Instruction: Please provide detailed information about CVE-2025-0335

CVE:CVE-2025-0335
Description:A vulnerability was found in code-projects Online Bike Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component Change Image Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other endpoints might be affected as well.
published:2025-01-09T06:15:15.850


Instruction: Please provide detailed information about CVE-2025-0336

CVE:CVE-2025-0336
Description:A vulnerability was found in Codezips Project Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pages/forms/teacher.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T07:15:27.860


Instruction: Please provide detailed information about CVE-2025-0339

CVE:CVE-2025-0339
Description:A vulnerability classified as problematic has been found in code-projects Online Bike Rental 1.0. Affected is an unknown function of the file /vehical-details.php of the component HTTP GET Request Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely.
published:2025-01-09T07:15:28.080


Instruction: Please provide detailed information about CVE-2025-0340

CVE:CVE-2025-0340
Description:A vulnerability classified as critical was found in code-projects Cinema Seat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/deleteBooking.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T07:15:28.260


Instruction: Please provide detailed information about CVE-2025-20033

CVE:CVE-2025-20033
Description:Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.
published:2025-01-09T07:15:28.450


Instruction: Please provide detailed information about CVE-2025-22445

CVE:CVE-2025-22445
Description:Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.
published:2025-01-09T07:15:28.617


Instruction: Please provide detailed information about CVE-2025-22449

CVE:CVE-2025-22449
Description:Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.
published:2025-01-09T07:15:28.777


Instruction: Please provide detailed information about CVE-2025-0341

CVE:CVE-2025-0341
Description:A vulnerability, which was classified as critical, has been found in CampCodes Computer Laboratory Management System 1.0. Affected by this issue is some unknown functionality of the file /class/edit/edit. The manipulation of the argument e_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T08:15:30.060


Instruction: Please provide detailed information about CVE-2025-0342

CVE:CVE-2025-0342
Description:A vulnerability, which was classified as problematic, was found in CampCodes Computer Laboratory Management System 1.0. This affects an unknown part of the file /class/edit/edit. The manipulation of the argument s_lname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-01-09T08:15:30.310


Instruction: Please provide detailed information about CVE-2025-0344

CVE:CVE-2025-0344
Description:A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /commpara/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T08:15:30.517


Instruction: Please provide detailed information about CVE-2025-0345

CVE:CVE-2025-0345
Description:A vulnerability was found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this issue is the function listData of the file /sys/menu/listData. The manipulation of the argument order leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T09:15:09.220


Instruction: Please provide detailed information about CVE-2025-0346

CVE:CVE-2025-0346
Description:A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/publishnews.php of the component Publish News Page. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T09:15:09.393


Instruction: Please provide detailed information about CVE-2025-0347

CVE:CVE-2025-0347
Description:A vulnerability was found in code-projects Admission Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php of the component Login. The manipulation of the argument u_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T10:15:07.170


Instruction: Please provide detailed information about CVE-2025-0348

CVE:CVE-2025-0348
Description:A vulnerability was found in CampCodes DepEd Equipment Inventory System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /data/add_employee.php. The manipulation of the argument data leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-09T10:15:07.700


Instruction: Please provide detailed information about CVE-2025-0349

CVE:CVE-2025-0349
Description:A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src/mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-01-09T11:15:16.547


Instruction: Please provide detailed information about CVE-2025-22295

CVE:CVE-2025-22295
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through 8.0.5.
published:2025-01-09T16:16:25.140


Instruction: Please provide detailed information about CVE-2025-22307

CVE:CVE-2025-22307
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeAstrology Team Product Table for WooCommerce allows Reflected XSS.This issue affects Product Table for WooCommerce: from n/a through 3.5.6.
published:2025-01-09T16:16:25.347


Instruction: Please provide detailed information about CVE-2025-22313

CVE:CVE-2025-22313
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through 3.0.
published:2025-01-09T16:16:25.653


Instruction: Please provide detailed information about CVE-2025-22330

CVE:CVE-2025-22330
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Parallax Slider allows Reflected XSS.This issue affects MG Parallax Slider: from n/a through 1.0..
published:2025-01-09T16:16:25.840


Instruction: Please provide detailed information about CVE-2025-22331

CVE:CVE-2025-22331
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in P3JX Cf7Save Extension allows Reflected XSS.This issue affects Cf7Save Extension: from n/a through 1.
published:2025-01-09T16:16:26.180


Instruction: Please provide detailed information about CVE-2025-22345

CVE:CVE-2025-22345
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tobias Spiess TS Comfort DB allows Reflected XSS.This issue affects TS Comfort DB: from n/a through 2.0.7.
published:2025-01-09T16:16:26.620


Instruction: Please provide detailed information about CVE-2025-22361

CVE:CVE-2025-22361
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics allows Reflected XSS.This issue affects Opentracker Analytics: from n/a through 1.3.
published:2025-01-09T16:16:26.830


Instruction: Please provide detailed information about CVE-2025-22504

CVE:CVE-2025-22504
Description:Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through 0.2.18.
published:2025-01-09T16:16:27.110


Instruction: Please provide detailed information about CVE-2025-22505

CVE:CVE-2025-22505
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabaraj Chapagain NC Wishlist for Woocommerce allows SQL Injection.This issue affects NC Wishlist for Woocommerce: from n/a through 1.0.1.
published:2025-01-09T16:16:27.280


Instruction: Please provide detailed information about CVE-2025-22508

CVE:CVE-2025-22508
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roninwp FAT Event Lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through 1.1.
published:2025-01-09T16:16:27.433


Instruction: Please provide detailed information about CVE-2025-22510

CVE:CVE-2025-22510
Description:Deserialization of Untrusted Data vulnerability in Konrad Karpieszuk WC Price History for Omnibus allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through 2.1.4.
published:2025-01-09T16:16:27.590


Instruction: Please provide detailed information about CVE-2025-22521

CVE:CVE-2025-22521
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a through 2.18.8.
published:2025-01-09T16:16:27.743


Instruction: Please provide detailed information about CVE-2025-22527

CVE:CVE-2025-22527
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv allows SQL Injection.This issue affects Mailing Group Listserv: from n/a through 2.0.9.
published:2025-01-09T16:16:27.890


Instruction: Please provide detailed information about CVE-2025-22535

CVE:CVE-2025-22535
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jonathan Kern WPListCal allows SQL Injection.This issue affects WPListCal: from n/a through 1.3.5.
published:2025-01-09T16:16:28.047


Instruction: Please provide detailed information about CVE-2025-22537

CVE:CVE-2025-22537
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in traveller11 Google Maps Travel Route allows SQL Injection.This issue affects Google Maps Travel Route: from n/a through 1.3.1.
published:2025-01-09T16:16:28.210


Instruction: Please provide detailed information about CVE-2025-22539

CVE:CVE-2025-22539
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ka2 Custom DataBase Tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through 2.1.34.
published:2025-01-09T16:16:28.350


Instruction: Please provide detailed information about CVE-2025-22540

CVE:CVE-2025-22540
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sebastian Orellana Emailing Subscription allows Blind SQL Injection.This issue affects Emailing Subscription: from n/a through 1.4.1.
published:2025-01-09T16:16:28.503


Instruction: Please provide detailed information about CVE-2025-22542

CVE:CVE-2025-22542
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ofek Nakar Virtual Bot allows Blind SQL Injection.This issue affects Virtual Bot: from n/a through 1.0.0.
published:2025-01-09T16:16:28.670


Instruction: Please provide detailed information about CVE-2025-22561

CVE:CVE-2025-22561
Description:Missing Authorization vulnerability in Jason Funk Title Experiments Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Title Experiments Free: from n/a through 9.0.4.
published:2025-01-09T16:16:28.827


Instruction: Please provide detailed information about CVE-2025-22594

CVE:CVE-2025-22594
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder – Sándor Fodor Better User Shortcodes allows Reflected XSS.This issue affects Better User Shortcodes: from n/a through 1.0.
published:2025-01-09T16:16:28.983


Instruction: Please provide detailed information about CVE-2025-22595

CVE:CVE-2025-22595
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja Mailing Group Listserv allows Reflected XSS.This issue affects Mailing Group Listserv: from n/a through 2.0.9.
published:2025-01-09T16:16:29.160


Instruction: Please provide detailed information about CVE-2025-22801

CVE:CVE-2025-22801
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Free WooCommerce Theme 99fy Extension allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through 1.2.8.
published:2025-01-09T16:16:29.323


Instruction: Please provide detailed information about CVE-2025-22802

CVE:CVE-2025-22802
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through 2.1.4.
published:2025-01-09T16:16:29.470


Instruction: Please provide detailed information about CVE-2025-22803

CVE:CVE-2025-22803
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through 1.1.4.
published:2025-01-09T16:16:29.627


Instruction: Please provide detailed information about CVE-2025-22804

CVE:CVE-2025-22804
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through 2.1.23.
published:2025-01-09T16:16:29.787


Instruction: Please provide detailed information about CVE-2025-22805

CVE:CVE-2025-22805
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePoints Skill Bar allows Stored XSS.This issue affects Skill Bar: from n/a through 1.2.
published:2025-01-09T16:16:29.937


Instruction: Please provide detailed information about CVE-2025-22806

CVE:CVE-2025-22806
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allows DOM-Based XSS.This issue affects Black Widgets For Elementor: from n/a through 1.3.8.
published:2025-01-09T16:16:30.090


Instruction: Please provide detailed information about CVE-2025-22807

CVE:CVE-2025-22807
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Responsive Flickr Slideshow allows Stored XSS.This issue affects Responsive Flickr Slideshow: from n/a through 2.6.0.
published:2025-01-09T16:16:30.253


Instruction: Please provide detailed information about CVE-2025-22808

CVE:CVE-2025-22808
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through 9.0.
published:2025-01-09T16:16:30.403


Instruction: Please provide detailed information about CVE-2025-22809

CVE:CVE-2025-22809
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravity Master PDF Catalog Woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through 2.0.
published:2025-01-09T16:16:30.557


Instruction: Please provide detailed information about CVE-2025-22810

CVE:CVE-2025-22810
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CBB Team Content Blocks Builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through 2.7.6.
published:2025-01-09T16:16:30.713


Instruction: Please provide detailed information about CVE-2025-22811

CVE:CVE-2025-22811
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modeltheme MT Addons for Elementor allows Stored XSS.This issue affects MT Addons for Elementor: from n/a through 1.0.6.
published:2025-01-09T16:16:30.880


Instruction: Please provide detailed information about CVE-2025-22812

CVE:CVE-2025-22812
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs News Ticker Widget for Elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/a through 1.3.2.
published:2025-01-09T16:16:31.047


Instruction: Please provide detailed information about CVE-2025-22813

CVE:CVE-2025-22813
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ChatBot for WordPress - WPBot Conversational Forms for ChatBot allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through 1.4.2.
published:2025-01-09T16:16:31.200


Instruction: Please provide detailed information about CVE-2025-22814

CVE:CVE-2025-22814
Description:Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through 1.4.1.
published:2025-01-09T16:16:31.370


Instruction: Please provide detailed information about CVE-2025-22815

CVE:CVE-2025-22815
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LLC Button Block allows Stored XSS.This issue affects Button Block: from n/a through 1.1.6.
published:2025-01-09T16:16:31.543


Instruction: Please provide detailed information about CVE-2025-22817

CVE:CVE-2025-22817
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra allows Stored XSS.This issue affects BP Profile Shortcodes Extra: from n/a through 2.6.0.
published:2025-01-09T16:16:31.693


Instruction: Please provide detailed information about CVE-2025-22818

CVE:CVE-2025-22818
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor Integration: from n/a through 4.2.1.
published:2025-01-09T16:16:31.850


Instruction: Please provide detailed information about CVE-2025-22819

CVE:CVE-2025-22819
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 4wpbari Qr Code and Barcode Scanner Reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through 1.0.0.
published:2025-01-09T16:16:32.000


Instruction: Please provide detailed information about CVE-2025-22820

CVE:CVE-2025-22820
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Walmsley VR Views allows Stored XSS.This issue affects VR Views: from n/a through 1.5.1.
published:2025-01-09T16:16:32.173


Instruction: Please provide detailed information about CVE-2025-22821

CVE:CVE-2025-22821
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vfthemes StorePress allows DOM-Based XSS.This issue affects StorePress: from n/a through 1.0.12.
published:2025-01-09T16:16:32.363


Instruction: Please provide detailed information about CVE-2025-22822

CVE:CVE-2025-22822
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bishawjit Das wp custom countdown allows Stored XSS.This issue affects wp custom countdown: from n/a through 2.8.
published:2025-01-09T16:16:32.557


Instruction: Please provide detailed information about CVE-2025-22823

CVE:CVE-2025-22823
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Twerdy Genesis Style Shortcodes allows DOM-Based XSS.This issue affects Genesis Style Shortcodes: from n/a through 1.0.
published:2025-01-09T16:16:32.717


Instruction: Please provide detailed information about CVE-2025-22824

CVE:CVE-2025-22824
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lucia Intelisano Live Flight Radar allows Stored XSS.This issue affects Live Flight Radar: from n/a through 1.0.
published:2025-01-09T16:16:32.893


Instruction: Please provide detailed information about CVE-2025-22826

CVE:CVE-2025-22826
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce, wp.insider Sell Digital Downloads allows Stored XSS.This issue affects Sell Digital Downloads: from n/a through 2.2.7.
published:2025-01-09T16:16:33.047


Instruction: Please provide detailed information about CVE-2025-22827

CVE:CVE-2025-22827
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joomag. WP Joomag allows DOM-Based XSS.This issue affects WP Joomag: from n/a through 2.5.2.
published:2025-01-09T16:16:33.200


Instruction: Please provide detailed information about CVE-2025-21592

CVE:CVE-2025-21592
Description:An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system.  Through the execution of either 'show services advanced-anti-malware' or 'show services security-intelligence' command, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.   This issue affects Junos OS SRX Series:      *  All versions before 21.4R3-S8,    *  from 22.2 before 22.2R3-S5,    *  from 22.3 before 22.3R3-S3,   *  from 22.4 before 22.4R3-S2,    *  from 23.2 before 23.2R2-S1,    *  from 23.4 before 23.4R2.
published:2025-01-09T17:15:18.203


Instruction: Please provide detailed information about CVE-2025-21593

CVE:CVE-2025-21593
Description:An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS).  On devices with SRv6 (Segment Routing over IPv6) enabled, an attacker can send a malformed BGP UPDATE packet which will cause the rpd to crash and restart. Continued receipt of these UPDATE packets will cause a sustained DoS condition.   This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.This issue affects Junos OS:       *  All versions before 21.2R3-S9,    *  from 21.4 before 21.4R3-S10,    *  from 22.2 before 22.2R3-S5,    *  from 22.3 before 22.3R3-S4,    *  from 22.4 before 22.4R3-S3,    *  from 23.2 before 23.2R2-S2,    *  from 23.4 before 23.4R2;    and Junos OS Evolved:       *  All versions before 21.2R3-S9-EVO,    *  from 21.4-EVO before 21.4R3-S10-EVO,    *  from 22.2-EVO before 22.2R3-S5-EVO,    *  from 22.3-EVO before 22.3R3-S4-EVO,    *  from 22.4-EVO before 22.4R3-S3-EVO,   *  from 23.2-EVO before 23.2R2-S2-EVO,    *  from 23.4-EVO before 23.4R2-EVO.
published:2025-01-09T17:15:18.380


Instruction: Please provide detailed information about CVE-2025-21596

CVE:CVE-2025-21596
Description:An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem' command to cause the chassis daemon (chassisd) to crash and restart, resulting in a temporary Denial of Service (DoS). However, repeated execution of this command will eventually cause the chassisd process to fail to restart, impacting packet processing on the system.  This issue affects Junos OS on SRX1500, SRX4100, SRX4200:       *  All versions before 21.4R3-S9,    *  from 22.2 before 22.2R3-S5,    *  from 22.3 before 22.3R3-S4,    *  from 22.4 before 22.4R3-S4,    *  from 23.2 before 23.2R2-S3,    *  from 23.4 before 23.4R2-S1.
published:2025-01-09T17:15:18.593


Instruction: Please provide detailed information about CVE-2025-21599

CVE:CVE-2025-21599
Description:A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Tunnel Driver (jtd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause Denial of Service.   Receipt of specifically malformed IPv6 packets, destined to the device, causes kernel memory to not be freed, resulting in memory exhaustion leading to a system crash and Denial of Service (DoS). Continuous receipt and processing of these packets will continue to exhaust kernel memory, creating a sustained Denial of Service (DoS) condition. This issue only affects systems configured with IPv6.  This issue affects Junos OS Evolved:       *  from 22.4-EVO before 22.4R3-S5-EVO,    *  from 23.2-EVO before 23.2R2-S2-EVO,    *  from 23.4-EVO before 23.4R2-S2-EVO,    *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.     This issue does not affect Juniper Networks Junos OS Evolved versions prior to 22.4R1-EVO.
published:2025-01-09T17:15:18.770


Instruction: Please provide detailed information about CVE-2025-21600

CVE:CVE-2025-21600
Description:An Out-of-Bounds Read vulnerability in  the routing protocol daemon (rpd) of    Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.    This issue only affects systems configured in       either of two ways:                    *  systems with BGP traceoptions enabled          *  systems with BGP family traffic-engineering (BGP-LS)           configured    and can be exploited from a directly connected and configured BGP peer.   This issue affects iBGP and eBGP   with   any address family   configured, and both IPv4 and IPv6 are affected by this vulnerability.  This issue affects:  Junos OS:       *    from 21.4 before 21.4R3-S9,    *  from 22.2 before 22.2R3-S5,    *  from 22.3 before 22.3R3-S4,    *  from 22.4 before 22.4R3-S5,    *  from 23.2 before 23.2R2-S3,    *  from 23.4 before 23.4R2-S3,    *  from 24.2 before 24.2R1-S2, 24.2R2;      Junos OS Evolved:       *  from 21.4-EVO before 21.4R3-S9-EVO,    *  from 22.2-EVO before 22.2R3-S5-EVO,    *  from 22.3-EVO before 22.3R3-S4-EVO,    *  from 22.4-EVO before 22.4R3-S5-EVO,    *  from 23.2-EVO before 23.2R2-S3-EVO,    *  from 23.4-EVO before 23.4R2-S2-EVO,    *  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.   This issue does not affect versions of Junos OS prior to 21.3R1.   This issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.    This is a similar, but different vulnerability than the issue reported as CVE-2024-39516.
published:2025-01-09T17:15:18.960


Instruction: Please provide detailed information about CVE-2025-21602

CVE:CVE-2025-21602
Description:An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS).   Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.  This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.  This issue affects Junos OS:       *  from 21.4 before 21.4R3-S9,    *  from 22.2 before 22.2R3-S5,    *  from 22.3 before 22.3R3-S4,   *  from 22.4 before 22.4R3-S5,    *  from 23.2 before 23.2R2-S3,    *  from 23.4 before 23.4R2-S3,    *  from 24.2 before 24.2R1-S2, 24.2R2;    This issue does not affect versions prior to 21.1R1.      Junos OS Evolved:       *  from 21.4 before 21.4R3-S9-EVO,    *  from 22.2 before 22.2R3-S5-EVO,    *  from 22.3 before 22.3R3-S4-EVO,   *  from 22.4 before 22.4R3-S5-EVO,    *  from 23.2 before 23.2R2-S3-EVO,    *  from 23.4 before 23.4R2-S3-EVO,    *  from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.   This issue does not affect versions prior to 21.1R1-EVO
published:2025-01-09T17:15:19.150


Instruction: Please provide detailed information about CVE-2025-21628

CVE:CVE-2025-21628
Description:Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by adding a tautological WHERE clause. This issue is patched with v3.16.0.
published:2025-01-09T18:15:30.070


Instruction: Please provide detailed information about CVE-2025-22149

CVE:CVE-2025-22149
Description:JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the HTTPClientStorageOptions.RefreshInterval to zero (or not specifying the value).
published:2025-01-09T18:15:30.233


Instruction: Please provide detailed information about CVE-2025-21598

CVE:CVE-2025-21598
Description:An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd. This issue affects:  Junos OS:       *  from 21.2R3-S8 before 21.2R3-S9,    *  from 21.4R3-S7 before 21.4R3-S9,    *  from 22.2R3-S4 before 22.2R3-S5,    *  from 22.3R3-S2 before 22.3R3-S4,    *  from 22.4R3 before 22.4R3-S5,    *  from 23.2R2 before 23.2R2-S2,    *  from 23.4R1 before 23.4R2-S1,    *  from 24.2R1 before 24.2R1-S1, 24.2R2.   Junos OS Evolved:   *  from 21.4R3-S7-EVO before 21.4R3-S9-EVO,    *  from 22.2R3-S4-EVO before 22.2R3-S5-EVO,    *  from 22.3R3-S2-EVO before 22.3R3-S4-EVO,    *  from 22.4R3-EVO before 22.4R3-S5-EVO,    *  from 23.2R2-EVO before 23.2R2-S2-EVO,    *  from 23.4R1-EVO before 23.4R2-S1-EVO,    *  from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.   This issue requires a BGP session to be established.  This issue can propagate and multiply through multiple ASes until reaching vulnerable devices.  This issue affects iBGP and eBGP.  This issue affects IPv4 and IPv6.  An indicator of compromise may be the presence of malformed update messages in a neighboring AS which is unaffected by this issue:  For example, by issuing the command on the neighboring device:  show log messages  Reviewing for similar messages from devices within proximity to each other may indicate this malformed packet is propagating:   rpd[<pid>]: Received malformed update from <IP address> (External AS <AS#>) and   rpd[<pid>]: Malformed Attribute
published:2025-01-09T19:15:20.123


Instruction: Please provide detailed information about CVE-2025-22151

CVE:CVE-2025-22151
Description:Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node interface. When querying for a specific type using the global node field (e.g., FruitType:some-id), the resolver may incorrectly return an instance of a different type mapped to the same model (e.g., SpecialFruitType). This can lead to information disclosure if the alternate type exposes sensitive fields and potential privilege escalation if the alternate type contains data intended for restricted access. This vulnerability is fixed in 0.257.0.
published:2025-01-09T19:15:20.410


Instruction: Please provide detailed information about CVE-2025-21385

CVE:CVE-2025-21385
Description:A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.
published:2025-01-09T22:15:29.980


Instruction: Please provide detailed information about CVE-2025-21380

CVE:CVE-2025-21380
Description:Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.
published:2025-01-09T23:15:08.340


Instruction: Please provide detailed information about CVE-2025-0311

CVE:CVE-2025-0311
Description:The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-01-10T07:15:08.507


Instruction: Please provide detailed information about CVE-2025-23016

CVE:CVE-2025-23016
Description:FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
published:2025-01-10T12:15:25.480


Instruction: Please provide detailed information about CVE-2025-22946

CVE:CVE-2025-22946
Description:Tenda ac9 v1.0 firmware v15.03.05.19 contains a stack overflow vulnerability in /goform/SetOnlineDevName, which may lead to remote arbitrary code execution.
published:2025-01-10T15:15:16.710


Instruction: Please provide detailed information about CVE-2025-23022

CVE:CVE-2025-23022
Description:FreeType 2.8.1 has a signed integer overflow in cf2_doFlex in cff/cf2intrp.c.
published:2025-01-10T15:15:16.967


Instruction: Please provide detailed information about CVE-2025-22152

CVE:CVE-2025-22152
Description:Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack vectors present in multiple PHP files. This vulnerability is fixed in v600.
published:2025-01-10T16:15:29.910


Instruction: Please provide detailed information about CVE-2025-22596

CVE:CVE-2025-22596
Description:WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the modulos_visiveis.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.
published:2025-01-10T16:15:30.143


Instruction: Please provide detailed information about CVE-2025-22597

CVE:CVE-2025-22597
Description:WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the CobrancaController.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the local_recepcao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.8.
published:2025-01-10T16:15:30.343


Instruction: Please provide detailed information about CVE-2025-22598

CVE:CVE-2025-22598
Description:WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the cadastrarSocio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the local_recepcao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.8.
published:2025-01-10T16:15:30.540


Instruction: Please provide detailed information about CVE-2025-22599

CVE:CVE-2025-22599
Description:WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the home.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.
published:2025-01-10T16:15:30.737


Instruction: Please provide detailed information about CVE-2025-22600

CVE:CVE-2025-22600
Description:WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_doacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the avulso parameter. This vulnerability is fixed in 3.2.8.
published:2025-01-10T16:15:30.940


Instruction: Please provide detailed information about CVE-2025-22949

CVE:CVE-2025-22949
Description:Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remote arbitrary code execution.
published:2025-01-10T16:15:31.137


Instruction: Please provide detailed information about CVE-2025-23078

CVE:CVE-2025-23078
Description:Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Breadcrumbs2 extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.5, from 1.42.X before 1.42.4.
published:2025-01-10T18:15:26.877


Instruction: Please provide detailed information about CVE-2025-23079

CVE:CVE-2025-23079
Description:Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - ArticleFeedbackv5 extension: from 1.42.X before 1.42.2.
published:2025-01-10T19:15:38.353


Instruction: Please provide detailed information about CVE-2025-23110

CVE:CVE-2025-23110
Description:An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of a CSV file containing a list of alert configurations. An attacker can send the victim a CSV file containing the XSS payload in the email-subject. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim clicks on the email-subject value, it triggers the XSS payload.
published:2025-01-10T22:15:27.550


Instruction: Please provide detailed information about CVE-2025-23111

CVE:CVE-2025-23111
Description:An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website. Thus, this allows malicious actions to be executed without user consent.
published:2025-01-10T22:15:27.723


Instruction: Please provide detailed information about CVE-2025-23112

CVE:CVE-2025-23112
Description:An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receive the survey, if he clicks on the field name, it triggers the XSS payload.
published:2025-01-10T22:15:27.863


Instruction: Please provide detailed information about CVE-2025-23113

CVE:CVE-2025-23113
Description:An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim click on the alert-title value, it can trigger a logout request and terminates their session, or redirect to a phishing website. This vulnerability stems from the absence of CSRF protections on the logout functionality.
published:2025-01-10T22:15:28.023


Instruction: Please provide detailed information about CVE-2025-0103

CVE:CVE-2025-0103
Description:An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system.
published:2025-01-11T03:15:22.020


Instruction: Please provide detailed information about CVE-2025-0104

CVE:CVE-2025-0104
Description:A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.
published:2025-01-11T03:15:22.183


Instruction: Please provide detailed information about CVE-2025-0105

CVE:CVE-2025-0105
Description:An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.
published:2025-01-11T03:15:22.317


Instruction: Please provide detailed information about CVE-2025-0106

CVE:CVE-2025-0106
Description:A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem.
published:2025-01-11T03:15:22.490


Instruction: Please provide detailed information about CVE-2025-0107

CVE:CVE-2025-0107
Description:An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
published:2025-01-11T03:15:22.637


Instruction: Please provide detailed information about CVE-2025-23108

CVE:CVE-2025-23108
Description:Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability affects Firefox for iOS < 134.
published:2025-01-11T04:15:06.280


Instruction: Please provide detailed information about CVE-2025-23109

CVE:CVE-2025-23109
Description:Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address This vulnerability affects Firefox for iOS < 134.
published:2025-01-11T04:15:06.367


Instruction: Please provide detailed information about CVE-2025-0390

CVE:CVE-2025-0390
Description:A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-01-11T08:15:26.527


Instruction: Please provide detailed information about CVE-2025-0391

CVE:CVE-2025-0391
Description:A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-01-11T09:15:05.937


Instruction: Please provide detailed information about CVE-2025-0392

CVE:CVE-2025-0392
Description:A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-01-11T11:15:06.657


Instruction: Please provide detailed information about CVE-2025-23124

CVE:CVE-2025-23124
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-01-11T15:15:08.930


Instruction: Please provide detailed information about CVE-2025-23125

CVE:CVE-2025-23125
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-01-11T15:15:09.023


Instruction: Please provide detailed information about CVE-2025-23126

CVE:CVE-2025-23126
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-01-11T15:15:09.100


Instruction: Please provide detailed information about CVE-2025-23127

CVE:CVE-2025-23127
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-01-11T15:15:09.173


Instruction: Please provide detailed information about CVE-2025-23128

CVE:CVE-2025-23128
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-01-11T15:15:09.250


Instruction: Please provide detailed information about CVE-2025-0396

CVE:CVE-2025-0396
Description:A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-01-12T12:15:17.963


Instruction: Please provide detailed information about CVE-2025-0397

CVE:CVE-2025-0397
Description:A vulnerability, which was classified as problematic, was found in reckcn SPPanAdmin 1.0. Affected is an unknown function of the file /;/admin/role/edit. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-12T13:15:07.333


Instruction: Please provide detailed information about CVE-2025-0398

CVE:CVE-2025-0398
Description:A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /resources/..;/inport/updateInport of the component Backend. The manipulation of the argument remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-12T14:15:08.993


Instruction: Please provide detailed information about CVE-2025-0399

CVE:CVE-2025-0399
Description:A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-12T23:15:07.050


Instruction: Please provide detailed information about CVE-2025-0400

CVE:CVE-2025-0400
Description:A vulnerability was found in StarSea99 starsea-mall 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/categories/update. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-12T23:15:07.260


Instruction: Please provide detailed information about CVE-2025-0401

CVE:CVE-2025-0401
Description:A vulnerability classified as critical has been found in 1902756969 reggie 1.0. Affected is the function download of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T00:15:06.807


Instruction: Please provide detailed information about CVE-2025-0402

CVE:CVE-2025-0402
Description:A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T00:15:07.707


Instruction: Please provide detailed information about CVE-2025-0403

CVE:CVE-2025-0403
Description:A vulnerability, which was classified as problematic, has been found in 1902756969 reggie 1.0. Affected by this issue is some unknown functionality of the file /user/sendMsg of the component Phone Number Validation Handler. The manipulation of the argument code leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T00:15:07.873


Instruction: Please provide detailed information about CVE-2025-0404

CVE:CVE-2025-0404
Description:A vulnerability has been found in liujianview gymxmjpa 1.0 and classified as critical. This vulnerability affects the function CoachController of the file src/main/java/com/liujian/gymxmjpa/controller/CoachController.java. The manipulation of the argument coachName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T01:15:07.227


Instruction: Please provide detailed information about CVE-2025-0405

CVE:CVE-2025-0405
Description:A vulnerability was found in liujianview gymxmjpa 1.0 and classified as critical. This issue affects the function GoodsDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/GoodsController.java. The manipulation of the argument goodsName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T01:15:07.430


Instruction: Please provide detailed information about CVE-2025-0406

CVE:CVE-2025-0406
Description:A vulnerability was found in liujianview gymxmjpa 1.0. It has been classified as critical. Affected is the function SubjectDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/SubjectController.java. The manipulation of the argument subname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T02:15:07.490


Instruction: Please provide detailed information about CVE-2025-0407

CVE:CVE-2025-0407
Description:A vulnerability was found in liujianview gymxmjpa 1.0. It has been declared as critical. Affected by this vulnerability is the function EquipmentDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/EquipmentController.java. The manipulation of the argument hyname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T02:15:07.667


Instruction: Please provide detailed information about CVE-2025-0408

CVE:CVE-2025-0408
Description:A vulnerability was found in liujianview gymxmjpa 1.0. It has been rated as critical. Affected by this issue is the function LoosDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/LoosController.java. The manipulation of the argument loosName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T02:15:07.840


Instruction: Please provide detailed information about CVE-2025-0409

CVE:CVE-2025-0409
Description:A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0. This affects the function MembertypeDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/MembertypeController.java. The manipulation of the argument typeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T03:15:06.667


Instruction: Please provide detailed information about CVE-2025-0410

CVE:CVE-2025-0410
Description:A vulnerability classified as critical was found in liujianview gymxmjpa 1.0. This vulnerability affects the function MenberDaoInpl of the file src/main/java/com/liujian/gymxmjpa/controller/MenberConntroller.java. The manipulation of the argument hyname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-01-13T03:15:06.847


Instruction: Please provide detailed information about CVE-2025-0412

CVE:CVE-2025-0412
Description:Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the processing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22139.
published:2025-01-13T04:15:06.477


Instruction: Please provide detailed information about CVE-2025-22828

CVE:CVE-2025-22828
Description:CloudStack users can add and read comments (annotations) on resources they are authorised to access.   Due to an access validation issue that affects Apache CloudStack versions from 4.16.0, users who have access, prior access or knowledge of resource UUIDs can list and add comments (annotations) to such resources.   An attacker with a user-account and access or prior knowledge of resource UUIDs may exploit this issue to read contents of the comments (annotations) or add malicious comments (annotations) to such resources.   This may cause potential loss of confidentiality of CloudStack environments and resources if the comments (annotations) contain any privileged information. However, guessing or brute-forcing resource UUIDs are generally hard to impossible and access to listing or adding comments isn't same as access to CloudStack resources, making this issue of very low severity and general low impact.   CloudStack admins may also disallow listAnnotations and addAnnotation API access to non-admin roles in their environment as an interim measure.
published:2025-01-13T13:16:12.233


Instruction: Please provide detailed information about CVE-2025-22314

CVE:CVE-2025-22314
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Scripts Food Store – Online Food Delivery & Pickup allows Reflected XSS.This issue affects Food Store – Online Food Delivery & Pickup: from n/a through 1.5.1.
published:2025-01-13T14:15:10.270


Instruction: Please provide detailed information about CVE-2025-22337

CVE:CVE-2025-22337
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infosoft Consultant Order Audit Log for WooCommerce allows Reflected XSS.This issue affects Order Audit Log for WooCommerce: from n/a through 2.0.
published:2025-01-13T14:15:10.440


Instruction: Please provide detailed information about CVE-2025-22344

CVE:CVE-2025-22344
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Convoy Media Category Library allows Reflected XSS.This issue affects Media Category Library: from n/a through 2.7.
published:2025-01-13T14:15:10.613


Instruction: Please provide detailed information about CVE-2025-22498

CVE:CVE-2025-22498
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in New Normal LLC LucidLMS allows Reflected XSS.This issue affects LucidLMS: from n/a through 1.0.5.
published:2025-01-13T14:15:10.787


Instruction: Please provide detailed information about CVE-2025-22499

CVE:CVE-2025-22499
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FAKTOR VIER F4 Post Tree allows Reflected XSS.This issue affects F4 Post Tree: from n/a through 1.1.18.
published:2025-01-13T14:15:10.960


Instruction: Please provide detailed information about CVE-2025-22506

CVE:CVE-2025-22506
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartAgenda Smart Agenda allows Stored XSS.This issue affects Smart Agenda: from n/a through 4.7.
published:2025-01-13T14:15:11.127


Instruction: Please provide detailed information about CVE-2025-22514

CVE:CVE-2025-22514
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Tatheer KNR Author List Widget allows Reflected XSS.This issue affects KNR Author List Widget: from n/a through 3.1.1.
published:2025-01-13T14:15:11.290


Instruction: Please provide detailed information about CVE-2025-22567

CVE:CVE-2025-22567
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trustist TRUSTist REVIEWer allows Reflected XSS.This issue affects TRUSTist REVIEWer: from n/a through 2.0.
published:2025-01-13T14:15:11.460


Instruction: Please provide detailed information about CVE-2025-22568

CVE:CVE-2025-22568
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paramveer Singh for Arete IT Private Limited Post And Page Reactions allows Reflected XSS.This issue affects Post And Page Reactions: from n/a through 1.0.5.
published:2025-01-13T14:15:11.610


Instruction: Please provide detailed information about CVE-2025-22569

CVE:CVE-2025-22569
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Featured Page Widget allows Reflected XSS.This issue affects Featured Page Widget: from n/a through 2.2.
published:2025-01-13T14:15:11.787


Instruction: Please provide detailed information about CVE-2025-22570

CVE:CVE-2025-22570
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Miloš Đekić Inline Tweets allows Stored XSS.This issue affects Inline Tweets: from n/a through 2.0.
published:2025-01-13T14:15:11.940


Instruction: Please provide detailed information about CVE-2025-22576

CVE:CVE-2025-22576
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Downing Site PIN allows Reflected XSS.This issue affects Site PIN: from n/a through 1.3.
published:2025-01-13T14:15:12.117


Instruction: Please provide detailed information about CVE-2025-22583

CVE:CVE-2025-22583
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anshul Sojatia Scan External Links allows Reflected XSS.This issue affects Scan External Links: from n/a through 1.0.
published:2025-01-13T14:15:12.300


Instruction: Please provide detailed information about CVE-2025-22586

CVE:CVE-2025-22586
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detlef Stöver WPEX Replace DB Urls allows Reflected XSS.This issue affects WPEX Replace DB Urls: from n/a through 0.4.0.
published:2025-01-13T14:15:12.490


Instruction: Please provide detailed information about CVE-2025-22588

CVE:CVE-2025-22588
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scanventory.net Scanventory allows Reflected XSS.This issue affects Scanventory: from n/a through 1.1.3.
published:2025-01-13T14:15:12.660


Instruction: Please provide detailed information about CVE-2025-22777

CVE:CVE-2025-22777
Description:Deserialization of Untrusted Data vulnerability in GiveWP GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.19.3.
published:2025-01-13T14:15:12.900


Instruction: Please provide detailed information about CVE-2025-22800

CVE:CVE-2025-22800
Description:Missing Authorization vulnerability in Post SMTP Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through 2.9.11.
published:2025-01-13T14:15:13.067


Instruction: Please provide detailed information about CVE-2025-22963

CVE:CVE-2025-22963
Description:Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.
published:2025-01-13T16:15:19.367


Instruction: Please provide detailed information about CVE-2025-22142

CVE:CVE-2025-22142
Description:NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In affected versions an admin can add the ability to have users fill out an additional field and users can inject javascript code into it that would be activated once a staffer visits the user's profile on staff panel. As a result an attacker can execute javascript code on the staffer's computer. This issue has been addressed in version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T20:15:29.677


Instruction: Please provide detailed information about CVE-2025-22144

CVE:CVE-2025-22144
Description:NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by email the reset code is NULL, but when the account is manually validated by a user with admincp.core.emails or admincp.users.edit permissions then the reset_code will no longer be NULL but empty. An attacker can request http://localhost/nameless/index.php?route=/forgot_password/&c= and reset the password. As a result an attacker may compromise another users password and take over their account. This issue has been addressed in release version 2.1.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T20:15:29.817


Instruction: Please provide detailed information about CVE-2025-23026

CVE:CVE-2025-23026
Description:jte (Java Template Engine) is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with `script` tags or script attributes that include a Javascript template string (backticks) are subject to XSS. The `javaScriptBlock` and `javaScriptAttribute` methods in the `Escape` class do not escape backticks, which are used for Javascript template strings. Dollar signs in template strings should also be escaped as well to prevent undesired interpolation. HTML templates rendered by Jte's `OwaspHtmlTemplateOutput` in versions less than or equal to `3.1.15` with `script` tags or script attributes that contain Javascript template strings (backticks) are vulnerable. Users are advised to upgrade to version 3.1.16 or later to resolve this issue. There are no known workarounds for this vulnerability.
published:2025-01-13T20:15:30.003


Instruction: Please provide detailed information about CVE-2025-23027

CVE:CVE-2025-23027
Description:next-forge is a Next.js project boilerplate for modern web application. The BASEHUB_TOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems.
published:2025-01-13T20:15:30.150


Instruction: Please provide detailed information about CVE-2025-22134

CVE:CVE-2025-22134
Description:When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003
published:2025-01-13T21:15:14.333


Instruction: Please provide detailed information about CVE-2025-22138

CVE:CVE-2025-22138
Description:@codidact/qpixel is a Q&A-based community knowledge-sharing software. In affected versions when a category is set to private or limited-visibility within QPixel's admin tools, suggested edits within this category can still be viewed by unprivileged or anonymous users via the suggested edit queue. This issue has not yet been patched and no workarounds are available. Users are advised to follow the development repo for updates.  ### Patches Not yet patched.  ### Workarounds None available. Private or limited-visibility categories should not be considered ways to store sensitive information.  ### References Internal: [SUPPORT-114](https://codidact.atlassian.net/issues/SUPPORT-114)
published:2025-01-13T21:15:14.500


Instruction: Please provide detailed information about CVE-2025-22613

CVE:CVE-2025-22613
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `informacao_adicional.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `informacao_adicional.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T21:15:14.837


Instruction: Please provide detailed information about CVE-2025-22614

CVE:CVE-2025-22614
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `dependente_editarInfoPessoal.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `nome` and `SobrenomeForm`parameters. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `dependente_editarInfoPessoal.php` parameters. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T21:15:14.967


Instruction: Please provide detailed information about CVE-2025-22615

CVE:CVE-2025-22615
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `Cadastro_Atendido.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `cpf` parameter. The application fails to validate and sanitize user inputs in the `cpf` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T21:15:15.110


Instruction: Please provide detailed information about CVE-2025-22616

CVE:CVE-2025-22616
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `dependente_parentesco_adicionar.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `dependente_parentesco_adicionar.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T21:15:15.237


Instruction: Please provide detailed information about CVE-2025-22617

CVE:CVE-2025-22617
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `editar_socio.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `socio` parameter. The application fails to validate and sanitize user inputs in the `socio` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T21:15:15.370


Instruction: Please provide detailed information about CVE-2025-22618

CVE:CVE-2025-22618
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_cargo.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `cargo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_cargo.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in release version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T21:15:15.500


Instruction: Please provide detailed information about CVE-2025-22619

CVE:CVE-2025-22619
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `editar_permissoes.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_c` parameter. The application fails to validate and sanitize user inputs in the `msg_c` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in release version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-13T21:15:15.620


Instruction: Please provide detailed information about CVE-2025-0053

CVE:CVE-2025-0053
Description:SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of the application and may be leveraged to facilitate further attacks or exploits.
published:2025-01-14T01:15:15.403


Instruction: Please provide detailed information about CVE-2025-0055

CVE:CVE-2025-0055
Description:SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
published:2025-01-14T01:15:15.570


Instruction: Please provide detailed information about CVE-2025-0056

CVE:CVE-2025-0056
Description:SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
published:2025-01-14T01:15:15.730


Instruction: Please provide detailed information about CVE-2025-0057

CVE:CVE-2025-0057
Description:SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.
published:2025-01-14T01:15:15.883


Instruction: Please provide detailed information about CVE-2025-0058

CVE:CVE-2025-0058
Description:In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.
published:2025-01-14T01:15:16.040


Instruction: Please provide detailed information about CVE-2025-0059

CVE:CVE-2025-0059
Description:Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
published:2025-01-14T01:15:16.190


Instruction: Please provide detailed information about CVE-2025-0060

CVE:CVE-2025-0060
Description:SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.
published:2025-01-14T01:15:16.350


Instruction: Please provide detailed information about CVE-2025-0061

CVE:CVE-2025-0061
Description:SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.
published:2025-01-14T01:15:16.500


Instruction: Please provide detailed information about CVE-2025-0063

CVE:CVE-2025-0063
Description:SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.
published:2025-01-14T01:15:16.633


Instruction: Please provide detailed information about CVE-2025-0066

CVE:CVE-2025-0066
Description:Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application
published:2025-01-14T01:15:16.783


Instruction: Please provide detailed information about CVE-2025-0067

CVE:CVE-2025-0067
Description:Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
published:2025-01-14T01:15:16.950


Instruction: Please provide detailed information about CVE-2025-0068

CVE:CVE-2025-0068
Description:An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.
published:2025-01-14T01:15:17.107


Instruction: Please provide detailed information about CVE-2025-0069

CVE:CVE-2025-0069
Description:Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account could gain higher privileges. With this, he could move laterally within the network and further compromise the active directory of a company. This leads to high impact on confidentiality, integrity and availability of the Windows server.
published:2025-01-14T01:15:17.257


Instruction: Please provide detailed information about CVE-2025-0070

CVE:CVE-2025-0070
Description:SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.
published:2025-01-14T01:15:17.427


Instruction: Please provide detailed information about CVE-2025-23030

CVE:CVE-2025-23030
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `cadastro_funcionario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `cpf` parameter. The application fails to validate and sanitize user inputs in the `cpf` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:17.690


Instruction: Please provide detailed information about CVE-2025-23031

CVE:CVE-2025-23031
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_alergia.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `nome` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_alergia.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:17.833


Instruction: Please provide detailed information about CVE-2025-23032

CVE:CVE-2025-23032
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_escala.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `escala` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_escala.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:17.980


Instruction: Please provide detailed information about CVE-2025-23033

CVE:CVE-2025-23033
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_situacao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `situacao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_situacao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:18.127


Instruction: Please provide detailed information about CVE-2025-23034

CVE:CVE-2025-23034
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `tags.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. The application fails to validate and sanitize user inputs in the `msg_e` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:18.273


Instruction: Please provide detailed information about CVE-2025-23035

CVE:CVE-2025-23035
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_quadro_horario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_tipo_quadro_horario.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:18.413


Instruction: Please provide detailed information about CVE-2025-23036

CVE:CVE-2025-23036
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `pre_cadastro_funcionario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. The application fails to validate and sanitize user inputs in the `msg_e` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.7. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:18.563


Instruction: Please provide detailed information about CVE-2025-23037

CVE:CVE-2025-23037
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `control.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `cargo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `control.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:18.717


Instruction: Please provide detailed information about CVE-2025-23038

CVE:CVE-2025-23038
Description:WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `remuneracao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `remuneracao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-01-14T01:15:18.867


Instruction: Please provide detailed information about CVE-2025-23082

CVE:CVE-2025-23082
Description:Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
published:2025-01-14T02:15:08.163


Instruction: Please provide detailed information about CVE-2024-13348

CVE:CVE-2024-13348
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-22506 Reason: This candidate is a reservation duplicate of CVE-2025-22506. Notes: All CVE users should reference CVE-2025-22506 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-01-14T04:15:09.200


Instruction: Please provide detailed information about CVE-2025-0393

CVE:CVE-2025-0393
Description:The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-01-14T09:15:21.263


Instruction: Please provide detailed information about CVE-2025-0394

CVE:CVE-2025-0394
Description:The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
published:2025-01-14T09:15:21.430


Instruction: Please provide detailed information about CVE-2025-20016

CVE:CVE-2025-20016
Description:OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command.
published:2025-01-14T10:15:07.500


Instruction: Please provide detailed information about CVE-2025-20055

CVE:CVE-2025-20055
Description:OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command.
published:2025-01-14T10:15:07.710


Instruction: Please provide detailed information about CVE-2025-20620

CVE:CVE-2025-20620
Description:SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may obtain the administrative password of the web management page.
published:2025-01-14T10:15:07.860


Instruction: Please provide detailed information about CVE-2025-0458

CVE:CVE-2025-0458
Description:A vulnerability classified as problematic was found in Virtual Computer Vysual RH Solution 2024.12.1. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Panel. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-14T16:15:34.397


Instruction: Please provide detailed information about CVE-2025-0459

CVE:CVE-2025-0459
Description:A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-14T16:15:34.617


Instruction: Please provide detailed information about CVE-2025-0460

CVE:CVE-2025-0460
Description:A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-14T16:15:34.800


Instruction: Please provide detailed information about CVE-2025-0461

CVE:CVE-2025-0461
Description:A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The manipulation of the argument pathfile leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-01-14T16:15:34.997


Instruction: Please provide detailed information about CVE-2025-22983

CVE:CVE-2025-22983
Description:An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
published:2025-01-14T16:15:35.603