EUVD-2025-34879

A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2. Affected by this issue is the function update of the file /cms/article/update. Executing manipulation of the argument cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The...

CVE-2025-11903

A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2. Affected by this issue is the function update of the file /cms/article/update. Executing a manipulation of the argument cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. Th...

Knowledge Base module XSS

The vulnerability of the Knowledge Base module of the FreeScout support service management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

PT-2025-42639

Name of the Vulnerable Software and Affected Versions Shenzhen Ruiming Technology Streamax Crocus version 1.3.40 Description A security flaw exists in the Streamax Crocus software. The issue involves unrestricted file upload through manipulation of the File argument in the uploadFile function,...

PT-2025-42648

Name of the Vulnerable Software and Affected Versions Shenzhen Ruiming Technology Streamax Crocus version 1.3.40 Description A path traversal issue exists due to manipulation of the Path argument in the Download function via the /Service.do?Action=Download endpoint. This allows for remote...

EUVD-2025-34770

Smidge is vulnerable to Path Traversal...

Smidge is vulnerable to Path Traversal

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is...

CVE-2025-11851 Apeman ID71 set_alias.cgi cross site scripting

A vulnerability has been found in Apeman ID71 EN75.8.53.20. The affected element is an unknown function of the file /setalias.cgi. Such manipulation of the argument alias leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be...

CVE-2025-11851

CVE-2025-11851 affects the Apeman ID71 EN75.8.53.20 webcam. The issue is a cross-site scripting vulnerability in the /set_alias.cgi file, caused by manipulation of the alias parameter in that function. It is exploitable remotely, and public exploits/PoCs exist. The vulnerability is described acro...

Microsoft Exchange Server Privilege Escalation

The vulnerability of Microsoft Exchange Server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers, operating remotely, to increase their privileges...

PT-2025-42525

Name of the Vulnerable Software and Affected Versions Apeman ID71 version 218.53.203.117 Description A security issue exists in the ONVIF Service component of Apeman ID71. Specifically, a manipulation of an unknown function within the /onvif/device service file results in missing authentication...

CVE-2025-11842: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 4.6.0 is...

Microsoft Exchange Server Spoofing

The vulnerability of Microsoft Exchange Server servers is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

PowerDNS Recursor DNS Spoofing

The vulnerability of the PowerDNS Recursor DNS server is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...

XWiki Platform CSRF

The vulnerability of the software interface of the XWiki Platform for creating collaborative web applications is related to insufficient verification of the authenticity of executed requests. Exploiting this vulnerability can allow a malicious actor to carry out a CSRF attack remotely...

EUVD-2025-34259

A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may...

CVE-2025-11736

A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may...

CVE-2025-37136

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system...

CVE-2025-37137

Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system...

EUVD-2025-34176

In wlan AP driver, there is a possible out of bounds write due to an integer overflow. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418785; Issue ID: MSV-3515...