6119 matches found
erjinzhi 10OA 安全漏洞
erjinzhi 10OA is an enterprise automation system from China Binary erjinzhi. A security vulnerability exists in erjinzhi 10OA version 1.0, which stems from an incorrect manipulation of the parameter File in the file /view/file.aspx, which could lead to path traversal...
Fedora 41 : civetweb (2025-ed25a8b170)
The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ed25a8b170 advisory. civetweb 1.16 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issu...
CVE-2025-59039
Prebid Universal Creative PUC is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should s...
CVE-2025-40695
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This...
CVE-2025-40696
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fullname', 'location' and 'message' parameters via POST at the endpoint '/ofrs/reporting.php'. This vulnerability could...
Security Bulletin: Uncontrolled Resource Consumption in Apache Commons Configuration 1.x When Loading Untrusted Configurations, affects watsonx.data
Summary Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons...
CVE-2025-9623
CVE-2025-9623 affects the WordPress plugin Admin in English with Switch . The vulnerability is a Cross-Site Request Forgery (CSRF) in all versions up to and including 1.1, caused by missing or incorrect nonce validation on the enable_eng function. This allows unauthenticated attackers to modify a...
PT-2025-37144
The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish save option function. This makes it possible for unauthenticated attackers to modify plugin settings...
CVE-2025-29592
oasys v1.1 is vulnerable to Directory Traversal in ProcedureController...
CVE-2025-40979 DLL search order hijack in Wave by Grandstream Networks
DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this vulnerability could allow attackers with local access to execute arbitrary code by placing an arbitrary file in the 'C:\Users\AppData\Local\Temp' directory, which could lead to...
Linux Distros Unpatched Vulnerability : CVE-2016-8596
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in the cspcanprocessframe in cspifcan.c in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute...
Freshworks Platform 输入验证错误漏洞
Freshworks Platform is a customer service software platform from Freshworks USA. An input validation error vulnerability exists in Freshworks Platform versions 1.2.3 and earlier, which stems from an open redirect due to a misbehavior of file/api/v2/logout with respect to the parameter...
CVE-2025-29592
oasys v1.1 is vulnerable to Directory Traversal in ProcedureController...
Linux Distros Unpatched Vulnerability : CVE-2014-1686
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation. CVE-2014-1686 Note that Nessus relies on the...
September 9, 2025—KB5065427 (OS Build 14393.8422)
None None...
CVE-2025-10113
A security vulnerability has been detected in itsourcecode Student Information Management System 1.0. This affects an unknown function of the file /admin/modules/room/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has...
KB5065430: Windows 10 LTS 1507 Security Update (September 2025)
The remote Windows host is missing security update 5065430. It is, therefore, affected by multiple vulnerabilities - SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make t...
itsourcecode E-Logbook with Health Monitoring 安全漏洞
itsourcecode E-Logbook with Health Monitoring is a itsourcecode open source electronic logbook with health monitoring. A security vulnerability exists in version 1.0 of itsourcecode E-Logbook with Health Monitoring, which is caused by a SQL injection due to incorrect manipulation of the parameter...
CVE-2025-10112 itsourcecode Student Information Management System index.php sql injection
A weakness has been identified in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/modules/department/index.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The...