PT-2025-27824 · Phpstudy · Phpstudy

Name of the Vulnerable Software and Affected Versions: PHPStudy versions 2016 through 2018 Description: A backdoor in PHPStudy allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charse...

CVE-2025-20309

CVE-2025-20309 affects Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). The root cause is static, hardcoded root credentials that cannot be changed or deleted, enabling an unauthenticated, remote attacker to log in using the root accoun...

CVE-2025-34073 stamparm/maltrail <=0.54 Remote Command Execution

An unauthenticated command injection vulnerability exists in stamparm/maltrail Maltrail versions =0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input...

CVE-2025-6898

A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the file in proxyclient.asp. The manipulation of the argument proxysrv/proxylanport/proxylanip/proxysrvport leads to os command injection. The...

CVE-2025-4689

The CVE-2025-4689 entry concerns Ads Pro Plugin for WordPress (Advertising Manager). The connected sources confirm a vulnerability chain: an unauthenticated Local File Inclusion (LFI) that can lead to Remote Code Execution (RCE), triggered by a prior SQL Injection, within all versions up to 4.89....

CVE-2025-6882

A vulnerability classified as critical has been found in D-Link DIR-513 1.0. This affects an unknown part of the file /goform/formSetWanPPTP. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

CVE-2025-45931

An issue D-Link DIR-816-A2 DIR-816A2FWv1.10CNB05R1B011D88210 allows a remote attacker to execute arbitrary code via system function in the bin/goahead file...

PT-2025-27664

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue allows an unauthorized attacker to execute code over a network due to a 'type confusion' vulnerability in Microsoft Edge Chromium-based, enabling remote code...

CVE-2025-53107

CVE-2025-53107 affects the Serverless/MCP server package used by cyanheads/git-mcp-server. The vulnerability is a command injection in which input parameters are unsafely incorporated into shell commands via child_process.exec, enabling an attacker to inject arbitrary commands and potentially ach...

CVE-2025-34060 Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to filegetcontents without validation. MIME type checks using...

CVE-2025-6854

A vulnerability classified as problematic was found in chatchat-space Langchain-Chatchat up to 0.3.1. This vulnerability affects unknown code of the file /v1/files?purpose=assistants. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to...

PT-2025-27837

Name of the Vulnerable Software and Affected Versions DjVuLibre versions prior to 3.5.29 djvulibre versions prior to 3.5.28-2.1deb12u1 mingw-djvulibre version 3.5.29 djview versions prior to 3.5.28-2ubuntu0.25.04.1 djview3 versions prior to 3.5.28-2ubuntu0.25.04.1 djvulibre-bin versions prior to...

CVE-2025-6932 D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password

A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function gFnGenPassForQlync of the file /bin/httpd of the component Qlync Password Generation Handler. The manipulation leads to use of hard-coded password. It is possible to initiate...

CVE-2025-6930

A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/manage-foreigners-ticket.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has...

CVE-2025-6906

CVE-2025-6906 affects code-projects Car Rental System 1.0. The vulnerability is a SQL injection in the login.php file via the uname parameter, enabling remote exploitation. Documents repeatedly state this issue and public disclosure; no concrete patch/version fix is provided. Affected component: ...

CVE-2025-6901 code-projects Inventory Management System removeUser.php sql injection

A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /phpaction/removeUser.php. The manipulation of the argument userid leads to sql injection. The attack may be initiated remotely. The exploi...

CVE-2025-0634

Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2...

CVE-2025-45931

An issue D-Link DIR-816-A2 DIR-816A2FWv1.10CNB05R1B011D88210 allows a remote attacker to execute arbitrary code via system function in the bin/goahead file...

CVE-2025-6853

CVE-2025-6853 affects the Langchain-Chatchat backend component in the project "chatchat-space" up to version 0.3.1. The vulnerability is in the function upload_temp_docs under /knowledge_base/upload_temp_docs, where manipulating the flag argument enables a path traversal. The issue can be exploit...

CVE-2025-49003

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threa...