CVE-2025-12547 LogicalDOC Community Edition Admin Login login.jsp excessive authentication

A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely...

CVE-2025-12546 LogicalDOC Community Edition API Key creation UI cross site scripting

A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized...

CVE-2025-12546

This CVE affects LogicalDOC Community Edition up to version 9.2.1, where a flaw in the API Key creation UI component enables cross-site scripting. The root cause involves manipulation of the API Key creation UI, leading to XSS with remote exploitation possible. The vulnerability has been publicly...

CVE-2025-36592

Dell Secure Connect Gateway SCG Policy Manager, versions 5.20. 5.22, 5.24, 5.26, 5.28, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading...

CVE-2025-12546: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized...

PT-2025-44662

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions up to 9.2.1 Description A flaw exists in the API Key creation UI component that allows for cross site scripting. Remote exploitation is possible. The issue has been publicly disclosed, and the vendor was...

GitLab EE Access Control Unauthorized Access

The vulnerability of the application software interface of the Git-based software platform for collaborative code development on GitLab EE is related to access control errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to agents fr...

EUVD-2025-37043

A Reflected Cross-Site Scripting XSS vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 inclusive. This allows remote attackers to execute arbitrary JavaScript in a user's web browser by including a malicious payload in the "code" URL parameter. When an...

CVE-2025-53880

CVE-2025-53880 is a path-traversal vulnerability in the tftpsync/add and tftpsync/delete scripts. A remote attacker on an adjacent network can write or delete files on the filesystem with the wwwrun user’s privileges. The endpoint is unauthenticated but access is limited to a list of allowed IPs....

CVE-2025-11202 win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability

win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-12346

A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/autopost/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDi...

D-Link DIR600L Router DoS

The vulnerability of the formWlSiteSurvey function in D-Link DIR600L router microprogramming software is related to the copying of buffer contents without checking the size of the input data when processing the curTime parameter. Exploiting this vulnerability can allow a malicious actor to cause...

Poly Clariti Manager XSS

The vulnerability of the Poly Clariti Manager platform for managing, planning, and maintaining audiovisual systems is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Poly Clariti Manager Access Control Privilege Escalation

The vulnerability of the Poly Clariti Manager platform for managing, planning, and maintaining audiovisual systems is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

Poly Clariti Manager XSS

The vulnerability of the Poly Clariti Manager platform for managing, planning, and maintaining audiovisual systems is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2025-12331

A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited...

CVE-2025-12326

A vulnerability was found in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This vulnerability affects unknown code of the file /process.php of the component POST Request Handler. The manipulation of the argument un results in sql injection. The attack can be launched remotely...

CVE-2025-12329

A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The affected element is an unknown function of the file /details.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The...

CVE-2025-12314

A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing a manipulation of the argument itemID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made...

CVE-2025-12304

A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the file PayController.java of the component Order Status Handler. The manipulation leads to improper authorization. Remote exploitation of t...