(Pwn2Own) Microsoft Windows Exposed Dangerous Function Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

The vulnerability of the Common Client Real-time Scan service of Trend Micro’s anti-virus software programs, Apex One and Apex One as a Service, allows attackers to escalate their privileges and execute arbitrary code within the SYSTEM context.

The vulnerability of Trend Micro Apex One and Apex One as a Service anti-virus software’s Common Client Real-time Scan function is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow attackers to enhance their privileges and execute...

PT-2025-30142 · Unknown · Church Donation System

Name of the Vulnerable Software and Affected Versions: Church Donation System version 1.0 Description: A critical vulnerability exists in Church Donation System 1.0. The vulnerability affects unknown code within the /members/offering.php file. Manipulation of the trcode argument results in a SQL...

CVE-2024-25315

Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2...

CVE-2023-32232

An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.836. During client installation and repair, a PrinterLogic binary is called by the installer to configure the device. This window is not hidden, and is running with elevated privileges. A standard user can break out o...

CVE-2022-48217

The tfremappernode component 1.1.1 for Robot Operating System ROS allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled oldtftopicname and/or newtftopicname...

CVE-2022-48222

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK installation, certutil.exe is called by the Acuant installer to install certificates. This window is not hidden, and is running with elevated privileges. A standard user can break out of this window, obtaining a full...

CVE-2021-45835

The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code execution...

CVE-2021-25210

Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to manageevent.php...

Improper access permission settings in multiple SEIKO EPSON printer drivers for Windows OS

Overview Multiple SEIKO EPSON printer drivers for Windows OS are configured with an improper access permission settings when installed or used in a language other than English. Incorrect default permissions CWE-276 - CVE-2025-42598 Private security researcher Erkan Ekici reported this vulnerabili...

PT-2025-17208 · Lanchat · Landchat

Name of the Vulnerable Software and Affected Versions: LandChat version 3.25.12.18 Description: A remote code execution issue in the core application allows an unauthenticated attacker to execute system code via remote network access. Recommendations: For LandChat version 3.25.12.18, at the momen...

CVE-2025-29662

A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access...

LandChat 安全漏洞

LandChat is a simple, open source and lightweight chat system from LandChat Open Source. A security vulnerability exists in LandChat version 3.25.12.18, which stems from mishandling of the core application and could lead to the execution of system code by an unauthenticated attacker...

CVE-2025-29662

A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access...

PT-2025-15377 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: The issue allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once connected to the ABAP...

CVE-2024-39780 Use of unsafe yaml load in dynparam

A YAML deserialization vulnerability was found in the Robot Operating System ROS 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load functi...

CVE-2022-45093

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 1. An authenticated remote attacker with access to the Web Based Management 443/tcp of the affected product as well as with access to the SFTP server of the affected product 22/tcp, could potentially read and write...

Bitdefender Antivirus Free 代码问题漏洞

Bitdefender Antivirus Free is a free version of a suite of antivirus software from the Romanian company Bitdefender that primarily provides cyber threat detection and ransomware protection. Bitdefender Antivirus Free 2020 suffers from a code issue vulnerability that stems from an untrusted search...

CVE-2024-13043

Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

Wacom Center 后置链接漏洞

Wacom Center is a driver from Wacom USA. A backlink vulnerability exists in Wacom Center that stems from the presence of a local elevation of privilege vulnerability that allows a local attacker to elevate privileges and execute arbitrary code in the SYSTEM context...