4416 matches found
CVE-2025-7907 yangzongzhuan RuoYi Druid application-druid.yml default credentials
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/src/main/resources/application-druid.yml of the component Druid. The manipulation leads to use of default credentials. It is possible to...
CVE-2025-7907
The CVE-2025-7907 entry concerns the yangzongzhuan RuoYi project (up to 4.8.1) with a Druid component issue in ruoyi-admin/src/main/resources/application-druid.yml. The vulnerability arises from manipulation that enables use of default credentials, and it is exploitable remotely. Public exploit i...
CVE-2025-7905 itsourcecode Insurance Management System insertPayment.php sql injection
A vulnerability has been found in itsourcecode Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /insertPayment.php. The manipulation of the argument reciptno leads to sql injection. The attack can be initiated remotely. The exploit ha...
CVE-2025-7903 yangzongzhuan RuoYi Image Source ui layer
A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The...
CVE-2025-7902
A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The...
CVE-2025-7902
CVE-2025-7902 affects YangZongZhuan RuoYi up to version 4.8.1. The vulnerability is in the function addSave of file com/ruoyi/web/controller/system/SysNoticeController.java , causing a cross-site scripting (XSS) issue. It can be triggered remotely and exploitation details have been disclosed publ...
CVE-2025-7894
Onyx is affected up to version 0.29.1, with the SQL injection vulnerability arising via the generate_simple_sql function in backend/onyx/agents/agent_search/kb_search/nodes/a3_generate_simple_sql.py (Chat Interface). The issue allows remote exploitation and has been publicly disclosed. Connected ...
CVE-2025-7874 Metasoft 美特软件 MetaCRM env.jsp information disclosure
A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /env.jsp. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the...
CVE-2025-7870 Portabilis i-Diario justificativas-de-falta Endpoint cross site scripting
A vulnerability, which was classified as problematic, was found in Portabilis i-Diario 1.5.0. This affects an unknown part of the component justificativas-de-falta Endpoint. The manipulation of the argument Anexo leads to cross site scripting. It is possible to initiate the attack remotely. The...
CVE-2025-7868 Portabilis i-Educar Calendar educar_calendario_dia_motivo_cad.php cross site scripting
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educarcalendariodiamotivocad.php of the component Calendar Module. The manipulation of the argument Motivo/descricao results in cross site scripting. It is possible to...
CVE-2025-7858 PHPGurukul Apartment Visitors Management System HTTP POST Request admin-profile.php cross site scripting
A vulnerability classified as problematic has been found in PHPGurukul Apartment Visitors Management System 1.0. This affects an unknown part of the file /admin-profile.php of the component HTTP POST Request Handler. The manipulation of the argument adminname leads to cross site scripting. It is...
CVE-2025-50708
An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL...
CVE-2025-7800 cgpandey hotelmis HTTP GET Request admin.php cross site scripting
A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown code of the file admin.php of the component HTTP GET Request Handler. The manipulation of the argument Search leads to cross site scripting...
CVE-2025-7797
Removed by vendor...
Remote Code Execution (RCE)
github.com/juju/juju is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient authorization checks caused by allowing any authenticated controller user to upload arbitrary agent binaries to any model or the controller without verifying model membership or permissions...
XWiki 7.2-milestone-2 < 16.4.7, 16.5.0-rc-1 < 16.10.3, 17.0.0-rc-1 < 17.0.0 RCE Vulnerability (GHSA-jp4x-w9cj-97q7)
Xwiki is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...
PT-2025-30090 · Wx-Discuz · Wx-Discuz
Name of the Vulnerable Software and Affected Versions: descreekert wx-discuz versions prior to 12bd4745c63ec203cb32119bf77ead4a923bf277 Description: A vulnerability exists in the validToken function of the /wx.php file. Manipulation of the echostr argument can lead to cross-site scripting. The...
CVE-2025-54068
Summary (validated by connected docs): CVE-2025-54068 affects Laravel Livewire v3 up to 3.6.3, where the component hydration/update mechanism can allow unauthenticated remote command execution under specific mounting/config conditions. Public advisories and templates confirm an in-the-wild risk a...
CVE-2025-52379
Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware update feature. The /web/umfileNameset.cgi and /web/umwebupgrade.cgi endpoints fail to properly sanitize the upgradeFileName parameter, allowing authenticated...