CVE-2025-6107 comfyanonymous comfyui utils.py set_attr dynamically-determined object attributes

A vulnerability was found in comfyanonymous comfyui 0.3.40. It has been classified as problematic. Affected is the function setattr of the file /comfy/utils.py. The manipulation leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The complexity of an...

CVE-2025-6107

CVE-2025-6107 affects comfyanonymous comfyui 0.3.40. The vulnerability is in the function set_attr of /comfy/utils.py, enabling manipulation of dynamically-determined object attributes. The issue can be triggered remotely with high attack complexity and no privileges required; PoC exploits have b...

CVE-2025-6105 jflyfox jfinal_cms HOME.java cross-site request forgery

A vulnerability has been found in jflyfox jfinalcms 5.0.1 and classified as problematic. This vulnerability affects unknown code of the file HOME.java. The manipulation of the argument Logout leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2025-6100

A vulnerability was found in realguoshuai open-video-cms 1.0. It has been rated as critical. This issue affects some unknown processing of the file /v1/video/list. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to...

CVE-2025-6098

CVE-2025-6098 : A buffer overflow exists in the UTT Progress 750W API endpoint /goform/setSysAdm, triggered by the passwd1 argument in the strcpy usage. Affects versions up to 5.0; vulnerability can be exploited remotely, with exploitation described as a proof-of-concept in sources. Impact includ...

CVE-2025-6098 UTT 进取 750W API setSysAdm strcpy buffer overflow

A vulnerability was found in UTT 进取 750W up to 5.0. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the component API. The manipulation of the argument passwd1 leads to buffer overflow. It is possible to initiate the attack remotely. The explo...

CVE-2025-6097 UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change

A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 leads to unverified password change. T...

PT-2025-25525 · Tenda · Tenda Fh1201

Name of the Vulnerable Software and Affected Versions: Tenda FH1201 version 1.2.0.14408 Description: A critical vulnerability has been found in Tenda FH1201. This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the page argument leads to a stack-based buffer overflo...

PT-2025-25523 · Javahongxi · Whatsmars

Name of the Vulnerable Software and Affected Versions: javahongxi whatsmars version 2021.4.0 Description: A problem has been found that affects the initialize function of the file...

PT-2025-25583 · Unknown · Projectworlds Life Insurance Management System

Name of the Vulnerable Software and Affected Versions: Projectworlds Life Insurance Management System version 1.0 Description: A critical issue has been identified, affecting the /insertNominee.php file. The client id and nominee id arguments are vulnerable to SQL injection. This issue can be...

PT-2025-26478 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: A critical issue affects the formSetACLFilter function of the file /goform/formSetACLFilter. The manipulation of the curTime argument leads to a stack-based buffer overflow. This issue can be...

ROS-20250616-11

A vulnerability in the Moodle virtual learning environment is related to insufficient protection of proprietary data. Exploitation of the vulnerability could allow an attacker acting remotely to disclose protected information. information Vulnerability of moodle virtual learning environment is...

PT-2025-25535 · D Link · Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06B01 Description: A critical vulnerability has been found in the function form portforwarding of the file /goform/form portforwarding. The manipulation of the argument ingress name %d/sched name %d/name %d leads to ...

The vulnerability in the web interface of the “Termide Virtual Desktops Connection Manager” software allows a attacker to perform XSS attacks.

The vulnerability of the software interface “Termide Virtual Desktops Connection Manager” is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

PT-2025-25507

Name of the Vulnerable Software and Affected Versions UTT 进取 750W versions up to 5.0 Description A critical issue was found, affecting the function formDefineManagement of the file /goform/setSysAdm in the Administrator Password Handler component. The manipulation of the passwd1 argument leads to...

PT-2025-25542 · Unknown · Parking Management System

Name of the Vulnerable Software and Affected Versions: Das Parking Management System version 6.2.0 Description: A critical issue was found in the API component of the system, specifically affecting the /Reservations/Search file. The manipulation of the Value argument leads to SQL injection. This...

PT-2025-25561 · Unknown · Phpgurukul Rail Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Rail Pass Management System version 1.0 Description: A vulnerability was found in the PHPGurukul Rail Pass Management System, allowing for cross-site scripting. The issue is related to the manipulation of the pagedes argument in an...

The vulnerability of the “Termide Virtual Desktops Connection Manager” software server arises from an improper limitation on the path name to the restricted access catalog, allowing a perpetrator to gain access to any file in the file system.

The vulnerability of the “Termide Virtual Desktops Connection Manager” software complex is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to any file in the file system by...

The vulnerability of the Libinfo library in macOS operating systems, which allows attackers to increase their privileges

The vulnerability of the Libinfo library in macOS operating systems is related to integer overflow. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

PT-2025-26498 · Totolink · Totolink X15

Name of the Vulnerable Software and Affected Versions: TOTOLINK X15 version 1.0.0-B20230714.1105 Description: A critical vulnerability was found in the HTTP POST Request Handler component of the TOTOLINK X15, affecting the file /boafrm/formIpv6Setup. The manipulation of the submit-url argument...