PT-2025-35590

Name of the Vulnerable Software and Affected Versions: Samsung Magician versions 6.3 through 8.3 Description: An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file delete operations during the update process. Recommendations: Update Samsung Magician to a version...

CVE-2025-32098

CVE-2025-32098 affects Samsung Magician (Windows) versions 6.3–8.3. The root cause is an insecure file-delete operation during the update process, which can allow an attacker to achieve elevation of privilege to SYSTEM . The CVSS v3.1 vector indicates a low attack complexity with no user interact...

SAMSUNG Magician 安全漏洞

SAMSUNG Magician is an application from the South Korean company Samsung SAMSUNG. Designed to help manage Samsung SSDs. A security vulnerability exists in Samsung Magician versions 6.3 through 8.3, which stems from an insecure file deletion operation during the update process that could result in...

PHPGurukul Employee Leave Management System 安全漏洞

PHPGurukul Employee Leave Management System is an employee leave management system from PHPGurukul Inc. A security vulnerability exists in PHPGurukul Employee Leave Management System version 2.1, which stems from improper handling of the leaveid parameter and could lead to an insecure direct obje...

CVE-2025-56254

PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference IDOR vulnerability in leave-details.php. An authenticated user can change the leaveid parameter in the URL to access leave application details of other users...

PT-2025-35564

Name of the Vulnerable Software and Affected Versions: PHPGurukul Employee Leave Management System version 2.1 Description: The software contains an Insecure Direct Object Reference IDOR vulnerability in the leave-details.php file. An authenticated user can modify the leaveid parameter within the...

WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Miraculous Core Plugin versions 2.0.9...

Exploit for CVE-2025-53691

CVE-2025-53691: Remote code execution RCE through insecure...

ASB-A-401545800

In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-389127608

In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecure default value. This could lead to remote proximal/adjacent information disclosure with no additional execution privileges needed. User interaction is not...

CVE-2025-50722

Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component...

CVE-2025-9474

A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach...

CVE-2025-45968

An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contains an Insecure Direct Object Reference IDOR vulnerability, which occurs due to a lack of proper authorization checks when accessing objects referenced by thi...

CVE-2025-9578

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 40734...

CVE-2009-20011

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as t...

CVE-2009-20011

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as t...

Linux Distros Unpatched Vulnerability : CVE-2018-6829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive...

CVE-2025-40702 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH

Cross-Site Scripting XSS vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage ACDH-CH, due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an...

Multiple vulnerabilities in multiple iND products

Overview Multiple products provided by iND Co.,Ltd contain multiple vulnerabilities listed below. Insecure storage of sensitive information CWE-922 - CVE-2025-53507 OS command injection CWE-78 - CVE-2025-53508 HL330-DLS, HL320-DLS Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported...

CVE-2025-53507

Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploited, configuration information, such as admin password, may be disclosed. As for the details of affected product names and versions, refer to the information under Product Status...