CVE-2025-64325 Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard

Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has...

CVE-2025-63883

A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 Bhabishya-123/E-commerce. The site's client-side JavaScript reads attacker-controlled input for example, values derived from the URL or page fragment and inserts it into the DOM via unsafe sinks...

SourceCodester Train Station Ticketing System SQL注入漏洞

SourceCodester Train Station Ticketing System is SourceCodester open source a train station ticketing system. A SQL injection vulnerability exists in SourceCodester Train Station Ticketing System version 1.0, which stems from an incorrect operation of the function saveticket in the file /ajax.php...

itsourcecode Student Information System SQL注入漏洞

itsourcecode Student Information System is an open source student information system by itsourcecode. The SQL injection vulnerability exists in itsourcecode Student Information System version 1.0, which originates from incorrect manipulation of the parameter enid in the file /enrollmentedit1.php,...

itsourcecode Online Voting System SQL注入漏洞

Online Voting System is an online voting system. Online Voting System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter id/category in the file /index.php. An attacker can exploit this vulnerability to...

CampCodes Supplier Management System SQL注入漏洞

CampCodes Supplier Management System is a supplier management system from CampCodes, Inc. A SQL injection vulnerability exists in Campcodes Supplier Management System version 1.0, which stems from incorrect manipulation of the parameter ID in the file /manufacturer/editunit.php, which could lead ...

SourceCodester Dental Clinic Appointment SQL注入漏洞

SourceCodester Dental Clinic Appointment is SourceCodester open source a dental clinic appointment system . A SQL injection vulnerability exists in SourceCodester Dental Clinic Appointment version 1.0, which stems from incorrect manipulation of the parameters username/password in the file...

PT-2025-47173

Name of the Vulnerable Software and Affected Versions Campcodes Supplier Management System version 1.0 Description A flaw exists in Campcodes Supplier Management System that allows for SQL injection. This issue affects the /manufacturer/confirm order.php file. Manipulation of the ID argument can...

CampCodes Supplier Management System SQL注入漏洞

CampCodes Supplier Management System is a supplier management system from CampCodes, Inc. A SQL injection vulnerability exists in Campcodes Supplier Management System version 1.0, which stems from incorrect manipulation of the parameter ID in the file /manufacturer/confirmorder.php, which could...

PT-2025-47070

Name of the Vulnerable Software and Affected Versions itsourcecode Inventory Management System version 1.0 Description A flaw exists in itsourcecode Inventory Management System 1.0 that allows for remote SQL injection. The issue is located in the file /admin/products/index.php?view=edit,...

SourceCodester Farm Management System 安全漏洞

SourceCodester Farm Management System is an open source farm management system from SourceCodester. A security vulnerability exists in SourceCodester Farm Management System version 1.0, which stems from an exposed directory listing and could lead to information disclosure...

PT-2025-47057

Name of the Vulnerable Software and Affected Versions Simple Cafe Ordering System version 1.0 Description A SQL injection issue exists in Simple Cafe Ordering System 1.0. The issue is related to the manipulation of the Username parameter within the /login.php file. This manipulation can be...

CVE-2025-54560

A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of internal infrastructure...

EUVD-2025-175314

js-yaml has prototype pollution in merge...

PT-2025-46987

Name of the Vulnerable Software and Affected Versions Desktop Alert PingAlert versions 6.1.0.11 through 6.1.1.2 Description A flaw exists in the Application Server of Desktop Alert PingAlert that can lead to the disclosure of technical information via stack traces. Recommendations Update to a...

CVE-2025-12681

CVE-2025-12681 affects the WordPress plugin Comment Edit Core – Simple Comment Editing, up to version 3.1.0. The root cause is an unauthenticated exposure via the ajax_get_comment function, allowing any visitor to access sensitive data such as user IDs, IP addresses, and email addresses. Wordfenc...

Siemens SIMATIC S7-1500 Allocation of Resources Without Limits or Throttling (CVE-2024-28182)

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK...

CVE-2025-64707 Frappe LMS revoking access did not show immediate effect as roles were cached

Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, when admins revoked a role from the user, the effect was not immediate because of caching. The issue has been fixed in version 2.41.0 by ensuring the cache is...

CVE-2024-48829

Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code 'Code Injection' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution...

PT-2025-46710

Name of the Vulnerable Software and Affected Versions Dell SmartFabric OS10 Software versions prior to 10.6.1.0 Description Dell SmartFabric OS10 Software versions prior to 10.6.1.0 contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' issue. A low privilege...