PT-2025-39679

Name of the Vulnerable Software and Affected Versions itsourcecode Online Clinic Management System version 1.0 Description A flaw exists in itsourcecode Online Clinic Management System version 1.0. The issue involves the potential for SQL injection through manipulation of the ID argument in a...

PT-2025-39672

Name of the Vulnerable Software and Affected Versions Dibo Data Decision Making System versions prior to 2.7.0 Description A path traversal issue exists in Dibo Data Decision Making System. The issue is related to the manipulation of the filePath argument within the downloadImpTemplet function...

PT-2025-39662

Name of the Vulnerable Software and Affected Versions SonarQube versions prior to 6.0.0 Description A command injection issue exists in the SonarQube GitHub Action when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This bypasses a previou...

CVE-2025-20364

Cisco Wireless AP Software is affected by CVE-2025-20364 in the Device Analytics action frame processing. The issue stems from insufficient verification of incoming 802.11 Device Analytics action frames, enabling an unauthenticated, adjacent attacker to inject frames with arbitrary information. A...

CVE-2025-20364

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point AP Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vulnerability is due to insufficient verification checks of incomin...

CVE-2025-20364

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point AP Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vulnerability is due to insufficient verification checks of incomin...

CVE-2025-10779

A vulnerability was found in D-Link DCS-935L up to 1.13.01. The impacted element is the function sub402280 of the file /HNAP1/. The manipulation of the argument HNAPAUTH/SOAPAction results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and...

Cisco Wireless LAN Controller 安全漏洞

Cisco Wireless LAN Controller WLC is a wireless LAN controller product from Cisco USA. The product provides security policy, intrusion detection, and other functions in a wireless LAN. A security vulnerability exists in Cisco Wireless LAN Controller that stems from insufficient validation of 802....

CVE-2025-10764

A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may b...

CVE-2025-9887

The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in the /frndzkadminclsw.php file. This makes it possible for unauthenticated attackers to change the...

CVE-2025-10779

A vulnerability was found in D-Link DCS-935L up to 1.13.01. The impacted element is the function sub402280 of the file /HNAP1/. The manipulation of the argument HNAPAUTH/SOAPAction results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and...

D-Link DCS-935L 安全漏洞

The D-Link DCS-935L is a router from China's AUO D-Link. A buffer overflow vulnerability exists in D-Link DCS-935L version 1.13.01 and earlier, which originates from the parameter HNAPAUTH/SOAPAction in file /HNAP1/ that fails to correctly validate the length and size of the input data, and can b...

CVE-2025-10764

A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may b...

CVE-2025-10764

CVE-2025-10764 affects SeriaWei ZKEACMS up to 4.3, specifically the Edit function in Event Action System at src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs. The vulnerability stems from manipulation of the Data argument, enabling server-side request forgery (SSRF) from remote attacke...

CVE-2025-10764 SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery

A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may b...

CVE-2025-10764 SeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery

A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may b...

CVE-2025-8487

The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-lev...

PT-2025-38659

Name of the Vulnerable Software and Affected Versions SeriaWei ZKEACMS versions prior to 4.4 Description A vulnerability exists in SeriaWei ZKEACMS up to version 4.3. The issue affects the Edit function within the src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs file of the Event Acti...

CVE-2025-10662

A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /adminmembers.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be use...

CVE-2025-9949 Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery

The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the processbulkaction function. This makes it possible for...