31681 matches found
CVE-2025-55443
Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details IP/port that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to: 1. Authenticate to the MDM web platfor...
📄 Ilevia EVE X1/X5 Server 4.7.18.0.eden Authentication Bypass
Ilevia EVE X1/X5 Server versions 4.7.18.0.eden and below construct a shell command using unsanitized user input passed to the system function, calling an external binary for authentication. Due to improper input handling and reliance on the binary's return value for access control, an attacker ca...
Adobe Commerce/Magento XXE Vulnerability (APSB24-40)
The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7 2.4.7-p1 Adobe Commerce / 2.4.6 2.4.6-p6 Adobe Commerce / 2.4.5 2.4.5-p8 Adobe Commerce / 2.4.4 2.4.4-p9 Adobe Commerce / 2.4.3 2.4.3-ext-8 Adobe Commerce / 2.4.2...
CVE-2025-55443
Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details IP/port that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to: 1. Authenticate to the MDM web platfor...
CVE-2024-45753
In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute...
Apache StreamPark SQL Injection Vulnerability
Apache StreamPark is the United States Apache Apache Foundation of a streaming media application development framework. A SQL injection vulnerability exists in Apache StreamPark versions 2.1.4 through 2.1.6 and earlier, which stems from the application's lack of validation of externally entered S...
PT-2025-34818 · Agiloft · Agiloft
Name of the Vulnerable Software and Affected Versions: Agiloft versions prior to 31 Description: Agiloft Release 28 contains an XML External Entities issue in any table that allows 'import/export'. An authenticated attacker can import a template file and perform path traversal on local system...
CVE-2025-55443
Affected product: Telpo MDM Android, versions 1.4.6–1.4.9. Vulnerability: Sensitive administrator credentials and MQTT server connection details are stored in plaintext in log files on external storage, enabling access to the MDM web platform to perform administrative operations and to the MQTT s...
Agiloft 安全漏洞
Agiloft is a contract management platform from Agiloft Corporation in the United States. A security vulnerability exists in Agiloft that stems from XML external entity injection and could lead to path traversal...
PT-2025-34746
Name of the Vulnerable Software and Affected Versions: Delta Electronics EIP Builder version 1.11 Description: Delta Electronics EIP Builder version 1.11 is susceptible to a file parsing XML External Entity XXE processing information disclosure issue. This allows for the potential disclosure of...
CVE-2025-52219
CVE-2025-52219 affects SelectZero Data Observability Platform older than 2025.5.2, where an Open Redirect vulnerability exists due to legacy UI fields allowing arbitrary external links via HTML Injection. Affected component is the web UI frontend, with the root cause described as an open redirect...
Ilevia EVE X1/X5 Server 4.7.18.0.eden Authentication Bypass Exploit
Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...
MAL-2025-42030 Malicious code in msmg-frontend-task (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-41910 Malicious code in @espace-client-axafr/user-profile (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-41895 Malicious code in @espace-client-axafr/savings-card (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-41899 Malicious code in @espace-client-axafr/savings-webservices (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-41884 Malicious code in @espace-client-axafr/redirection-angel (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-41868 Malicious code in @espace-client-axafr/mes-documents-contrat (npm)
The package communicates with a domain associated with malicious activity...