4416 matches found
BIT-APPSMITH-2024-55964
An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that...
CVE-2025-25060
CVE-2025-25060 affects Hammock AssetView and AssetView CLOUD with a missing authentication for a critical function (CWE-306). An unauthenticated remote attacker could obtain and/or delete files on the server running AssetView. Affected versions: AssetView prior to 13.2.0 and AssetView CLOUD prior...
PT-2025-14545 · Bl-Ac2100 · Bl-Ac2100
Name of the Vulnerable Software and Affected Versions: BL-AC2100 versions 1.0.4 and earlier Description: The issue allows a remote attacker to execute arbitrary code via the enable parameter passed to "/goform/set hidessid cfg", which is not handled properly. Recommendations: For BL-AC2100 versio...
Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2025-016 (ALASTOMCAT9-2025-016)
The version of tomcat installed on the remote host is prior to 9.0.102-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2025-016 advisory. Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or...
CVE-2025-29266
Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled...
CVE-2025-2981
A vulnerability, which was classified as problematic, has been found in Legrand SMS PowerView 1.x. This issue affects some unknown processing. The manipulation of the argument redirect leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the publi...
CVE-2025-24517
Use of client-side authentication issue exists in CHOCO TEI WATCHER mini IB-MCT001 all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication...
CVE-2025-2976
CVE-2025-2976 affects GFI KerioConnect 10.0.6, with the vulnerability located in the File Upload component. The issue allows cross-site scripting via manipulation of uploaded content, and the attack can be launched remotely. Multiple connected sources describe an unknown file-upload function as t...
CVE-2025-2976 GFI KerioConnect File Upload cross site scripting
A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and...
CVE-2025-3011 PiExtract SOOP-CLM - SQL Injection
SOOP-CLM from PiExtract has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...
CVE-2025-2969
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2968
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2966
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2025-2965
CVE-2025-2965 has conflicting statuses across sources. Red Hat reports a ConcreteCMS remote‑exploitable cross‑site scripting flaw in the Save function of the Accordion Block Handler affecting up to version 9.3.9, with no fixed version and no remediation version published. CNNVD also indicates the...
CVE-2025-2961
A vulnerability classified as problematic was found in opensolon up to 3.1.0. This vulnerability affects the function rendermav of the file /aa of the component org.noear.solon.core.handle.RenderManager. The manipulation of the argument template with the input ../org/example/HelloApp.class leads ...
CVE-2025-22953
A SQL injection vulnerability exists in Epicor HCM 2021 1.9, with patches available: 5.16.0.1033/HCM2022, 5.17.0.1146/HCM2023, and 5.18.0.573/HCM2024. The injection is specifically in the filter parameter of the JsonFetcher.svc endpoint. An attacker can exploit this vulnerability by injecting...
CVE-2025-2832 mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 cross-site request forgery
A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit...
