21706 matches found
BIT-PHP-2025-1217 Header parser of http stream wrapper does not handle folded headers
In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME...
CVE-2025-3563
The CVE-2025-3563 entry concerns WuzhiCMS 4.1. The vulnerability exists in the Setting Handler’s Set function of the /index.php?m=attachment&f=index&_su=wuzhicms&v=set&submit=1 path, where manipulating the Setting argument enables code injection. Documentation states remote exploitation is possib...
CVE-2025-3561 ghostxbh uzy-ssm-mall cross-site request forgery
A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The...
CVE-2025-3556 ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication
A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be...
CVE-2025-3555 ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication
A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The...
Information Disclosure
api-platform/core is vulnerable to Information disclosure. The vulnerability is due to improper handling of exception messages, where non-HTTP exceptions are not sanitized and are directly included in the JSON error response, allows potentially sensitive internal information to be exposed to...
CVE-2025-3550
CVE-2025-3550 affects wowjoy Internet Doctor Workstation System 1.0. The vulnerability is an improper authorization in the /v1/pushConfig/detail/ endpoint, enabling remote exploitation. Multiple sources confirm the issue exists in version 1.0 and describe the impact as unauthorized access to the ...
CVE-2025-3550 wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System detail improper authorization
A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig/detail/. The manipulation leads to improper authorization. The attack can be launched...
PT-2025-16275 · Zhenfeng13 · My-Blog-Layui
Name of the Vulnerable Software and Affected Versions: ZHENFENG13/code-projects My-Blog-layui version 1.0 Description: A problem was found in the software, affecting an unknown part of the file /admin/v1/link/edit. This issue leads to cross site scripting and can be initiated remotely. Multiple...
CVE-2025-3537 Tutorials-Website Employee Management System update-user.php improper authorization
A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely...
CVE-2025-3534 PowerCreator CMS OpenPublicCourse.aspx sql injection
A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to th...
CVE-2025-3534 PowerCreator CMS OpenPublicCourse.aspx sql injection
A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to th...
CVE-2025-3533 YouDianCMS index.html.Attackers cross site scripting
A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admin/Default/Channel/index.html.Attackers. The manipulation of the argument Parent leads to cross site scripting. The attack may be initiated...
PT-2025-16175 · Unknown · Youdiancms
Name of the Vulnerable Software and Affected Versions: YouDianCMS version 9.5.21 Description: A vulnerability has been found in YouDianCMS, affecting an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross-site scripting...
Advisory ROSA-SA-2025-2804
Software: httpd 2.4.37 OS: ROSA Virtualization 3.0 packageevrstring: httpd-2.4.37-65.rv30.3 CVE-ID: CVE-2023-31122 BDU-ID: 2023-07124 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the modmacro module of the Apache HTTP Server web server involves reading beyond memory boundaries. Exploitation of th...
DEBIAN-CVE-2025-32743
In ConnMan through 1.44, the lookup string in nsresolv in dnsproxy.c can be NULL or an empty string when the TC Truncated bit is set in a DNS response. This allows attackers to cause a denial of service application crash or possibly execute arbitrary code, because those lookup values lead to...
CVE-2025-32743
In ConnMan through 1.44, the lookup string in nsresolv in dnsproxy.c can be NULL or an empty string when the TC Truncated bit is set in a DNS response. This allows attackers to cause a denial of service application crash or possibly execute arbitrary code, because those lookup values lead to...
CVE-2025-3411
A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing of the file 3apiplatform/api-platform/src/main/java/top/aias/platform/controller/AsrController.java. The manipulation of the argument url leads to server-sid...
CVE-2025-3401
A vulnerability has been found in ESAFENET CDG 5.6.3.154.20520250114 and classified as critical. This vulnerability affects unknown code of the file /parameter/getLimitIPList.jsp. The manipulation of the argument noticeId leads to sql injection. The attack can be initiated remotely. The exploit h...