171980 matches found
CVE-2025-62250
Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Lifer...
CVE-2025-62250
CVE-2025-62250 describes an Improper Authentication flaw in Liferay Portal/DXP where remote attackers can send unauthenticated cluster messages that are treated as trusted data. Affected products include Liferay Portal 7.4.0 through 7.4.3.132 and older unsupported versions, and Liferay DXP 2023.Q...
CVE-2025-11949 Digiwin｜EasyFlow .NET and EasyFlow AiNet - Missing Authentication
EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality...
CVE-2025-62648
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
CVE-2025-62646
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...
CVE-2025-6515 Reuse of session IDs in oatpp-mcp leads to session hijacking and prompt hijacking by remote attackers
The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses...
GLPI Authentication Bypass
The vulnerability of the GLPI system for requests, incidents, and inventory management involves bypassing authentication using a password. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and modify protected information...
Idea Platform Service Manager Account Access
The vulnerability of the software solution for comprehensive enterprise management, Idea Platform Service Manager, is related to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain control of other users’ accounts...
MediaWiki AuthManager Unauthorized Access
The vulnerability of the AuthManager component of the MediaWiki software environment relates to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the compromised system by creating an...
CVE-2025-62648
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
CVE-2025-62648
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
CVE-2025-62646
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...
EUVD-2025-34858
The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...
CVE-2025-11898 Flowring Technology｜Agentflow - Arbitrary File Reading through Path Traversal
Agentflow developed by Flowring has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...
CVE-2025-62648
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
CVE-2025-62648
CVE-2025-62648 affects Restaurant Brands International (RBI) assistant platform versions up to 2025-09-06. The connected CSAF document details multiple vulnerabilities: an unauthenticated account creation path via a signup API, cleartext transmission of passwords in email, a token with administra...
CVE-2025-62648: Incorrect Authorization
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
CVE-2025-56316
The MCMS content management system (versions 5.5.0 through 6.0.1 ) is vulnerable to a SQL injection vulnerability (CWE-89). The root cause is the improper sanitization of the content_title parameter within the /cms/content/list endpoint during FreeMarker template rendering . This flaw allows remo...
EUVD-2025-34926
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...