171980 matches found
CVE-2025-62250
Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Lifer...
CVE-2025-62250
CVE-2025-62250 describes an Improper Authentication flaw in Liferay Portal/DXP where remote attackers can send unauthenticated cluster messages that are treated as trusted data. Affected products include Liferay Portal 7.4.0 through 7.4.3.132 and older unsupported versions, and Liferay DXP 2023.Q...
CVE-2025-11949 Digiwin｜EasyFlow .NET and EasyFlow AiNet - Missing Authentication
EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality...
CVE-2025-62648
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
CVE-2025-62646
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...
CVE-2025-6515 Reuse of session IDs in oatpp-mcp leads to session hijacking and prompt hijacking by remote attackers
The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses...
Idea Platform Service Manager Account Access
The vulnerability of the software solution for comprehensive enterprise management, Idea Platform Service Manager, is related to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain control of other users’ accounts...
GLPI Authentication Bypass
The vulnerability of the GLPI system for requests, incidents, and inventory management involves bypassing authentication using a password. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access and modify protected information...
MediaWiki AuthManager Unauthorized Access
The vulnerability of the AuthManager component of the MediaWiki software environment relates to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the compromised system by creating an...
CVE-2025-62648
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
CVE-2025-62646
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...
CVE-2025-62648
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
EUVD-2025-34858
The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...
CVE-2025-11898 Flowring Technology｜Agentflow - Arbitrary File Reading through Path Traversal
Agentflow developed by Flowring has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...
CVE-2025-62648
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
Windows Local Session Manager DoS
The vulnerability of the Windows Local Session Manager component in Windows operating systems is related to improper validation of the specified data type during input processing. Exploiting this vulnerability can allow an attacker to cause service interruptions from a remote location...
CVE-2025-62648: Incorrect Authorization
The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...
CVE-2025-56316
The MCMS content management system (versions 5.5.0 through 6.0.1 ) is vulnerable to a SQL injection vulnerability (CWE-89). The root cause is the improper sanitization of the content_title parameter within the /cms/content/list endpoint during FreeMarker template rendering . This flaw allows remo...