13 August 2025

49 results · Clear filters · Feed

• Medium 6.1
  CVE-2025-45316

  A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers …

  Aug 13, 2025
• Medium 5.4
  CVE-2025-45315

  A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers…

  Aug 13, 2025
• Medium 6.1
  CVE-2025-45313

  A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arb…

  Aug 13, 2025
• Medium 6.5
  CVE-2025-45317

  A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute a…

  Aug 13, 2025
• Medium 6.1
  CVE-2025-45314

  A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute …

  Aug 13, 2025
• Medium 5.4
  CVE-2025-52392 Public exploit

  Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

  Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. T…

  soosyze/soosyze Packagist
  Aug 13, 2025
• Medium 5.4
  CVE-2025-52386

  CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file

  Aug 13, 2025
• Medium 6.1
  CVE-2025-51691

  Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) al…

  Aug 13, 2025
• Medium 6.5
  CVE-2025-43989

  The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishand…

  Aug 13, 2025