CVE-2025-9646

A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /xorganizationassemblepersonal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. Th...

CVE-2025-9729 PHPGurukul Online Course Registration student-registration.php sql injection

A vulnerability was detected in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /admin/student-registration.php. Performing manipulation of the argument studentname results in sql injection. The attack is possible to be carried out remotely. The...

CVE-2025-9728

A security vulnerability has been detected in givanz Vvveb 1.0.7.2. This affects an unknown part of the file app/template/user/login.tpl. Such manipulation of the argument Email/Password leads to cross site scripting. The attack can be executed remotely. The name of the patch is...

CVE-2025-9727

CVE-2025-9727 affects D-Link DIR-816L firmware 206b01. The issue lies in the soapcgi_main function of /soap.cgi, where the service argument can be manipulated to trigger an OS command injection. Remote exploitation is possible, and public exploits exist. Several connected sources confirm the vuln...

CVE-2025-9726 Campcodes Farm Management System review.php sql injection

A security flaw has been discovered in Campcodes Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /review.php. The manipulation of the argument pid results in sql injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2025-9724

CVE-2025-9724 affects Portabilis i-Educar up to version 2.10. The vulnerability lies in /intranet/educar_nivel_ensino_cad.php (specifically the nm_nivel/descricao arguments), where manipulation can trigger cross-site scripting. Exploitation can be performed remotely, and public disclosures of the...

CVE-2025-9723 Portabilis i-Educar educar_tipo_regime_cad.php cross site scripting

A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educartiporegimecad.php. Performing manipulation of the argument nmtipo results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and...

CVE-2025-9720

A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edit of the component Cadastrar tabela de arredondamento Page. The manipulation of the argument Nome results in cross site scripting. The attack may be performe...

CVE-2025-9720 Portabilis i-Educar Cadastrar tabela de arredondamento edit cross site scripting

A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edit of the component Cadastrar tabela de arredondamento Page. The manipulation of the argument Nome results in cross site scripting. The attack may be performe...

CVE-2025-9718

A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /xprocessplatformassembledesigner/jaxrs/process of the component Personal Profile Page. Performing manipulation of the argument name/alias results in cross site scripting. Remote exploitation of t...

CVE-2025-9718

A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /xprocessplatformassembledesigner/jaxrs/process of the component Personal Profile Page. Performing manipulation of the argument name/alias results in cross site scripting. Remote exploitation of t...

CVE-2025-9717 O2OA Personal Profile unit cross site scripting

A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /xorganizationassemblecontrol/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelNa...

CVE-2025-9606

A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agendapreferencias.php. Performing manipulation of the argument codagenda results in sql injection. The attack may be initiated remotely. The exploit is...

CVE-2025-9608

A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2025-9605

A security vulnerability has been detected in Tenda AC21 and AC23 16.03.08.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. Such manipulation of the argument mac leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has...

CVE-2025-9583

A vulnerability has been found in Comfast CF-N1 2.6.0. Affected by this vulnerability is the function pingconfig of the file /usr/bin/webmgnt. The manipulation leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used...

CVE-2025-9591

A security vulnerability has been detected in ZrLog up to 3.1.5. This vulnerability affects unknown code of the file /api/admin/template/config of the component Theme Configuration Form. Such manipulation of the argument footerLink leads to cross site scripting. The attack may be launched remotel...

CVE-2025-9597

A vulnerability was identified in itsourcecode Apartment Management System 1.0. This impacts an unknown function of the file /odashboard/rentedallinfo.php. Such manipulation of the argument uid leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available...

CVE-2025-9592

A vulnerability was detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /report/billinfo.php. Performing manipulation of the argument vid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public...

PT-2025-35390

Name of the Vulnerable Software and Affected Versions: O2OA versions prior to 10.0-410 Description: A cross site scripting issue exists in O2OA due to manipulation of the name, alias, or description argument within the file /x processplatform assemble designer/jaxrs/form of the Personal Profile...