CVE-2025-10485

A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue is the function pptlog of the file /login of the component HTTP Header Handler. Such manipulation of the argument X-Forwarded-For leads to cross site scripting. The attack may be...

CVE-2025-10440 D-Link DI-8100/DI-8100G/DI-8200/DI-8200G/DI-8003/DI-8003G jhttpd usb_paswd.asp sub_4621DC os command injection

A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub4621DC of the file usbpaswd.asp of the component jhttpd. The manipulation of the argument hname leads to os comma...

CVE-2025-10433

A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/debug. Executing manipulation of the argument code can lead to deserialization. The attack can be executed remotely. The exploit has been...

CVE-2025-10426

A security flaw has been discovered in itsourcecode Online Laundry Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been releas...

CVE-2025-10427

A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/operation/user.php. Executing manipulation of the argument websiteimage can lead to unrestricted upload. It is possible to launch the attack remotely. The...

CVE-2025-10419 SourceCodester Student Grading System del_promote.php sql injection

A security vulnerability has been detected in SourceCodester Student Grading System 1.0. Affected by this issue is some unknown functionality of the file /delpromote.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit has been disclos...

CVE-2025-10404 itsourcecode Baptism Information Management System rptbaptismal.php sql injection

A vulnerability was found in itsourcecode Baptism Information Management System 1.0. This impacts an unknown function of the file /rptbaptismal.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could be...

CVE-2025-10403

PHPGurukul Beauty Parlour Management System 1.1 is affected by a SQL injection vulnerability in /admin/view-enquiry.php via the viewid parameter. The issue arises from unsanitized input in a function handling this parameter, enabling remote attackers to execute arbitrary SQL. Public disclosures e...

CVE-2025-10393 miurla morphic HTTP Status Code 3xx advanced-search fetchHtml server-side request forgery

A flaw has been found in miurla morphic up to 0.4.5. This impacts the function fetchHtml of the file /api/advanced-search of the component HTTP Status Code 3xx Handler. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been...

CVE-2025-10386

A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Request Handler. The manipulation of the argument requestUrl results in cross site scripting. It is possible to launch the attack remotely...

PT-2025-37407

Name of the Vulnerable Software and Affected Versions: SourceCodester Pet Grooming Management Software version 1.0 Description: A SQL injection issue exists in SourceCodester Pet Grooming Management Software version 1.0 due to manipulation of the ID argument in the /admin/edit role.php file. This...

PT-2025-37409

Name of the Vulnerable Software and Affected Versions: fcba zzm ics-park Smart Park Management System version 2.0 Description: A security flaw has been discovered that allows for unrestricted file upload. The vulnerability affects unknown code within the FileUploadUtils.java file. The manipulatio...

CVE-2025-10372

A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educarmodulocad.php. This manipulation of the argument nmtipo/descricao causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made...

CVE-2025-10332 cdevroe unmark info.php cross site scripting

A vulnerability was found in cdevroe unmark up to 1.9.3. Impacted is an unknown function of the file application/views/marks/info.php. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public...

PT-2025-37394

Name of the Vulnerable Software and Affected Versions: yangzongzhuan RuoYi versions up to 4.8.1 Description: A flaw exists in yangzongzhuan RuoYi up to version 4.8.1 related to improper authorization within the Role Handler component. The issue is associated with the /system/role/authUser/cancelA...

CVE-2025-10328

CVE-2025-10328 affects MiczFlor RPi-Jukebox-RFID versions up to 2.8.0. The vulnerability stems from improper handling of the File argument in the file /htdocs/api/playlist/playsinglefile.php , enabling os command injection. The issue can be exploited remotely and has been publicly disclosed. Mult...

CVE-2025-10324

CVE-2025-10324 affects Wavlink WL-WN578W2 (firmware variant 221110). The vulnerability resides in the firewall.cgi file, within the sub_401C5C function, where manipulating the arguments pingFrmWANFilterEnabled, blockSynFloodEnabled, blockPortScanEnabled, or remoteManagementEnabled enables arbitra...

CVE-2025-10322

A vulnerability has been found in Wavlink WL-WN578W2 221110. The affected element is an unknown function of the file /sysinit.html. The manipulation of the argument newpass/confpass leads to weak password recovery. The attack is possible to be carried out remotely. The exploit has been disclosed ...

CVE-2025-10277 YunaiV yudao-cloud submit improper authorization

A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. T...

Debian: Security Advisory (DLA-4298-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...