33357 matches found
CVE-2025-15120
A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is need...
CVE-2025-15119 JeecgBoot list queryPageList improper authorization
A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A high complexity level is associated with this...
PT-2025-53669
Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.13 Description A weakness exists in PbootCMS up to version 3.2.12. The issue affects an unknown function within the SQLite Database component, specifically the file /data/pbootcms.db. Successful manipulation can...
PT-2025-53637
Name of the Vulnerable Software and Affected Versions JeecgBoot versions up to 3.9.0 Description A flaw exists in JeecgBoot that relates to improper authorization. The issue is located in the loadDatarule function within the /sys/sysDepartRole/datarule/ file. Manipulation of the departId/roleId...
PT-2025-53641
Name of the Vulnerable Software and Affected Versions JeecgBoot versions up to 3.9.0 Description A weakness exists in JeecgBoot related to improper authorization. The issue is triggered by manipulating the positionId argument within the getPositionUserList function located in the...
Vulnerability fixed in MongoDB
MongoDB developers have fixed a vulnerability in MongoDB. The vulnerability with reference CVE-2025-14847 allows an unauthenticated remote attacker to read uninitialized heap memory. It is caused by improperly processing length parameters in Zlib-compressed protocol headers. Misuse of the...
MAL-2025-192942 Malicious code in telebot-bot (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ae13454f920b5cce1011546e4802ed263ce8218d4b484ef8471142abb42c3f3e The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category:...
MAL-2025-192943 Malicious code in telegrem (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f2186dc29d07dc851d756bae0b5d080ebe5923efe6654fdb4aa9ec55bbba9b6a The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category:...
CVE-2025-15097
A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used...
CVE-2025-59683
Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of servi...
CVE-2025-66737
Yealink T21PE2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request result read function of the diagnostic component...
📄 Backdoor.Win32.Netbus.170 Blind Command Execution
This Metasploit module provides historical/educational exploitation of the Backdoor.Win32.Netbus.170 trojan, originally discovered in 1998. It represents a legacy proof-of-concept rather than a modern offensive security tool...
The vulnerability of the Forgejo collaborative development platform, related to deficiencies in the mechanism for processing symbolic links, allows a hacker to gain unauthorized access to the platform.
The vulnerability of the Forgejo collaborative development platform is related to deficiencies in the mechanism for handling symbolic links. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the platform by sending a specially crafted...
ROS-20251226-7306
A vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird email client is related to information disclosure. Exploitation of the vulnerability could allow a remote attacker to disclose protected information...
CVE-2025-66738
CVE-2025-66738 affects Yealink T21P_E2 Phone (version 52.84.0.15). The issue is in the ping function of the diagnostic component, allowing a remote attacker with normal privileges to execute arbitrary code via a crafted request. Exploitation details are not provided in the available documents; no...
CVE-2025-15090
A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This vulnerability affects the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart results in buffer overflow. The attack may be performed from remote. The exploit has been made public...
CVE-2025-15085
A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java of the component Balance Handler. The manipulation results in improper...
CVE-2025-15074 itsourcecode Online Frozen Foods Ordering System customer_details.php sql injection
A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customerdetails.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be...
DEBIAN-CVE-2025-68920
C-Kermit aka ckermit through 10.0 Beta.12 aka 416-beta12 before 244644d allows a remote Kermit system to overwrite files on the local system, or retrieve arbitrary files from the local system...