A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects an unknown function of the file ai/chat2db/server/web/api/controller/data/source/DataSourceController.java of the component JDBC Connection Handler. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE Database V5

Detailed information about CVE-2025-9148: SQL Injection in CodePhiliaX Chat2DB affecting CodePhiliaX Chat2DB. Get real-time updates, technical details, and miti

CVE-2025-9148: SQL Injection in CodePhiliaX Chat2DB - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-9148: SQL Injection in CodePhiliaX Chat2DB

In the smartLibrary component of the HRForecast Suite 0.4.3, a SQL injection vulnerability was discovered in the valueKey parameter. This flaw enables any authenticated user to execute arbitrary SQL queries, via crafted payloads to valueKey to the api/smartlibrary/v2/en/dictionaries/options/lookup endpoint.

CVE-2025-51506 is a SQL injection vulnerability identified in the smartLibrary component of the HRForecast Suite version 0.4.3. The vulnerability exists specifically in the valueKey parameter of the API endpoint api/smartlibrary/v2/en/dictionaries/options/lookup. An authenticated user can exploit this flaw by sending crafted payloads to the valueKey parameter, which allows arbitrary SQL queries to be executed against the backend database. This type of injection attack can lead to unauthorized data access, data manipulation, or even complete compromise of the database depending on the privileges of the database user. Since exploitation requires authentication, the attacker must have valid credentials or be able to bypass authentication mechanisms. However, once authenticated, the attacker can leverage this vulnerability to escalate privileges, extract sensitive information, modify or delete data, or disrupt application functionality. The lack of a CVSS score suggests that the vulnerability has not yet been fully assessed or scored, but the technical details confirm the presence of a critical injection flaw. No public exploits are currently known in the wild, and no patches or fixes have been linked yet. The vulnerability was reserved in June 2025 and published in August 2025, indicating it is a recent discovery. The absence of affectedVersions data beyond 0.4.3 limits precise scope determination, but organizations using this specific version of HRForecast Suite are at risk.

Detailed information about CVE-2025-51506: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-51506: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-51506: n/a

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for cross site scripting. This vulnerability is fixed in 11.10.0.

CVE-2025-54880 is a medium severity cross-site scripting (XSS) vulnerability affecting the mermaid-js mermaid library, specifically versions from 11.1.0 up to but not including 11.10.0. Mermaid is a JavaScript-based diagramming and charting tool that enables users to create complex diagrams using Markdown-inspired text definitions. The vulnerability arises because user-supplied input for architecture diagram icons is passed directly to the d3.js html() method without proper sanitization or neutralization. This creates a sink for reflected or stored XSS attacks, where malicious scripts can be injected and executed in the context of the user's browser. The vulnerability is classified under CWE-79, indicating improper neutralization of input during web page generation. Exploitation requires no authentication but does require some user interaction (e.g., viewing a crafted diagram). The CVSS 4.0 base score is 5.1, reflecting a medium severity level due to network attack vector, low complexity, no privileges required, but user interaction needed and limited scope impact. No known exploits are currently reported in the wild. The issue was resolved in mermaid version 11.10.0 by properly sanitizing or escaping user inputs before passing them to the d3 html() method, preventing script injection. This vulnerability primarily affects web applications and services that embed or allow user-generated Mermaid diagrams with architecture icons, especially those that do not sanitize or validate input before rendering. Attackers could leverage this vulnerability to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or other client-side attacks.

Detailed information about CVE-2025-54880: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in mermaid-js mermaid af

CVE-2025-54880: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in mermaid-js mermaid - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-54880: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in mermaid-js mermaid

A vulnerability has been found in jasonclark getsemantic up to 040c96eb8cf9947488bd01b8de99b607b0519f7d. The impacted element is an unknown function of the file /index.php. The manipulation of the argument view leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-9147 is a Cross Site Scripting (XSS) vulnerability identified in the 'getsemantic' product developed by jasonclark. The vulnerability exists in an unspecified function within the /index.php file, where the 'view' argument can be manipulated by an attacker to inject malicious scripts. This flaw allows remote attackers to execute arbitrary JavaScript code in the context of the victim's browser without requiring authentication. The vulnerability is present in versions up to commit 040c96eb8cf9947488bd01b8de99b607b0519f7d. The product follows a rolling release model, so specific version numbers are not provided, complicating patch management. The vendor was notified early but did not respond, and no official patch or update has been released at the time of disclosure. The CVSS 4.0 base score is 5.1, indicating a medium severity, with the vector showing network attack vector, low attack complexity, no privileges required, but user interaction is necessary. The vulnerability impacts confidentiality and integrity to a limited extent by enabling script execution that could steal session tokens, perform actions on behalf of users, or manipulate displayed content. No known exploits are currently in the wild, but public disclosure increases the risk of exploitation. The lack of vendor response and patch availability means organizations must rely on mitigation strategies until an official fix is released.

Detailed information about CVE-2025-9147: Cross Site Scripting in jasonclark getsemantic affecting jasonclark getsemantic. Get real-time updates, technical deta

CVE-2025-9147: Cross Site Scripting in jasonclark getsemantic - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-9147: Cross Site Scripting in jasonclark getsemantic

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 10.9.0-rc.1 to 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.

Detailed information about CVE-2025-54881: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in mermaid-js mermaid af