CVE-2025-7920

WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-52362

Server-Side Request Forgery SSRF vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL...

CVE-2025-41679

An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard Conftool service...

CVE-2025-7919

CVE-2025-7919 relates to the WinMatrix3 Web package from Simopro Technology, which is affected by an SQL Injection vulnerability. The vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Connected sources provide CVS...

openjdk: Glyph out-of-memory access and crash (Oracle CPU 2025-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1;...

CVE-2025-34118

A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/',...

Arbitrary Code Injection

pyLoad-ng is vulnerable to Arbitrary Code Injection. The vulnerability is due to unsafe JavaScript evaluation caused by insecure CAPTCHA processing logic that allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially on the backend server...

UBUNTU-CVE-2025-30761

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...

CVE-2023-38327

An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote attackers to enumerate the users of web applications based on server response...

EGroupware 安全漏洞

EGroupware is an online office platform from EGroupware, Inc. A security vulnerability exists in EGroupware version 17.1.20190111, which stems from the presence of reflective cross-site scripting in calendar/freebusy.php, which could allow an unauthenticated, remote attacker to inject arbitrary w...

Exploit for CVE-2025-34085

📂 Simple File List – Unauthenticated RCE Exploit CVE-2025-340...

CVE-2025-53645

Zimbra Collaboration ZCS before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condition due to improper handling of excessive, comma-separated path segments in the Admin Console. An unauthenticated remote attacker can send specially crafted G...

CVE-2025-53645

CVE-2025-53645 affects Zimbra Collaboration Suite (ZCS). Versions before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 are vulnerable due to improper handling of excessive, comma-separated path segments in the Admin Console. An unauthenticated remote attacker can issue specially...

CVE-2025-40735

A vulnerability has been identified in SINEC NMS All versions V4.0. The affected devices are vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database...

CVE-2025-24002

An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog...

Exploit for Injection in Cisco Identity_Services_Engine

CVE-2025-20281 — Cisco ISE ERS API Unauthenticated RCE Exploit...

SUSE CVE-2025-48710

kro Kube Resource Orchestrator 0.1.0 before 0.2.1 allows users with permission to create or modify ResourceGraphDefinition resources to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in...

📄 Turn off PC 1.0 Unauthenticated Remote System Control

Turn Off PC version 1.0 exposes an unsecured socket port 8081 allowing complete remote power control shutdown, restart, sleep without authentication, enabling system disruption attacks. Exploit Title: Turn Off PC 1.0 - Unauthenticated Remote System Control Shutdown/Restart/Sleep Date: 02/07/25...

CVE-2025-41656

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the NodeRED server is not configured by default...

CVE-2025-34045

A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/downloadimgage endpoint, where insufficient inpu...