EUVD-2025-41751

EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-12867

The CVE-2025-12867 entry concerns Hundred Plus EIP Plus. The connected documents substantiate an Arbitrary File Upload vulnerability in EIP Plus that could allow privileged remote attackers to upload and execute a web shell, resulting in arbitrary code execution on the server. Affected product is...

PT-2025-45593

Name of the Vulnerable Software and Affected Versions Hundred Plus EIP Plus affected versions not specified Description A flaw exists in Hundred Plus EIP Plus that allows remote attackers with elevated privileges to upload and execute web shell backdoors. Successful exploitation could lead to...

Go Insufficient Validation Information Disclosure

The vulnerability of the Go programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise the accessibility of protected information...

CVE-2022-50590

SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of t...

CVE-2025-33110

IBM OpenPages 9.1, and 9.0 with Watson is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

EUVD-2025-38268

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QuMagie 2.7.3 and later...

EUVD-2025-38286

A cross-site request forgery CSRF vulnerability has been reported to affect QuLog Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following version: QuLog Center 1.8.2.927 2025/09/17 and...

CVE-2025-53410 File Station 5

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

Rack::Sendfile Unauthorized Access

The vulnerability of the Rack::Sendfile class in the module interface between web servers and Rack applications is related to the exposure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using specially...

QNAP Systems File Station 5 security vulnerabilities

QNAP File Station 5 is a core file management application developed by Qualcomm Technologies QNAP for its networked storage NAS devices. QNAP File Station 5 suffers from an Unlimited or Unthrottled Resource Allocation vulnerability, which can be exploited by an attacker to prevent other systems,...

Log4cxx Confidential Data Access

The vulnerability of the C++ Apache Log4cxx logging framework is related to improper handling of output data for registration logs. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential data...

Log4cxx Confidential Data Access

The vulnerability of the C++ Apache Log4cxx logging framework is related to improper handling of output data for registration logs. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential data...

BIT-MLFLOW-2025-11200 MLflow Weak Password Requirements Authentication Bypass Vulnerability

MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords...

CVE-2025-63588

An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request e.g., a maliciously crafted POST login. Successful exploitation may lead to theft of...

CVE-2025-60784

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase...

CVE-2025-21075

Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory...

CVE-2025-21074

Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory...

CVE-2025-21074

Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory...

SAMSUNG Members security vulnerabilities

SAMSUNG Members is a community platform app from Samsung South Korea. A security vulnerability exists in SAMSUNG Members versions prior to 5.5.01.3, which stems from improper input validation and could allow a remote attacker to connect to an arbitrary URL and initiate arbitrary activities with...