CVE-2025-52575 EspoCRM vulnerable to LDAP Injection through Improper Neutralization of Special Elements

EspoCRM is an Open Source CRM Customer Relationship Management software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard...

IBM OpenPages with Watson Encryption Issue Vulnerability

IBM OpenPages with Watson is an AI-powered financial risk analytics solution from International Business Machines IBM. The platform is based on AI technology to predict risk factors and minimize risks in financial activities by integrating, automatically identifying, measuring, monitoring,...

HAXiam 安全漏洞

HAXiam is a HAX The Web open source This is a wrapper for the HAXcms software. A security vulnerability exists in HAXiam version 11.0.4 and earlier, which stems from an improper response to a user data request and could lead to a user enumeration attack...

The vulnerability of the Microsoft Visual Studio Code Python Extension, related to breach of confidentiality boundaries, allows the attacker to execute arbitrary code.

The vulnerability of the Microsoft Visual Studio Code Python Extension is related to a breach of trust boundaries. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Two App Studio Journey 安全漏洞

Two App Studio Journey is a cross-platform digital journaling application from Two App Studio Singapore. A security vulnerability exists in Two App Studio Journey version 5.5.6, which stems from insufficient protection of the local authentication component and could result in biometric and PIN...

Digiwin SFT SQL注入漏洞

Digiwin SFT is a production tracking system from China-based Digiwin. A SQL injection vulnerability exists in Digiwin SFT, which can be exploited by an unauthenticated, remote attacker to inject arbitrary SQL commands that could result in reading, modifying, and deleting database content...

Unspecified Vulnerability in Oracle Java SE (CNVD-2025-24098)

Oracle Java SE is a U.S. Oracle Oracle company for the development and deployment of desktop, server and embedded devices and real-time environments in the Java application. A security vulnerability exists in Oracle Java SE for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers in RuoYi, China. A security vulnerability exists in RuoYi 4.8.1 and earlier versions, which stems from the use of default credentials by the Druid component...

RuoYi 安全漏洞

RuoYi is a backend management system by the individual developer of RuoYi in China. A security vulnerability exists in RuoYi 4.8.1 and earlier versions, which stems from an improper restriction of the rendering UI layer of the Image Source Handler component...

RuoYi 安全漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A security vulnerability exists in RuoYi 4.8.1 and earlier versions, which originates from the incorrect operation of the File parameter File in the function uploadFile in the file...

China’s Salt Typhoon Hackers Breached the US National Guard for Nearly a Year

Plus: Secret IRS data-sharing with ICE, a 20-year-old hackable vulnerability in train brakes, and more...

CVE-2025-20285

A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address. This vulnerability is due to improper enforcement of access controls...

Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai

Security researchers recently revealed that the personal information of millions of people who applied for jobs at McDonald 's was exposed after they guessed the password "123456" for the fast food chain's account at Paradox.ai , a company that makes artificial intelligence based hiring chatbots...

StudentManage 安全漏洞

StudentManage is a student management system by DayCloud Individual Developer in China. A security vulnerability exists in StudentManage version 1.0, which stems from the mishandling of the Add A New Teacher module and could lead to a cross-site scripting attack...

StudentManage 安全漏洞

StudentManage is a student management system by DayCloud Individual Developer in China. A security vulnerability exists in StudentManage version 1.0, which stems from vulnerability to cross-site request forgery attacks...

StudentManage 安全漏洞

StudentManage is a student management system by DayCloud Individual Developer in China. A security vulnerability exists in StudentManage version 1.0, which stems from improper handling of the component /admin/adminStudentUrl, which could lead to an SQL injection attack...

WordPress plugin Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

CVE-2025-7397 CLI history displays inline passwords

A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface CLI in plain text within the command history. A local authenticated user that can access sensitive information like passwords within the CLI history leading to unauthorized...

MAL-2025-5996 Malicious code in @jssrv/template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce87403bb05aae59ca8877b014a3a8255b54b2a22e930687649c675cc9602f76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Massive Data Leak at Texas Adoption Agency Exposes 1.1 Million Records

Texas adoption agency suffers major data leak, exposing over 1.1M sensitive records including case notes, contact info, and internal communications to public without any security authentication or password...