CVE-2025-12266

CVE-2025-12266 affects Zytec Dalian Zhuoyun Technology Central Authentication Service. The vulnerability is in the function _empty of /index.php/auth/widget; manipulation of the parameters get.layer, get.widget, and get.action can trigger remote code injection. The exploit is public and can be us...

CVE-2025-12253

A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/getexpiredtime.php. This manipulation of the argument uid causes sql injection. The attack may be initiated remotely. The exploit has be...

CVE-2025-12243

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated...

EUVD-2025-36125

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated...

CVE-2025-12243 code-projects Client Details System GET Parameter welcome.php sql injection

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated...

CVE-2025-12211

A security flaw has been discovered in Tenda O3 1.0.0.102478. Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-12213

CVE-2025-12213 affects Tenda O3 1.0.0.10(2478). The vulnerability is a stack-based overflow in the SetValue/GetValue handling of /goform/setVlanConfig via crafted lan input, enabling remote exploitation. Public disclosures exist. Connected sources (CNVD/CNNVD/NVD/PT-2025-43873) corroborate a buff...

CVE-2025-12210 Tenda O3 AdvSetLanip GetValue stack-based overflow

A vulnerability was identified in Tenda O3 1.0.0.102478. Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is...

Zytec Central Authentication Service code injection vulnerability

Zytec Central Authentication Service is a centralized authentication service from China's Zhuo Yun Zytec Company. A code injection vulnerability exists in Zytec Central Authentication Service 20251009 and earlier versions, which stems from incorrect manipulation of the parameters get.layer,...

AMTT Hotel Broadband Operation System SQL Injection Vulnerability

AMTT Hotel Broadband Operation System is a hotel broadband operation system from China-based AMTT. A SQL injection vulnerability exists in AMTT Hotel Broadband Operation System version 1.0, which originates from an incorrect manipulation of the parameter uid in the file...

CVE-2025-12243: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated...

PT-2025-43899

Name of the Vulnerable Software and Affected Versions code-projects Client Details System version 1.0 Description A flaw exists in the GET Parameter Handler component of the software, specifically within the clientdetails/welcome.php file. Manipulation of the ID parameter can lead to a SQL...

Siemens SIMATIC Devices Improper Input Validation (CVE-2024-27047)

Vulnerablity in Linux kernel: net: phy: phygetinternaldelay accessing an empty array The phygetinternaldelay function could try to access to an empty array in the case that the driver is calling phygetinternaldelay without defining delayvalues and rx-internal- delay-ps or tx-internal-delay-ps is...

ncc2 for D-Link DIR-820L Unauthorized Access

The vulnerability of the ncc2 microprogramming software for D-Link DIR-820L routers is related to deficiencies in access control when processing the /getset.ccp endpoint. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protect...

CVE-2025-27222

TRUfusion Enterprise versions up to and including 7.10.4.0 are vulnerable to a pre-auth path traversal vulnerability in the /trufusionPortal/getCobrandingData endpoint. The root cause is insufficient input sanitization, which allows attackers to include path traversal sequences to read arbitrary ...

CVE-2025-4203

The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the getmembers function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'rowcount' parameters. The function blindly interpolates 'rowcount' into a...

EUVD-2025-35921

The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the getmembers function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'rowcount' parameters. The function blindly interpolates 'rowcount' into a...

CVE-2025-53701

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...

Malicious code in cooler-loans-api-get (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bf5016290eaec4debcd0e35dda5e684927f8e80c05f9ca16252c71ea8cca6de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48601 Malicious code in cooler-loans-api-get (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bf5016290eaec4debcd0e35dda5e684927f8e80c05f9ca16252c71ea8cca6de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...