ABB AC500 V2 安全漏洞

ABB AC500 V2 is a PLC from ABB Switzerland. suitable for simple control tasks and complex automation solutions. A security vulnerability exists in ABB AC500 V2 version 2.5.2 and earlier, which stems from vulnerability to buffer over-reading attacks...

The vulnerability of the API interface of the boiler controller MyHeat GO allows a hacker to gain unauthorized access to the controller.

The vulnerability of the API interface of the boiler control controller MyHeat GO is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the controller...

The vulnerability of the upnp_ctrl_asp() function in the JHTTPD web server of the D-Link DI-8100 router’s microprogramming software allows a intruder to trigger a service failure.

The vulnerability of the upnpctrlasp function in the JHTTPD web server of the D-Link DI-8100 microprogrammed router software is related to the execution of operations outside the buffer in memory when processing the removeextproto and removeextport parameters. Exploitation of this vulnerability...

CVE-2025-47281 Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service DoS vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via improper handling of JMESPath variable substitutions in the getValueAsStringMap function within pkg/engine/wildcards/wildcards.go. An attacker can cause the admission controller and reports controller to crash by...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the downloadFile function in the ModuleController.php file, which fails to validate the query parameter file. An authenticated attacker with access to the backend module can access...

DB-GPT 命令注入漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT version 0.7.0, which stems from a file upload vulnerability in agent.hub.controller.refreshplugins that could lead to the execution of arbitrary...

CVE-2025-7936

A vulnerability has been found in fuyanglipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a and classified as critical. Affected by this vulnerability is the function queryPage of the file com/platform/controller/ScheduleJobLogController.java. The manipulation of the argument...

CVE-2025-7934

A vulnerability, which was classified as critical, has been found in fuyanglipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a. This issue affects the function queryPage of the file platform-schedule/src/main/java/com/platform/controller/ScheduleJobController.java. The manipulation ...

Weitong Mall 注入漏洞

Weitong Mall Weitong Mall is a shopping mall system by fuyanglipengjun, an individual developer. Weitong Mall has an injection vulnerability, the vulnerability stems from a SQL injection problem in the function queryPage in the file...

JPACookieShop 代码问题漏洞

JPACookieShop is a cake mall platform software by Jerryshensjf individual developer. A code issue vulnerability exists in JPACookieShop version 1.0, which stems from an incorrect operation of the function addGoods in the file GoodsController.java resulting in unlimited uploads...

TRENDnet TEW-WLC100P 安全漏洞

The TRENDnet TEW-WLC100P is a wireless LAN controller from Trendnet, Inc. A security vulnerability exists in the TRENDnet TEW-WLC100P version 2.03b03, which stems from enabling aggressive mode in the racoon configuration file, which could lead to an offline dictionary attack...

CVE-2025-7906 yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to unrestricted upload. The...

Thinkgem JeeSite 代码问题漏洞

Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform of China Joyuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components , workflo...

GHSA-565H-44M8-4C2V xxl-job has Inadequate Encryption Strength

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with...

CVE-2025-7763

CVE-2025-7763 affects thinkgem JeeSite up to version 5.12.0. The vulnerability lies in the Site Controller’s SiteController.java, where manipulation of the redirect argument in the select function causes an open redirect. Exploitation can be performed remotely, and public disclosure of the exploi...

CVE-2025-7763 thinkgem JeeSite Site Controller SiteController.java select redirect

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...

CVE-2025-41238

VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI Paravirtualized SCSI controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine'...

Thinkgem JeeSite 输入验证错误漏洞

Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform of China Zhuo Yuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components ,...

PT-2025-29981

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0 Description A problematic vulnerability exists in thinkgem JeeSite. The select function within the src/main/java/com/jeesite/modules/cms/web/SiteController.java file of the Site Controller component is...