2 October 2025

63 results · Clear filters · Feed

• Medium 5.1
  CVE-2025-40991

  Stored XSS in Creativeitem Ekushey CRM

  Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via POST. This vulnerability coul…

  Creativeitem Ekushey CRM
  Oct 2, 2025
• Medium 5.1
  CVE-2025-40990

  Stored XSS in Creativeitem Ekushey CRM

  Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnera…

  Creativeitem Ekushey CRM
  Oct 2, 2025
• Medium 5.1
  CVE-2025-40989

  Stored XSS in Creativeitem Ekushey CRM

  Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_message/add/xxx", affecting to "message" parameter via POST. This vulnerability could all…

  Creativeitem Ekushey CRM
  Oct 2, 2025
• Medium 4.7
  CVE-2025-54468

  Rancher sends sensitive information to external services through the `/meta/proxy` endpoint

  A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive…

  SUSE Rancher github.com/rancher/rancher Go
  Oct 2, 2025
• Medium 5.9
  CVE-2025-40646

  Exposure of sensitive information in Viday

  Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload.

  ViDay ViDay
  Oct 2, 2025
• Medium 4.8
  CVE-2025-54292

  Client-Side Path Traversal in LXD-UI

  Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.

  Canonical LXD
  Oct 2, 2025
• Medium 6.9
  CVE-2025-54291

  Project existence disclosure in LXD images API

  Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

  Canonical LXD incus lxd Debian Alpine Go
  Oct 2, 2025
• Medium 6.9
  CVE-2025-54290

  Project Existence Disclosure via Error Handling in LXD Image Export

  Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

  Canonical LXD incus lxd Debian Alpine Go
  Oct 2, 2025
• Medium 5.1
  CVE-2025-54288

  Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server

  Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device informat…

  Canonical LXD lxd incus Debian Ubuntu Alpine Go
  Oct 2, 2025
• Medium 6.5
  CVE-2025-11182

  File Download in GTONE ChangeFlow

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1.

  GTONE ChangeFlow
  Oct 2, 2025
• Medium 6.2
  CVE-2025-59406

  The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow L…

  Oct 2, 2025
• Medium 6.1
  CVE-2025-61087

  SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name f…

  Oct 2, 2025
• Medium 6.5
  CVE-2025-61096

  PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname p…

  Oct 2, 2025
• Medium 5.3
  CVE-2025-60661

  Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuW…

  Oct 2, 2025
• Medium 5.4
  CVE-2025-60782

  PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability …

  Oct 2, 2025
• Medium 5.1
  CVE-2025-57443

  FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-librar…

  Oct 2, 2025
• Medium 6.5
  CVE-2025-57305

  VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.

  Oct 2, 2025
• Medium 6.5
  CVE-2025-56162

  YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint…

  Oct 2, 2025
• Medium 6.5
  CVE-2025-56381 Public exploit

  ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.report…

  Oct 2, 2025
• Medium 6.1
  CVE-2025-56154

  htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The…

  Oct 2, 2025
• Medium 6.5
  CVE-2025-56380 Public exploit

  Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the fr…

  Oct 2, 2025
• Medium 5.4
  CVE-2025-56379 Public exploit

  A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to exec…

  Oct 2, 2025
• Medium 6.5
  CVE-2025-56019 Public exploit

  An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobi…

  Oct 2, 2025