CVE-2023-41471

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can...

CVE-2025-48979

A flaw was found in uisp. Improper input validation allows a command injection vulnerability, enabling a local attacker with high privileges to execute arbitrary commands. This exploitation occurs through crafted input to the application. The consequence of successful exploitation is limited to...

CVE-2025-58323

NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to improper privilege checks...

CVE-2025-58323

NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to improper privilege checks...

CVE-2025-56577

An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys...

PT-2025-35301

Name of the Vulnerable Software and Affected Versions: copyparty version 1.9.1 Description: A Cross Site Scripting issue exists in copyparty version 1.9.1. A local attacker can execute arbitrary code by using a crafted payload targeting the WEEKEND-PLANS function. Recommendations: Update to a new...

CVE-2025-56577

CVE-2025-56577 describes a vulnerability in Evope Core v1.1.3.20 where a local attacker can obtain sensitive information due to the use of hard-coded cryptographic keys. The available connected sources corroborate the affected product/version and the cryptographic-key issue, with CVSSv3.1 base sc...

CVE-2025-56577

An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys...

PT-2025-35307

Name of the Vulnerable Software and Affected Versions: Evope Core version 1.1.3.20 Description: An issue allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys. Recommendations: At the moment, there is no information about a newer version that contain...

CVE-2023-41471

Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can...

CVE-2023-41471

CVE-2023-41471 affects copyparty prior to 1.9.2, enabling Cross-Site Scripting via the WEEKEND-PLANS function. The vulnerability is exploitable by a local attacker (with write access) and can lead to arbitrary code execution in the user's browser. Some sources note debate over the practical impac...

CVE-2025-48979

An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access...

CVE-2025-9195

Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of Service...

CVE-2025-9195

CVE-2025-9195 affects Solidigm DC Products firmware. The vulnerability is due to improper input validation in the firmware, which could allow a local attacker (requires high privileges) to trigger a Denial of Service (A: high). The CVSS from the entry is CVSS3.1: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A...

CVE-2025-54542

QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or...

CVE-2025-54542

QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or...

CVE-2025-58322

NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to improper privilege checks...

GE Vernova CIMPLICITY

RISK EVALUATION Successful exploitation of this vulnerability could allow a low-privileged local attacker to escalate privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure...

PT-2025-35123

Name of the Vulnerable Software and Affected Versions Solidigm DC Products affected versions not specified Description Improper input validation in the firmware may allow an attacker with local access to cause a Denial of Service. Recommendations At the moment, there is no information about a new...

PT-2025-35151

Name of the Vulnerable Software and Affected Versions: UISP Application affected versions not specified Description: An improper input validation issue exists in the UISP Application. This could allow a malicious actor with high privileges and local access to execute commands through command...