CVE-2025-6702 is a security vulnerability (CVSS 4.3). Risk factors: public PoC available.
Path traversal in yzcheng90 X-SpringBoot up to version 5.0 allows remote authenticated attackers with low privileges to write files outside the intended directory via the File parameter of the /sys/oss/upload/apk endpoint. Exploit code is publicly available, but EPSS indicates very low exploitation probability (0.10%) and no active exploitation is reported.
Cross-site scripting in xuxueli xxl-sso 1.1.0 login page allows remote attackers to inject arbitrary web script via the errorMsg parameter. The vulnerability is publicly disclosed with exploit code available, but no active exploitation has been confirmed by CISA KEV. Successful exploitation could lead to session hijacking or defacement if an administrator or user interacts with a crafted link.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers with low privileges to inject scripts via employee registration form fields. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed. The vendor did not respond to disclosure, leaving the vulnerability unpatched.
Cross-site scripting in WeGIA 3.4.0 allows a remote authenticated low-privileged attacker to inject arbitrary web script via the 'Insira o novo tipo' parameter in the adicionar_tipoSaida.php page. Successful exploitation requires user interaction and can lead to session hijacking or unauthorized actions on behalf of the victim. Public exploit code exists but no active widespread exploitation has been reported.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira o novo tipo' parameter in /html/matPat/adicionar_tipoEntrada.php. The vulnerability requires an authenticated user to click a malicious link, but exploit code is publicly available. No active exploitation has been confirmed.
Cross-site scripting in LabRedesCefetRJ WeGIA 3.4.0 allows remote authenticated attackers with user interaction to inject arbitrary web script via the Nome/Sobrenome fields. The vulnerability has a publicly available proof-of-concept but no confirmed active exploitation; EPSS indicates low exploitation probability.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira a nova categoria' parameter in adicionar_categoria.php. The vulnerability requires authentication and user interaction but can lead to content spoofing or session manipulation. A public proof-of-concept is available, though no active exploitation has been confirmed.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira a nova unidade' parameter in the Adicionar Unidade page. The vendor has not responded to early disclosure, and public exploit code exists, but no evidence of active exploitation has been confirmed.
Open redirect vulnerability in Xuxueli xxl-sso 1.1.0 allows authenticated remote attackers to redirect users to arbitrary websites via the redirect_url parameter of the /xxl-sso-server/doLogin endpoint. Exploit code is publicly available, but no active exploitation has been reported (not in CISA KEV). EPSS indicates very low likelihood of widespread exploitation (0.05%).
pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.
A privilege escalation vulnerability in GitLab CE/EE affecting all (CVSS 3.1). Remediation should follow standard vulnerability management procedures.
An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.
We need to produce a comprehensive JSON analysis for CVE-2025-6624. The user provided a lot of data: description, CVSS (4.0 vector and base score 1.2), EPSS, KEV not mentioned (so assume no), POC? The description says the vulnerability is insertion of sensitive information into log file. The EPSS is 0.03%, percentile 8%, very low. No KEV, so not actively exploited. Patch available from vendor. CPE is cpe:2.3:a:snyk:snyk_cli:*:*:*:*:*:*:*:*. Tags include Information Disclosure, Docker, Snyk Cli. References include docs, commits, releases, GitHub. We need to fill each field accordingly. First, product_name: "snyk CLI" (3 words). Affected product: snyk CLI before 1.1297.3. summary: Need original synthesis, not copy. Must start with impact verb and product, e.g., "Sensitive credential logging in Snyk CLI versions before 1.1297.3 allows...". Mention the affected commands, debug mode, and that credentials (registry creds, Snyk tokens, docker reg token) are exposed in local debug logs. State that only debug mode triggers it, auth tokens require TRACE. EPSS low, no active exploitation (no KEV). Patch available. So: "Sensitive credential logging in Snyk CLI versions before 1.1297.3 can expose container registry credentials, Snyk auth tokens, and Docker registry tokens in local debug logs when debug mode is enabled or trace mode for auth/IaC commands. Requires local access and debug logging to be active; exploitation probability very low (EPSS 0.03%). Fix available in version 1.1297.3." technical_context: Explain that the Snyk CLI uses debug logging for troubleshooting, and certain commands inadvertently log credentials when verbose logging is enabled. The CWE-532 is Insertion of Sensitive Information into Log Files. The root cause is insufficient sanitization of sensitive parameters before writing to debug logs. CPE data confirms snyk_cli. So, "The Snyk CLI is a developer tool used for security scanning. Versions before 1.1297.3 fail to sanitize credentials in debug and