CVE-2025-3009

The CVE-2025-3009 entry concerns Jinher Network OA C6, specifically an SQL injection in the NetDiskProperty.aspx file (/C6/JHSoft.Web.NetDisk/NetDiskProperty.aspx) caused by manipulation of the ID parameter. Documents indicate remote exploitation possibilities and a publicly disclosed exploit. Se...

CVE-2025-3002

CVE-2025-3002 affects Digital China DCME-520 up to 20250320. The issue is an OS command injection caused by incorrect handling of the parameter named type_name in the file /usr/local/WWW/function/audit/newstatistics/mon_merge_stat_hist.php. The vulnerability can be exploited remotely and the expl...

CVE-2025-2993

A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14408. Affected by this issue is some unknown functionality of the file /default.cfg. The manipulation of the argument these leads to improper access controls. The attack may be launched remotely. The exploit...

CVE-2025-2984

Code-projects Payroll Management System 1.0 is affected by a remote SQL injection in the /delete.php script via the emp_id parameter. Root cause: improper handling/exposure of the emp_id argument leads to injection. Exploit has been disclosed publicly. Impact per sources includes confidentiality/...

CVE-2025-2973

The CVE-2025-2973 entry concerns code-projects College Management System 1.0. A vulnerability exists in an unknown portion of /Admin/student.php where manipulation of the profile_image parameter enables unrestricted file upload. This could allow remote execution of arbitrary code, as described ac...

[SECURITY] Fedora 40 Update: libxml2-2.12.10-1.fc40

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

CVE-2025-2854

A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file updateemployee.php. The manipulation of the argument emptype leads to sql injection. The attack can be launched remotely. The...

CVE-2025-2712

A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploi...

CVE-2025-2709

CVE-2025-2709 affects Yonyou UFIDA ERP-NC 5.0. The issue is a reflected cross-site scripting (XSS) vulnerability in /login.jsp caused by unsanitized input in the key/redirect parameters. An attacker can remotely trigger the vulnerability; the exploit has been disclosed publicly. The Nuclei templa...

CVE-2025-2623

A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/cms/content/save. The manipulation of the argument title/content/laiyuan leads to cross site scripting. The attack can be launch...

CVE-2025-2682

CVE-2025-2682 pertains to PHPGurukul Bank Locker Management System 1.0. The vulnerability is a SQL injection triggered by manipulating the mobilenumber parameter in /edit-subadmin.php?said=3, with remote exploitation possible. Multiple connected sources confirm the issue and public disclosure, in...

CVE-2025-2640 PHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php sql injection

A vulnerability was found in PHPGurukul Doctor Appointment Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /doctor/appointment-bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack...

CVE-2025-0452

eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '' character, which is commonly used as a separator in Windows paths. This vulnerability allows attackers to delete...

CVE-2025-2606

CVE-2025-2606 affects SourceCodester Best Church Management Software 1.0. The vulnerability arises from improper handling of the photo/photo1 parameter in /admin/app/soulwinning_crud.php, enabling unrestricted file upload. It is possible to trigger remotely, and the exploit has been disclosed pub...

CVE-2024-7631 Openshift-console: openshift console: path traversal

A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.goL112 Because of this unsafe filepath construction, an...

CVE-2025-2386

CVE-2025-2386 affects PHPGurukul Local Services Search Engine Management System v1.0. The vulnerability is a SQL injection caused by manipulation of the location parameter in serviceman-search.php, reported as exploitable remotely (network). The linked sources confirm the issue but do not provide...

CVE-2025-2120

A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been rated as problematic. This issue affects some unknown processing of the file /tmp/hostapd.conf of the component Configuration File Handler. The manipulation leads to cleartext storage in a file or on disk. It ...

[SECURITY] Fedora 42 Update: libxml2-2.12.10-1.fc42

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

CVE-2025-27397

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0. Affected devices do not properly limit user controlled paths to which logs are written and from where they are read. This could allow an authenticated highly-privileged remote attacker to read and write...

LoveCards code-related vulnerabilities

LoveCards is an open source confession wall program by LoveCards. A code issue vulnerability exists in LoveCards 2.3.2 and earlier versions, which stems from the fact that incorrect manipulation of the parameter file can lead to unlimited uploads, potentially leading to remote attacks...