PT-2025-18166 · Unknown · Scriptandtools Online-Travling-System

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Online-Travling-System version 1.0 Description: A critical issue has been found, affecting an unknown part of the file /admin/viewenquiry.php, leading to improper access controls. The manipulation can be initiated remotely...

CVE-2025-3855

A vulnerability was found in CodeCanyon RISE Ultimate Project Manager 3.8.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php/teammembers/saveprofileimage/ of the component Profile Picture Handler. The manipulation of the argument...

CVE-2025-3665 TOTOLINK A3700R cstecgi.cgi setSmartQosCfg access control

A vulnerability has been found in TOTOLINK A3700R 9.1.2u.5822B20200513 and classified as critical. Affected by this vulnerability is the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit h...

PT-2025-16215 · Huanfenz/Code Projects · Studentmanager

Name of the Vulnerable Software and Affected Versions: huanfenz/code-projects StudentManager versions up to 1.0 Description: A problematic vulnerability has been found in the Teacher String Handler component, leading to improper authorization. The manipulation can be initiated remotely. The...

The vulnerability of the monitoring and control application for SAP Just In Time lies in the lack of authorization, which allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of the monitoring and control application for SAP Just In Time is related to the absence of authentication. Exploiting this vulnerability allows a malicious actor to remotely influence the integrity of the protected information...

The vulnerability of the Grafana data presentation web tool, related to bypassing authentication using a user-controlled key, allows attackers to influence the integrity of the protected information.

The vulnerability of the Grafana data processing web tool relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely influence the integrity of the protected information...

Class Pollution

Django-Unicorn is vulnerable to Class Pollution. The vulnerability is due to improper handling of component requests due to the setpropertyvalue function allowing remote users to manipulate its parameters, leading to arbitrary changes in the Python runtime, enabling XSS, DoS, and authentication...

CVE-2025-0342

A vulnerability, which was classified as problematic, was found in CampCodes Computer Laboratory Management System 1.0. This affects an unknown part of the file /class/edit/edit. The manipulation of the argument slname leads to cross site scripting. It is possible to initiate the attack remotely...

The vulnerability of the “Evaluations” function of the monitoring, management, and improvement platform for LLM applications allows attackers to influence the integrity of the protected information.

The vulnerability of the “Evaluations” function in the platform for monitoring, managing, and improving LLM applications involves bypassing authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely influence the integrity of protected information ...

CVE-2024-12663 funnyzpc Mee-Admin Login login observable response discrepancy

A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the component Login. The manipulation of the argument username leads to observable response discrepancy. The attack can be initiated remotely. The...

PT-2024-16723 · Zkteco · Zkteco Biotime

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio Time version 9.0.1 Description: A vulnerability has been found in the Image File Handler component of ZKTeco ZKBio Time, affecting an unknown function of the file /auth files/photo/. This issue leads to direct request manipulatio...

JDK: Array indexing integer overflow (8328544)

Vulnerability in Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and 23. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores relates to the possibility of manipulating cross-site requests. This allows attackers to bypass security restrictions and carry out CSRF attacks.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and perform CSRF attacks...

Monero: A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.

The pending block queue in the Monero cryptocurrency protocol could be remotely filled to an extremely high size, up to approximately 54 GB, with blocks that would never leave the queue. This was possible due to lax rules in the synchronization code that allowed the queue size limit to be bypasse...

CVE-2024-41144 Malicious remote can create/update/delete arbitrary posts in arbitrary channels

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to properly validate synced posts, when shared channels are enabled, which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels...

PT-2024-38066 · Sourcecodester · Sourcecodester Insurance Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Insurance Management System version 1.0 Description: A vulnerability was found in the system, affecting an unknown functionality of the file /E-Insurance/. The manipulation leads to a direct request. The attack can be launched...

PT-2024-37774 · Unknown · Aviatorscript +1

Name of the Vulnerable Software and Affected Versions: WuKongOpenSource Wukong nocode up to 20230807 Description: A critical issue was found in the AviatorScript Handler component, specifically in the ExpressionUtil.java file, allowing for deserialization through unknown functionality manipulatio...

ROS-20240708-02

A vulnerability in the TPMLPCRSELECTION functions of the source repository for Trusted Platform Module tools TPM2.0 is related to improper mapping of PCR slots, providing a misleading TPM state. Exploitation of the vulnerability could allow an attacker acting remotely to manipulate output data...

Tenda W30E formSetCfm Function Stack Buffer Overflow Vulnerability

The Tenda W30E is a wireless router developed by Tenda to provide a stable network connection for homes and small offices. A stack buffer overflow vulnerability exists in the formSetCfm function of the /goform/setcfm file in Tenda W30E version 1.0.1.25633. An attacker can exploit this vulnerabili...

The vulnerability of the CMS system Netcat, related to the manipulation of inter-site requests, allows a hacker to modify the security policies of a web application.

The vulnerability of the CMS system Netcat is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to remotely alter the security policies of a web application...