3453 matches found
CVE-2025-52130
File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution RC...
Malicious code in prettier-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dd4a56ce83136ba0c08709c38d11bee44b0351d7dd9c5bca68b457fcb1b44be9 The OpenSSF Package Analysis project identified 'prettier-v2' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...
CVE-2025-51506: Improper Neutralization of Special Elements used in an SQL Command
In the smartLibrary component of the HRForecast Suite 0.4.3, a SQL injection vulnerability was discovered in the valueKey parameter. This flaw enables any authenticated user to execute arbitrary SQL queries, via crafted payloads to valueKey to the api/smartlibrary/v2/en/dictionaries/options/looku...
CVE-2025-9016: Uncontrolled Search Path Element
A vulnerability has been found in Mechrevo Control Center GX V2 5.56.51.48. Affected is an unknown function of the file C:\Program Files\OEM\机械革命控制中心\AiStoneService\MyControlCenter\Command of the component Powershell Script Handler. Such manipulation leads to uncontrolled search path. The attack...
CVE-2025-9000: Uncontrolled Search Path Element
A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler. The manipulation results in uncontrolled search path. The attack needs to be approached locally. The attack requires a high level of complexity. The...
CVE-2025-49897: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1...
Malicious code in key-recovery-service-v2 (npm)
The package key-recovery-service-v2 was found to contain malicious code...
Malicious code in npm-download-counts-v2 (npm)
The package npm-download-counts-v2 was found to contain malicious code...
MAL-2025-24423 Malicious code in key-recovery-service-v2 (npm)
The package key-recovery-service-v2 was found to contain malicious code...
MAL-2025-34589 Malicious code in tbb-v2 (npm)
The package tbb-v2 was found to contain malicious code...
Malicious code in webserver-internal-v2 (npm)
The package webserver-internal-v2 was found to contain malicious code...
MAL-2025-33394 Malicious code in skynet-api-v2 (npm)
The package skynet-api-v2 was found to contain malicious code...
MAL-2025-27829 Malicious code in npm-download-counts-v2 (npm)
The package npm-download-counts-v2 was found to contain malicious code...
SUSE-SU-2025:02592-1 Security update for cosign
This update for cosign fixes the following issues: Update to version 2.5.3 jscSLE-23879: - CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego bsc1246725 Changelog: Update to 2.5.3: - Add signing-config create command 4280 - Allow multiple services to be specified for trusted-ro...
PT-2025-53736
Уязвимость ПЛК NLcon-CE-485-C связана с недостаточной проверкой вводимых данных при обработке пакета вида 0xcccc в сервисе Codesys v2. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании среды исполнения Codesys v2...
PT-2025-53735
Уязвимость ПЛК NLcon-CE-485-C связана с недостатками процедуры авторизации сервиса Codesys v2. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить полный доступ к среде исполнения Codesys v2...
PT-2025-53737
Уязвимость ПЛК NLcon-CE-485-C связана с недостаточной проверкой вводимых данных при обработке пакета вида 0xbbbb в сервисе Codesys v2. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании среды исполнения Codesys v2...
PT-2025-53739
Уязвимость ПЛК NLcon-CE-485-C связана с недостаточной проверкой вводимых данных в сервисе Codesys v2. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании среды исполнения Codesys v2...
CVE-2025-53711: Buffer Copy without Checking Size of Input
A vulnerability has been found in TP-Link TL-WR841N v11, TL-WR842ND v2 and TL-WR494N v3. The vulnerability exists in the /userRpm/WlanNetworkRpm.htm file due to missing input parameter validation, which may lead to the buffer overflow to cause a crash of the web service and result in a...
