CVE-2025-7906

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to unrestricted upload. The...

CVE-2025-7901 yangzongzhuan RuoYi Swagger UI index.html cross site scripting

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be...

GHSA-9CG4-9HV5-3376 WebSSH Cross-site Scripting vulnerability

A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched...

PYSEC-2025-234

A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched...

PYSEC-2025-234

A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched...

CVE-2025-7885 Huashengdun WebSSH Login Page cross site scripting

A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched...

CVE-2025-7878

A vulnerability, which was classified as critical, was found in Metasoft 美特软件 MetaCRM up to 6.4.2. Affected is an unknown function of the file /common/jsp/upload2.jsp. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has...

CVE-2025-7872

Portabilis i-Diario 1.5.0 is affected by CVE-2025-7872. The vulnerability arises from improper handling of the Justificativa parameter in the file /justificativas-de-falta, allowing cross-site scripting. It can be exploited remotely, and public exploit information has been disclosed; vendor respo...

CVE-2025-7869 Portabilis i-Educar Turma Module educar_turma_tipo_det.php cross site scripting

A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file intranet/educarturmatipodet.php?codturmatipo=ID of the component Turma Module. The manipulation of the argument nmtipo leads to cross...

PT-2025-30215 · Itsourcecode · Insurance Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Insurance Management System version 1.0 Description: A critical issue exists in itsourcecode Insurance Management System 1.0. The vulnerability is due to SQL injection within the /insertPayment.php file, specifically through...

PT-2025-30191 · Tduckcloud · Tduck-Platform

Name of the Vulnerable Software and Affected Versions: TDuckCloud tduck-platform version 5.1 Description: A critical issue exists in TDuckCloud tduck-platform 5.1 related to SQL injection. The UserFormDataMapper function within the src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java...

PT-2025-30208 · Yangzongzhuan · Ruoyi

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A problematic issue exists in yangzongzhuan RuoYi, specifically within the Image Source Handler component. This issue involves improper restriction of rendered UI layers and can be exploit...

PT-2025-30209 · Itsourcecode · Insurance Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Insurance Management System version 1.0 Description: A critical issue exists in itsourcecode Insurance Management System version 1.0. The vulnerability is located in an unknown part of the file /insertNominee.php. Manipulation of...

PT-2025-30218 · Druid +1 · Druid +1

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A problematic issue exists in yangzongzhuan RuoYi. The issue involves the use of default credentials within an unknown function of the ruoyi-admin/src/main/resources/application-druid.yml...

D-Link DIR-513 安全漏洞

The D-Link DIR-513 is a wireless router device manufactured by D-Link. A buffer overflow vulnerability exists in the D-Link DIR-513 version 1.0, which originates from improper handling of the curTime parameter in the sprintf function of the /goform/formLanSetupRouterSettings file in the Boa...

PT-2025-30203 · Harry0703 · Moneyprinterturbo

Name of the Vulnerable Software and Affected Versions: harry0703 MoneyPrinterTurbo versions through 1.2.6 Description: A critical vulnerability exists in harry0703 MoneyPrinterTurbo. The issue is a path traversal vulnerability affecting the download video/delete video function within the...

PT-2025-30165

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0 Description An open redirect issue exists in the redirectUrl function located in the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the url argument can lead to an...

PT-2025-30197 · Onyx · Onyx

Name of the Vulnerable Software and Affected Versions: Onyx versions up to 0.29.1 Description: A critical issue has been identified in Onyx, potentially allowing for SQL injection. This occurs through manipulation of the generate simple sql function within the backend/onyx/agents/agent search/kb...

PT-2025-30204 · Unknown · Moneyprinterturbo

Name of the Vulnerable Software and Affected Versions: harry0703 MoneyPrinterTurbo versions through 1.2.6 Description: A critical issue exists in the verify token function within the app/controllers/base.py file of the API Endpoint component. This allows for missing authentication and may be...

PT-2025-30180 · Metasoft · Metasoft Metacrm

Name of the Vulnerable Software and Affected Versions: Metasoft MetaCRM versions up to 6.4.2 Description: A critical vulnerability exists in Metasoft MetaCRM up to version 6.4.2. The issue involves an unrestricted file upload vulnerability located in an unknown function of the...