1777 matches found
SAP NetWeaver AS ABAP Authorization Bypass (3565944)
The remote SAP NetWeaver ABAP server may be affected by an authorization bypass vulnerability. Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges could execute certain forms of SQL queries...
CVE-2025-32240
creationtimestamp| type| source ---|---|--- 2025-04-10 08:48:50+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11206 2025-04-10 11:10:48+00:00| seen| https://t.me/cvedetector/22636 2025-04-10 11:32:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmhfsljwju2u...
CVE-2025-31333
SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability is not impacted...
CVE-2025-30657
creationtimestamp| type| source ---|---|--- 2025-04-09 20:48:48+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11177 2025-04-09 23:28:07+00:00| seen| https://t.me/cvedetector/22592 2025-04-09 23:38:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmg5v6aivh2i 2026-04-09...
CVE-2025-3475 WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030
Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0...
CVE-2025-30280
A vulnerability has been identified in Mendix Runtime V10 All versions V10.21.0, Mendix Runtime V10.12 All versions V10.12.16, Mendix Runtime V10.18 All versions V10.18.5, Mendix Runtime V10.6 All versions V10.6.22, Mendix Runtime V8 All versions V8.18.35, Mendix Runtime V9 All versions V9.24.34...
CVE-2025-3426 Use of default hardcoded credentials
We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-enginee...
CVE-2025-3194
Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE function. Attackers can exploit this to crash the application...
CVE-2025-31075
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in videowhisper MicroPayments paid-membership allows Stored XSS.This issue affects MicroPayments: from n/a through = 2.9.29...
CVE-2025-2865 Reflected Cross-Site Scripting (XSS) vulnerability in saTECH BCU
SaTECH BCU, in its firmware version 2.1.3, could allow XSS attacks and other malicious resources to be stored on the web server. An attacker with some knowledge of the web application could send a malicious request to the victim users. Through this request, the victims would interpret the code...
Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks
From @jackfromeast and @superboy-zjc: We have identified a class pollution vulnerability in Mesop = 0.14.0 application that allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service Do...
CVE-2025-30799
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pagup WP Google Street View wp-google-street-view allows Stored XSS.This issue affects WP Google Street View: from n/a through = 1.1.5...
SAP Business Objects Business Intelligence Platform Information Disclosure Vulnerability (CNVD-2025-07542)
SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. An information disclosure vulnerability exists in SAP Business Objects Business Intelligence Platform, which stems from the application's inadequate...
CVE-2025-27631
The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website...
CVE-2025-27633
Summary: CVE-2025-27633 affects the Hitachi Energy TRMTracker web application, with a reflected cross-site scripting (XSS) vulnerability due to client-side code injection. The issue could compromise confidentiality and integrity and is described across multiple sources as a reflected XSS risk. CV...
CVE-2025-2109
CVE-2025-2109: WP Compress – Instant Performance & Speed Optimization (WordPress) is affected up to v6.30.15 by an unauthenticated SSRF via the init() function. Impact: attacker can trigger web requests to internal/external locations from the web app to glean information. CVSSv3.1 base score 5.8 ...
CVE-2024-11301
In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator...
CVE-2024-57170
SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichiertodelete" parameter allows authenticated attackers to specify file paths containing directory traversal sequences e.g., ../. This vulnerability enables attackers to delete arbitrary files outside t...
CVE-2024-11301
In lunary-ai/lunary before version 1.6.3, the application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator...
CVE-2024-6841 CSRF in vanna-ai/vanna
A Cross-Site Request Forgery CSRF vulnerability exists in the latest commit 56b782bcefd2e59b19cd7ba7878b95f54884f502 of the vanna-ai/vanna repository. Two endpoints in the built-in web app that provide SQL functionality are implemented as simple GET requests, making them susceptible to CSRF...