NUUO Devices OS Command Injection Vulnerability (Feb 2025) - Active Check

NUUO devices are prone to an OS command injection vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nuuo:nuuo";...

CVE-2025-1614

A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pfDescription leads to cross site scripting. It is...

CVE-2025-1582

A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/all-request.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The...

PT-2025-7669 · Unknown · Phpgurukul Online Nurse Hiring System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Nurse Hiring System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Online Nurse Hiring System. This issue affects an unknown part of the file /admin/search-report-details.php. The...

PT-2025-7523 · D Link · D-Link Dap-1320

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1320 version 1.00 Description: A critical issue has been found, affecting the function replace special char of the file /storagein.pd-XXXXXX. This issue leads to a stack-based buffer overflow and can be exploited remotely. The...

PT-2025-7589 · Phpcmsv9 · Phpcmsv9

Name of the Vulnerable Software and Affected Versions: phpcmsv9 version 9.6.3 Description: Cross Site Scripting vulnerabilities in phpcmsv9 allow a remote attacker to escalate privileges via a crafted script. Recommendations: For phpcmsv9 version 9.6.3, update to a version that fixes the Cross Si...

CVE-2025-1359

A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0. This issue affects some unknown processing of the file /qrcode.jsp. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotel...

PostgreSQL SQLi Vulnerability (Feb 2025) - Windows

PostgreSQL is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postgresql:postgresql...

cassandra-lucene-index 安全漏洞

cassandra-lucene-index is a Lucene-based secondary index for Cassandra open-sourced by NetApp Instaclustr. A security vulnerability exists in cassandra-lucene-index. An authenticated attacker could remotely bypass RBAC and elevate its privileges by exploiting this vulnerability...

CVE-2025-1208 code-projects Wazifa System Profile.php cross site scripting

A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /Profile.php. The manipulation of the argument postcontent leads to cross site scripting. The attack may be initiated remotely. The exploit has be...

SourceCodester Best Church Management Software 注入漏洞

SourceCodester Best Church Management Software is an open source church management software from Sourcecodester. An injection vulnerability exists in SourceCodester Best Church Management Software version 1.1, which originates from unknown code in the /admin/app/slidercrud.php file that does not...

AZL-56579 CVE-2025-1176 affecting package binutils for versions less than 2.41-4

A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function bfdelfgcmarkrsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather...

AZL-56661 CVE-2025-1151 affecting package crash 8.0.1-5

A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The...

CVE-2025-1147

CVE-2025-1147 refers to a buffer overflow in GNU Binutils 2.43, specifically in nm.c:__sanitizer::internal_strlen. Connected advisories indicate the fix is in Binutils 2.45, with openSUSE/SUSE advisories recommending upgrading to 2.45 (and related patch content). The vulnerability is exploitable ...

PT-2025-6052

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.43 Description A problematic issue has been found in GNU Binutils, affecting the bfd elf write section eh frame function of the ld component. This issue leads to memory corruption and can be initiated remotely, although...

JeecgBoot 安全漏洞

JeecgBoot is a Java low-code platform for enterprise web applications from China National Torch Jeecg. A security vulnerability exists in JeecgBoot version v.3.7.2, which originated from the inclusion of a SQL injection vulnerability that allows remote attackers to obtain sensitive information vi...

The vulnerability of Microsoft SharePoint Server and Microsoft SharePoint Enterprise Server packages lies in the lack of measures taken to protect the structure of web pages, allowing attackers to execute spear-phishing attacks.

The vulnerability of Microsoft SharePoint Server and Microsoft SharePoint Enterprise Server packages is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to perform a spear-phishing attack remotely...

The vulnerability of the Vault plugin in the JetBrains TeamCity system for continuous integration and delivery applications allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Vault plugin in the JetBrains TeamCity system for continuous integration and delivery applications is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotel...

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools, a resource management system, allows a perpetrator to carry out a CSRF attack.

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system for resource management involves the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack remotely...

CVE-2024-52803

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on...