EUVD-2025-27553

Malicious code in bioql PyPI...

EUVD-2025-20770

Malicious code in bioql PyPI...

EUVD-2021-6866

Malicious code in bioql PyPI...

EUVD-2023-33070

Malicious code in bioql PyPI...

EUVD-2025-19677

Malicious code in bioql PyPI...

TitanSystems Zender 安全漏洞

TitanSystems Zender is a messaging gateway software from TitanSystems Philippines. A security vulnerability exists in TitanSystems Zender version 3.9.7, which stems from improper validation of the token-user association in the password reset feature, which could lead to account takeover and...

CVE-2025-56404

An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation...

CVE-2025-56404

An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation...

PT-2025-37049

Name of the Vulnerable Software and Affected Versions: MariaDB MCP version 0.1.0 Description: An issue was discovered in the MariaDB MCP software where attackers can gain sensitive information via the SSE service due to a lack of user validation within the service. Recommendations: Ensure proper...

CVE-2025-56404

A security vulnerability exists in MariaDB MCP version 0.1.0 , an open-source server implementation of the Large Language Model Context Protocol for MariaDB. The flaw stems from insufficient validation of input data and a lack of user authentication within the SSE service . This allows a remote a...

CVE-2025-56404

An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation...

CVE-2025-53485 SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes

SetTranslationHandler.php does not validate that the user is an election admin, allowing any even unauthenticated user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue affects Mediawiki - SecurePoll extension:...

Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco Enterprise Chat and Email ECE could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An...

School Fees Payment System Cross-Site Request Forgery Vulnerability

School Fees Payment System is a tuition payment system. School Fees Payment System is vulnerable to a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. No details of the vulnerability are...

Car Rental Portal Cross-Site Request Forgery Vulnerability

Car Rental Portal is a rental car portal. Car Rental Portal suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. The vulnerability can be exploited by an attacker to spoof a...

CVE-2025-47725

Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process...

CVE-2025-47728

CVE-2025-47728 affects Delta Electronics CNCSoft-G2. The issue is a parsing/memory-corruption flaw in DPAX file handling that can allow code execution in the context of the current process when a user opens a malicious file. Metrics indicate LOCAL attack vector with low complexity and user intera...

CVE-2025-47727

CVE-2025-47727 affects Delta Electronics CNCSoft. Multiple connected sources describe a lack of validation of user-supplied files, enabling code execution in the context of the current process when a malicious file is opened. The issue is described as an out-of-bounds write/validation flaw in CNC...

CVE-2024-12132

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2023-25719

ConnectWise Control before 22.9.10032 formerly known as ScreenConnect fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executable can be used to...