IIS Automation Tool Code Execution

The vulnerability of the tool for automating the publishing and management of web applications on servers running under IIS is related to the restoration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AviaBit-Airport Password Reset Disclosure

The vulnerability of the password-reset module of the WEB application of the “AviaBit-Airport” system is related to insufficient protection of operational data. Exploiting this vulnerability allows a malicious actor to disclose protected information by sending a specially crafted POST request...

WBM AviaBit-Airport Authentication Bypass

The vulnerability of the WBM system “AviaBit-Airport” relates to the absence of restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to carry out an attack using brute-force methods...

CVE-2025-55740

nginx-defender is a high-performance, enterprise-grade Web Application Firewall WAF and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml...

PT-2025-34249 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.7 Description: WeGIA is a Web manager for charitable institutions. A Stored Cross-Site Scripting XSS vulnerability exists in the dependente docdependente.php endpoint of the WeGIA application. This vulnerability...

NVIDIA WebDataset OS Command Injection Vulnerability

NVIDIA WebDataset is a high-performance data storage method from NVIDIA. NVIDIA WebDataset suffers from an operating system command injection vulnerability that can be exploited by an attacker to bypass the authentication process and take over the accounts of other web application users under...

Link11 Highlights Growing Cybersecurity Risks and Introduces Integrated WAAP Platform

Frankfurt am Main, Germany, 20th August 2025, CyberNewsWire...

CVE-2025-54017

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows PHP Local File Inclusion.This issue affects Paid Member Subscriptions: from n/a through = 2.15.4...

Akamai Beats Other WAAP Vendors in Third-Party Evaluation

...

Hospital Management System SQL Injection Vulnerability

Hospital Management System is a PHP and MySQL based hospital management system. Hospital Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter doctorspecilization in the file...

Online Shopping Portal Project signup.php File SQL Injection Vulnerability

Online Shopping Portal Project is an online shopping portal project. A SQL injection vulnerability exists in Online Shopping Portal Project, which originates from the lack of validation of externally entered SQL statements in the parameter emailid in the file /shopping/signup.php. An attacker can...

CVE-2025-55740

nginx-defender is a high-performance, enterprise-grade Web Application Firewall WAF and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml...

CVE-2025-55740 Default Credentials in nginx-defender Configuration Files

nginx-defender is a high-performance, enterprise-grade Web Application Firewall WAF and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml...

CVE-2025-55740

CVE-2025-55740 affects nginx-defender, a WAF/threat-detection system. The vulnerability is a configuration flaw where default credentials in example files (config.yaml and docker-compose.yml) are left unchanged (default_password: change_me_please; GF_SECURITY_ADMIN_PASSWORD=admin123). If exposed ...

CVE-2025-51543

An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/resetpassword endpoint...

CVE-2025-55288

Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Reflected Cross-Site Scripting XSS vulnerability was identified in the Genealogy application. Authenticated attackers could run arbitrary JavaScript in another user’s session, leading to session hijacking, data theft, and U...

CVE-2025-55287

CVE-2025-55287 affects Genealogy (PHP) versions prior to 4.4.0. The vulnerability is an authenticated stored XSS in the Person firstname/lastname, allowing an attacker (Editor+ or higher) to inject JavaScript that executes in other users’ sessions, potentially leading to session hijacking, data t...

GHSA-R936-GWX5-V52F Spring Framework MVC Applications Path Traversal Vulnerability

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container the Servlet...

CVE-2025-57703 Reflected Cross-site Scripting in DIAEnergie

DIAEnergie - Reflected Cross-site Scripting...

D-Link DIR-818L Multiple Vulnerabilities (2022 - 2025)

D-Link DIR-818L devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...