180810 matches found
EUVD-2025-203140
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3. An app may be able to gain root privileges...
CVE-2025-14569
CVE-2025-14569 affects ggml-org whisper.cpp up to version 1.8.2. The vulnerable component is the read_audio_data function in /whisper.cpp/examples/common-whisper.cpp, with a use-after-free condition reported under local access. Multiple connected sources (NVD, Red Hat, EUVD, Debian tracker, CNVD/...
CVE-2025-14568
CVE-2025-14568 affects haxxorsid Stock-Management-System (fbbbf213e9c93b87183a3891f77e3cc7095f22b0) with a SQL injection in the file model/User.php . The vulnerability arises from manipulation of the arguments employee_id , id , or admin , enabling remote exploitation. Public disclosure is noted,...
CVE-2025-13960 GPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
CVE-2025-14531 code-projects Rental Management System Log Transaction.java crlf injection
A vulnerability was found in code-projects Rental Management System 2.0. This affects an unknown function of the file Transaction.java of the component Log Handler. Performing manipulation results in crlf injection. The attack can be initiated remotely. The exploit has been made public and could ...
CVE-2025-14516 Yalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgery
A vulnerability was found in Yalantis uCrop 2.2.11. Affected by this issue is the function downloadFile of the file com.yalantis.ucrop.task.BitmapLoadTask.java of the component URL Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. The...
PT-2025-50692
Name of the Vulnerable Software and Affected Versions UTT 进取 512W versions prior to 3.1.7.7-171114 Description A buffer overflow issue exists in the Endpoint component of UTT 进取 512W. The issue is related to the strcpy function within the /goform/formNatStaticMap file. Manipulation of the NatBind...
Wordfence Bug Bounty Program Monthly Report – November 2025
Last month in November 2025, the Wordfence Bug Bounty Program received 746 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfen...
PT-2025-50416
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...
CVE-2025-67579
Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through = 16.8...
Security Bulletin: IBM Planning Analytics Local is vulnerable to disclosing sensitive information (CVE-2025-36437)
Summary A sensitive information disclosure vulnerability was addressed in the File manager component of IBM Planning Analytics Local - IBM Planning Analytics Workspace 2.1.16. Vulnerability Details CVEID:CVE-2025-36437 DESCRIPTION: IBM Planning Analytics Local could disclose sensitive information...
CVE-2025-14223
A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php. Such manipulation of the argument staffid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to t...
IBM Planning Analytics Local 安全漏洞
IBM Planning Analytics Local is a web-based local architecture from International Business Machines IBM. A security vulnerability exists in IBM Planning Analytics Local versions 2.1.0 through 2.1.15, which stems from the disclosure of server architecture information and could facilitate further...
EUVD-2025-201729
A weakness has been identified in code-projects Online Ordering System 1.0. The impacted element is an unknown function of the file /usercontact.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to...
CVE-2025-14193
A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /viewpersonnel.php. Executing a manipulation of the argument perid can lead to sql injection. The attack can be launched remotely. The exploit has been...
CVE-2025-14229
CVE-2025-14229 affects SourceCodester Inventory Management System 1.0, targeting the SVC Report Export component. The vulnerability arises from a manipulation that enables CSV injection , with remote feasibility and a publicly disclosed exploit. Public sources consistently describe the issue but ...
CVE-2025-14224
CVE-2025-14224 affects Yottamaster DM2/DM3/DM200 up to 1.2.23 and 1.9.12. The vulnerability is a path traversal in the File Upload component that can be triggered remotely. The exploit has been publicly released, enabling remote exploitation, and multiple sources note the vendor did not respond t...
CVE-2025-14223 code-projects Simple Leave Manager request.php sql injection
A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php. Such manipulation of the argument staffid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to t...
CVE-2025-14222 code-projects Employee Profile Management System print_personnel_report.php sql injection
A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /printpersonnelreport.php. This manipulation of the argument perid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used...
