CVE-2025-10837

A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /ordersimple/order.php. The manipulation of the argument ID leads to cross site scripting. The attack may be initiated remotely. The...

CVE-2025-58029

Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classic Widgets with Block-based Widgets: from n/a through = 1.0.1...

CVE-2025-57983: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Damian BP Disable Activation Reloaded bp-disable-activation-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Disable Activation Reloaded: from n/a through = 1.2.1...

CVE-2025-57432

Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands. This service allows remote attackers to manipulate stream settings, including changing video modes and possibly altering device functionality. No credentials or authentication...

CVE-2025-57907: Missing Authorization

Missing Authorization vulnerability in Heureka Group Heureka heureka allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Heureka: from n/a through = 1.1.0...

CVE-2025-57899: Missing Authorization

Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Compress: from n/a through = 6.50.54...

CVE-2025-58000: Missing Authorization

Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a through = 1.75.0...

CVE-2025-58029: Missing Authorization

Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classic Widgets with Block-based Widgets: from n/a through = 1.0.1...

Multiple vulnerabilities in I-O DATA wireless LAN routers

Overview Wireless LAN routers provided by I-O DATA DEVICE, INC. contains multiple vulnerabilities listed below. Hidden functionality CWE-912 - CVE-2025-55075 OS command injection CWE-78 - CVE-2025-58116 Chuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinat...

CVE-2025-55075

Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker...

CVE-2025-10618 itsourcecode Online Clinic Management System transact.php sql injection

A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file transact.php. Such manipulation of the argument firstname leads to sql injection. The attack may be launched remotely. The exploit has...

CVE-2025-55075

Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker...

CVE-2025-55075

Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker...

CVE-2025-55075

Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker...

CVE-2025-55075

CVE-2025-55075 affects I-O DATA WN-7D36QR and WN-7D36QR/UE. A hidden functionality issue may allow a remote authenticated attacker to enable SSH. Impact is that SSH could be enabled remotely (no user interaction required). The issue is exploitable over the network with privileges required as High...

CVE-2025-55075: Hidden Functionality

Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker...

PT-2025-38106

Name of the Vulnerable Software and Affected Versions: WN-7D36QR WN-7D36QR/UE Description: A hidden functionality issue exists that may allow a remote authenticated attacker to enable SSH access. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

Use of Low-Level Functionality

Overview Affected versions of this package are vulnerable to Use of Low-Level Functionality through improper validation of user-supplied input. An attacker can execute arbitrary code or compromise user data by enticing a victim to visit a malicious website. Remediation Upgrade thunderbird to...

Use of Low-Level Functionality

Overview Affected versions of this package are vulnerable to Use of Low-Level Functionality through improper validation of user-supplied input. An attacker can execute arbitrary code or compromise user data by enticing a victim to visit a malicious website. Remediation Upgrade Firefox to version...

CVE-2025-59055: Server-Side Request Forgery (SSRF)

InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery SSRF vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS...