92 matches found
CVE-2025-66254
Unauthenticated Arbitrary File Deletion upgradecontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade parameter allows unauthenticated deletion of arbitrary...
PT-2025-46680
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.0.1 Splunk Enterprise versions 9.2.9 through 9.4.5 Splunk Cloud Platform versions below 9.3.2411.116 Splunk Cloud Platform versions 9.3.2408.124 and below Splunk Cloud Platform versions below 10.0.2503.5...
CVE-2025-10870
SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the 'ultralogin' parameter in '/centrosnet/ultralogin.php'...
SailPoint IdentityIQ 安全漏洞
SailPoint IdentityIQ is a complete solution from SailPoint that utilizes artificial intelligence and machine learning to enable seamless automated provisioning. A security vulnerability exists in SailPoint IdentityIQ that stems from the fact that certain IdentityIQ Web services can set the...
CVE-2025-53533 Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting XSS via a malformed URL path. The 404 error page includes t...
Newforma Project Center Server Code Execution Vulnerability
Newforma Project Center Server is a project information management solution for the Architecture, Engineering and Construction AEC industry from Newforma for centralized storage and management of project documents and collaboration. A code execution vulnerability exists in Newforma Project Center...
EUVD-2025-25203
Malicious code in bioql PyPI...
EUVD-2025-27978
Malicious code in bioql PyPI...
CVE-2025-9505
A flaw has been found in Campcodes Online Loan Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=saveloantype. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...
PT-2025-34657 · Dasan · Dasan Gpon Onu H660Wm +1
Name of the Vulnerable Software and Affected Versions: DASAN GPON ONU H660WM H660WMR210825 Description: An incorrect access control issue exists in the /cgi-bin/system diagnostic main.asp component, potentially allowing attackers to access sensitive information. Recommendations: At the moment,...
Exploit for CVE-2025-7769
CVE-2025-7769 – Remote Command Injection in mobileapi Des...
CVE-2025-0574
Sante PACS Server URL path Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists...
Teaching SQL注入漏洞
Goodat Teaching Teaching online teaching platform is a STEAM online education solution for organizations and schools from Shanghai Pigeon Egg Network Goodat, which aims to provide an innovative environment for teachers and students to teach and learn programming easily. A SQL injection...
WordPress plugin WPIDE 信息泄露漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...
VulnCheck KEV: CVE-2021-45837
It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 by sending a specifically crafted input to /tos/index.php?app/del...
The vulnerability of the /cgi-bin/cstecgi.cgi file, a microprogramming software for the Totolink T8 router, allows a hacker to disclose protected information.
The vulnerability of the /cgi-bin/cstecgi.cgi file, a microprogramming system for the Totolink T8 router, is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor to disclose protected information...
Rundeck Security Breach
Rundeck is an open source automation service with a web console, command line tools, and webAPI from Rundeck Inc. in the United States, which is primarily used to run automation tasks. A security vulnerability exists in Rundeck versions prior to 4.17.3, which stems from a vulnerability that could...
The vulnerability of the GLPI system’s request, incident, and inventory management functions arises from incorrect restrictions on the path to the restricted catalog when processing URL parameters. This allows attackers to carry out phishing attacks against user accounts.
The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes is related to incorrect restrictions on the path to the restricted access catalog when processing URL parameters. Exploiting this vulnerability allows a malicious actor to carry out...
CVE-2023-41263
An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With knowledge of valid IP addresses and source types, an unauthenticated attacker can download debug logs containing application-related information...