksi_pass.php parameter in nama_lengkap. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in SiAdmin
INCIBE has coordinated the publication of 3 vulnerabilities: 2 of critical severity and 1 of medium se
🚨 CVE-2024-4992
Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_kuliah/aksi_kuliah.php parameter in nim. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.
🎖@cveNotify
Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_kuliah/aksi_kuliah.php parameter in nim. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in SiAdmin
INCIBE has coordinated the publication of 3 vulnerabilities: 2 of critical severity and 1 of medium se
🚨 CVE-2024-4993
Vulnerability in SiAdmin 1.1 that allows XSS via the /show.php query parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and thereby steal their cookie session credentials.
🎖@cveNotify
Vulnerability in SiAdmin 1.1 that allows XSS via the /show.php query parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and thereby steal their cookie session credentials.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in SiAdmin
INCIBE has coordinated the publication of 3 vulnerabilities: 2 of critical severity and 1 of medium se
🚨 CVE-2024-8072
Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
🎖@cveNotify
Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users
🎖@cveNotify
Jfrog
Mage AI Terminal Server Infoleak | JFSA-2024-001039574
CVE-2024-8072, MEDIUM, Mage AI Terminal Server Infoleak
🚨 CVE-2024-45187
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server
🎖@cveNotify
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server
🎖@cveNotify
Jfrog
Mage AI deleted users RCE | JFSA-2024-001039602
CVE-2024-45187, HIGH, Mage AI deleted users RCE