Linux Distros Unpatched Vulnerability : CVE-2025-40029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bus: fsl-mc: Check return value of platformgetresource platformgetresource returns NULL in case of failure, so check its return value and propagate the error in...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from uninitialized access to the parent field in the squashfsgetparent function, which could lead to invalid...

CVE-2025-60800

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

CVE-2025-12266

CVE-2025-12266 affects Zytec Dalian Zhuoyun Technology Central Authentication Service. The vulnerability is in the function _empty of /index.php/auth/widget; manipulation of the parameters get.layer, get.widget, and get.action can trigger remote code injection. The exploit is public and can be us...

CVE-2025-12253

A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/getexpiredtime.php. This manipulation of the argument uid causes sql injection. The attack may be initiated remotely. The exploit has be...

CVE-2025-12243

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated...

EUVD-2025-36125

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated...

CVE-2025-12243 code-projects Client Details System GET Parameter welcome.php sql injection

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated...

CVE-2025-12211

A security flaw has been discovered in Tenda O3 1.0.0.102478. Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-12213

CVE-2025-12213 affects Tenda O3 1.0.0.10(2478). The vulnerability is a stack-based overflow in the SetValue/GetValue handling of /goform/setVlanConfig via crafted lan input, enabling remote exploitation. Public disclosures exist. Connected sources (CNVD/CNNVD/NVD/PT-2025-43873) corroborate a buff...

CVE-2025-12210 Tenda O3 AdvSetLanip GetValue stack-based overflow

A vulnerability was identified in Tenda O3 1.0.0.102478. Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is...

PT-2025-43873

Name of the Vulnerable Software and Affected Versions Tenda O3 version 1.0.0.102478 Description A security issue exists in Tenda O3 version 1.0.0.102478. The SetValue/GetValue function within the /goform/setVlanConfig file is susceptible to a stack-based buffer overflow. This occurs through...

AMTT Hotel Broadband Operation System SQL注入漏洞

AMTT Hotel Broadband Operation System is a hotel broadband operation system from China-based AMTT. A SQL injection vulnerability exists in AMTT Hotel Broadband Operation System version 1.0, which originates from an incorrect manipulation of the parameter uid in the file...

Zytec Central Authentication Service 代码注入漏洞

Zytec Central Authentication Service is a centralized authentication service from China's Zhuo Yun Zytec Company. A code injection vulnerability exists in Zytec Central Authentication Service 20251009 and earlier versions, which stems from incorrect manipulation of the parameters get.layer,...

PT-2025-43899

Name of the Vulnerable Software and Affected Versions code-projects Client Details System version 1.0 Description A flaw exists in the GET Parameter Handler component of the software, specifically within the clientdetails/welcome.php file. Manipulation of the ID parameter can lead to a SQL...

Siemens SIMATIC Devices Improper Input Validation (CVE-2024-27047)

Vulnerablity in Linux kernel: net: phy: phygetinternaldelay accessing an empty array The phygetinternaldelay function could try to access to an empty array in the case that the driver is calling phygetinternaldelay without defining delayvalues and rx-internal- delay-ps or tx-internal-delay-ps is...

CVE-2025-27222

TRUfusion Enterprise ≤ 7.10.4.0 is impacted by a pre-auth path-traversal in the /trufusionPortal/getCobrandingData endpoint. The unsanitized input can cause the traversal sequences to be processed, allowing an unauthenticated attacker to read arbitrary local files accessible to the TRUfusion user...

CVE-2025-4203

The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the getmembers function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'rowcount' parameters. The function blindly interpolates 'rowcount' into a...

EUVD-2025-35921

The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the getmembers function in all versions up to, and including, 2.4.8 due to missing integer validation on the 'offset' and 'rowcount' parameters. The function blindly interpolates 'rowcount' into a...

CVE-2025-53701

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...