Overview A stored cross-site scripting (XSS) vulnerability, identified as CVE-2025-51662, has been discovered in FileCodeBox version 2.2 and earlier. This vulnerability allows attackers to inject malicious JavaScript code into shared text “codeboxes.” This injected code is then automatically executed in the browsers of any users who access the infected codebox, either by clicking a link or entering the share code. Technical Details The vulnerability stems from insufficient input validation within the text sharing feature of FileCodeBox. When a user creates or modifies a codebox, the application fails to properly sanitize or encode the input before storing it in the database.…

Overview This article details a critical path traversal vulnerability, identified as CVE-2025-51661, affecting FileCodeBox version 2.2 and earlier. This vulnerability allows unauthenticated remote attackers to write arbitrary files to the server’s filesystem when the application is configured to use local filesystem storage. By exploiting this flaw, attackers can potentially overwrite critical system files, inject malicious code, and compromise the entire server. Technical Details The vulnerability resides within the SystemFileStorage.save_file method in core/storage.py. The application fails to properly sanitize filenames provided by user input when constructing the save path. Specifically, filenames with malicious traversal sequences (e.g., ../) are not validated, allowing…

Overview CVE-2025-36371 is a medium severity information disclosure vulnerability affecting IBM i versions 7.2, 7.3, 7.4, 7.5, and 7.6. This vulnerability resides in the database plan cache implementation and could allow a user with access to the plan cache to view information they are not authorized to see. This article provides a detailed overview of the vulnerability, its potential impact, and recommended mitigation steps. Technical Details The database plan cache in IBM i is used to store execution plans for SQL queries to improve performance. Due to insufficient access control mechanisms within the plan cache implementation, a user with the…

Overview This article discusses CVE-2025-65100, a vulnerability found in Isar, an integration system designed for automated root filesystem generation. The vulnerability arises from an incorrect timestamp setting for the security distribution when only defining `ISAR_APT_SNAPSHOT_DATE`. This misconfiguration can lead to missed security updates within the generated root filesystem. This issue affects Isar versions 0.11-rc1 and 0.11. A patch has been released to address this vulnerability. Technical Details The core of the problem lies in how Isar handles APT snapshot dates. When the `ISAR_APT_SNAPSHOT_DATE` variable is defined in the affected versions, it does not fully propagate the correct timestamp information required…

Overview A critical privilege escalation vulnerability, identified as CVE-2025-65094, has been discovered in WBCE CMS. This flaw allows a low-privileged user to escalate their privileges to the Administrators group, potentially leading to a complete compromise of the affected CMS installation. The vulnerability resides in the /admin/users/save.php script and stems from a lack of server-side validation of user group assignments. Technical Details The vulnerability occurs because WBCE CMS versions prior to 1.6.4 do not properly validate the groups[] parameter in the /admin/users/save.php request. While the user interface restricts users to assigning only their existing group, the server-side logic fails to enforce…

Overview CVE-2025-64759 describes a high-severity stored Cross-Site Scripting (XSS) vulnerability affecting versions of the Homarr dashboard prior to 1.43.3. This vulnerability allows an attacker to inject malicious JavaScript code that is persistently stored and executed in the browsers of users accessing the affected Homarr instance. Exploiting this vulnerability could lead to severe consequences, including account takeover and data compromise. Technical Details The vulnerability stems from the improper handling of uploaded SVG files within the Homarr application. Specifically, the application fails to adequately sanitize SVG files before rendering them. A malicious actor can craft a specially designed SVG file containing embedded…

Overview CVE-2025-63211 is a stored cross-site scripting (XSS) vulnerability identified in Bridgetech VBC Server & Element Manager. This vulnerability affects firmware versions 6.5.0-9 through 6.5.0-10. An attacker can exploit this flaw to inject malicious scripts into the application, potentially compromising user accounts and system integrity. Technical Details The vulnerability resides in the /vbc/core/userSetupDoc/userSetupDoc endpoint. Specifically, the addName parameter is vulnerable to stored XSS. An attacker can inject malicious JavaScript code into this parameter. When a user views the affected data, the injected script will execute in their browser within the context of the Bridgetech VBC Server & Element Manager application.…

Overview CVE-2025-65099 identifies a potential security vulnerability in Claude Code, an agentic coding tool. Specifically, prior to version 1.0.39, Claude Code could be tricked into executing malicious code embedded within a project’s Yarn plugins before a user even accepted the startup trust dialog. This could occur only when Claude Code was run in an untrusted directory and when the user was utilizing Yarn version 3.0 or higher. A patch has been released in version 1.0.39 to address this issue. Technical Details The vulnerability stems from the way Claude Code interacts with Yarn, a package manager for JavaScript. Yarn’s plugin system…

Overview CVE-2025-65095 identifies a potential cross-site scripting (XSS) vulnerability in Lookyloo, a web interface designed for capturing website pages and displaying a tree of interconnected domains. This flaw existed in versions prior to 1.35.1. Fortunately, the Lookyloo team has addressed this issue in version 1.35.1, mitigating the risk for users who upgrade. Technical Details The XSS vulnerability resided within the index and tree pages of the Lookyloo web interface. An attacker could potentially inject malicious scripts into these pages, which would then be executed in the browsers of unsuspecting users. The specifics of the injection point and payload are not…

Overview CVE-2025-65089 describes a medium severity information disclosure vulnerability found in the XWiki Remote Macros, specifically the XWiki rendering macros designed to aid in content migration from Confluence. This flaw allows a user without view permissions on a specific page to potentially access the content of office attachments displayed using the `view file` macro. The vulnerability resides in versions prior to 1.27.0 of the XWiki Remote Macros package. Technical Details The vulnerability occurs because the `view file` macro in older versions of XWiki Remote Macros doesn’t properly enforce access control restrictions when rendering attached office documents. Consequently, if a page…