CVE-2025-14607

A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to...

CVE-2025-13970

OpenPLCV3 is vulnerable to a cross-site request forgery CSRF attack due to the absence of proper CSRF validation. This issue allows an unauthenticated attacker to trick a logged-in administrator into visiting a maliciously crafted link, potentially enabling unauthorized modification of PLC settin...

CVE-2025-13970 OpenPLC_V3 Cross-Site Request Forgery

OpenPLCV3 is vulnerable to a cross-site request forgery CSRF attack due to the absence of proper CSRF validation. This issue allows an unauthenticated attacker to trick a logged-in administrator into visiting a maliciously crafted link, potentially enabling unauthorized modification of PLC settin...

CVE-2025-13970

OpenPLC_V3 (CVE-2025-13970) is reported across multiple sources to be vulnerable to a cross-site request forgery (CSRF) due to missing CSRF validation. The vulnerability allows an unauthenticated attacker to lure a logged-in administrator into visiting a malicious link, potentially enabling unaut...

PT-2025-51034

Name of the Vulnerable Software and Affected Versions OpenPLC V3 affected versions not specified Description The software is susceptible to a cross-site request forgery CSRF attack because of missing CSRF validation. An unauthenticated attacker can potentially trick a logged-in administrator into...

CVE-2025-67721

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via...

CVE-2025-67721 Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via...

EUVD-2025-203101

MineAdmin has an insecure default password...

CVE-2025-12834

CVE-2025-12834 affects the WordPress plugin “Accept Stripe Payments Using Contact Form 7” and is due to insufficient input sanitization and output escaping in the failure_message parameter. The issue enables a Reflected XSS by unauthenticated attackers, who must lure a user to perform an action (...

PT-2025-50955

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.5 Description The software is susceptible to a stored Cross Site Scripting XSS issue. The vulnerability exists through the /msg/add API endpoint. An attacker could potentially inject malicious scripts that are then...

CVE-2025-65854

Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of China's Ji Sheng Hua. A security vulnerability exists in jshERP v3.5 and earlier versions, which stems from a stored cross-site scripting vulnerability in the /msg/add endpoint...

CVE-2025-65854

Insecure permissions within the scheduled tasks feature of MineAdmin v3.x allow an attacker to execute arbitrary commands. This vulnerability can lead to a full account takeover . While the impact is significant, no specific patch version or remediation is currently provided in the documentation.

CVE-2025-66043

Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 3...

TeamViewer DEX Client 安全漏洞

TeamViewer DEX Client is a digital employee experience and endpoint management software from TeamViewer Germany. An elevation of privilege vulnerability exists in TeamViewer DEX Client, which can be exploited by an attacker to cause elevation of privilege and execute arbitrary code...

EUVD-2025-202587

XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers to access sensitive information via side-channel analysis of the data cache...

Important: Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (ROCm)

Red Hat AI Inference Server 3.2.2 ROCm is now available. Red Hat® AI Inference Server...

Important: Red Hat Security Advisory: Red Hat Quay 3.9.17

Red Hat Quay 3.9.17 is now available with bug fixes. Quay 3.9.17...

CVE-2025-67537

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Stored XSS.This issue affects ThirstyAffiliates: from n/a through = 3.11.8...

CVE-2025-65602

ChanCMS v3.3.4 contains a template injection vulnerability in the /vip/v1/file/save API endpoint that enables arbitrary code execution via a crafted POST request. Affected component/file: /vip/v1/file/save in ChanCMS 3.3.4. Root cause: template injection allowing code execution, as described acro...