Overview CVE-2025-13181 identifies a cross-site scripting (XSS) vulnerability present in pojoin h3blog version 1.0. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. The affected component resides within the /admin/cms/material/add file, specifically targeting the ‘Name’ argument. Technical Details The XSS vulnerability in pojoin h3blog 1.0 arises from insufficient input validation and sanitization of the ‘Name’ parameter within the /admin/cms/material/add endpoint. An attacker can inject arbitrary JavaScript code through this parameter. When a user interacts with the application, the injected script executes within their browser context, potentially leading to account compromise, data theft, or…

Overview CVE-2025-13180 describes a basic Cross-Site Scripting (XSS) vulnerability found in the Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System, affecting versions up to 20250320. This vulnerability allows a remote attacker to inject malicious scripts into the system via the /edit_profile endpoint, specifically through the first_name and last_name parameters. The vendor was notified but did not respond. A proof-of-concept exploit is publicly available. Technical Details The vulnerability resides within the /edit_profile functionality. By manipulating the first_name and last_name parameters with malicious JavaScript code, an attacker can inject scripts that will be executed in the context of other users’ browsers when…

Overview CVE-2025-13179 describes a Cross-Site Request Forgery (CSRF) vulnerability discovered in the Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System, specifically in versions up to 20250320. This vulnerability allows a remote attacker to potentially execute unauthorized actions on behalf of a legitimate user without their knowledge. The vulnerability was publicly disclosed and a proof-of-concept (PoC) exploit is available. The vendor was notified but did not respond to the disclosure. Technical Details The vulnerability lies in an unspecified area of the system’s processing logic. By crafting malicious requests, an attacker can trick a logged-in user into unknowingly performing actions, such as…

Overview CVE-2025-13033 is a high-severity vulnerability identified in an email parsing library. This flaw arises from improper handling of specially formatted recipient email addresses. A malicious actor can craft a recipient address containing an embedded external address within quotes, causing the application to misdirect emails to the attacker’s address instead of the legitimate internal recipient. This can result in significant data leaks, bypassing security filters and access controls, and unauthorized access to sensitive information. Technical Details The vulnerability occurs when the email parsing library fails to properly validate and sanitize recipient email addresses. An attacker can exploit this by crafting…

Overview CVE-2025-63680 describes a critical vulnerability affecting Nero BackItUp within the Nero product line. This flaw allows for arbitrary code execution due to a path parsing/UI rendering issue combined with Windows ShellExecuteW fallback extension resolution. A malicious actor can leverage this vulnerability by crafting a specific file structure that, when clicked by a user within the Nero BackItUp interface, results in the execution of arbitrary code. The vulnerability affects Nero BackItUp product lines from 2019 up to and including 2025 versions (and potentially earlier versions as well). The vendor, Nero, has acknowledged the existence of this vulnerability. Technical Details The…

Overview CVE-2025-63291 details an Insecure Direct Object Reference (IDOR) vulnerability found in Alteryx Server versions 2022.1.1.42654 and 2024.1. This flaw allows an attacker with authenticated access to the Alteryx Server API to potentially retrieve sensitive data belonging to other users, including administrative and private studio API keys, by manipulating MongoDB object IDs in API requests. Technical Details The Alteryx server utilizes MongoDB object IDs as unique identifiers when processing API requests. Due to a lack of proper authorization checks, the server fails to verify if the authenticated user has the necessary permissions to access the data associated with a specific…

Overview CVE-2025-13178 is a reported Cross-Site Scripting (XSS) vulnerability found in Bdtask/CodeCanyon SalesERP, affecting versions up to 20250728. The vulnerability resides in the /edit_profile component, specifically within the User Profile Handler. An attacker can remotely exploit this flaw by manipulating the first_name or last_name arguments. This can lead to the execution of malicious scripts within a user’s browser. Technical Details The vulnerability is classified as a basic Cross-Site Scripting (XSS) flaw. When a user attempts to edit their profile through the /edit_profile endpoint, the first_name and last_name fields are vulnerable to injection. An attacker can insert malicious JavaScript code into…

Overview CVE-2025-13177 details a medium-severity Cross-Site Request Forgery (CSRF) vulnerability discovered in Bdtask/CodeCanyon SalesERP, affecting versions up to 20250728. This vulnerability allows a remote attacker to potentially execute unauthorized actions on behalf of an authenticated user. The vulnerability is now publicly known and an exploit is available, increasing the urgency for organizations using the affected software to apply mitigation strategies. Notably, attempts were made to contact the vendor regarding this disclosure, but no response was received. Technical Details The CSRF vulnerability in Bdtask/CodeCanyon SalesERP allows attackers to forge requests that appear to originate from a legitimate user. This occurs due…

Overview CVE-2025-13174 is a medium-severity Server-Side Request Forgery (SSRF) vulnerability affecting the WeRSS we-mp-rss plugin, specifically versions up to 1.4.7. This flaw allows a remote attacker to potentially manipulate the application to make requests to arbitrary internal or external endpoints, potentially leading to sensitive data exposure, internal service access, or further exploitation. Technical Details The vulnerability resides within the do_job function of the /rachelos/we-mp-rss/blob/main/jobs/mps.py file, part of the Webhook Module. By manipulating the web_hook_url argument, an attacker can force the server to make requests to URLs they control. This can be achieved by sending crafted data to the application, triggering…

Overview A critical cross-site scripting (XSS) vulnerability, identified as CVE-2025-63830, has been discovered in CKFinder version 1.4.3. This vulnerability allows attackers to inject malicious scripts into the application through the file upload functionality. Specifically, by uploading a specially crafted SVG file containing active content, an attacker can execute arbitrary JavaScript code within the context of a user’s browser who interacts with the uploaded file. Technical Details The vulnerability resides in the way CKFinder 1.4.3 handles SVG files during the upload process. The application fails to properly sanitize or validate the uploaded SVG content, allowing an attacker to embed malicious JavaScript…