CVE-2025-20992

Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out-of-bounds memory...

PT-2025-23769 · Ideacms · Ideacms

Name of the Vulnerable Software and Affected Versions: IdeaCMS versions up to 1.7 Description: A critical issue affects the function Article/Goods of the file "/api/v1.index.article/getList.html". The manipulation of the Field argument leads to SQL injection. The attack may be initiated remotely...

PT-2025-23752

Name of the Vulnerable Software and Affected Versions Android versions prior to SMR Jun-2025 Release 1 Description The issue concerns the improper export of Android application components in Bluetooth, allowing local attackers to make devices discoverable. Recommendations For Android versions pri...

PT-2025-23415 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS up to 20250504 Description: A critical issue was found in the File Handler component, specifically affecting the filedeal function of the /systemController/filedeal.do file. This leads to improper access controls, allowing remote...

PT-2025-23166 · Aptiov · Aptiov

Name of the Vulnerable Software and Affected Versions: APTIOV affected versions not specified Description: The issue is related to an Improper Input Validation in the BIOS, which can be exploited locally by an attacker. This could potentially impact the integrity of the system. Recommendations: A...

PT-2025-23078 · Sourcecodester · Sourcecodester Computer Store System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Store System version 1.0 Description: A critical issue has been found in the SourceCodester Computer Store System. This issue affects the function Add of the file main.c. The manipulation of the argument...

CVE-2025-5172

CVE-2025-5172 affects Econtrata up to 20250516. The vulnerability resides in an unknown function within /valida, where manipulating the usuario parameter yields SQL injection. Exploitation is described as remote and publicly disclosed, with vendor non-response noted. Connected sources corroborate...

CVE-2025-5164

A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is...

CVE-2025-5163 yangshare 技术杨工 warehouseManager 仓库管理系统 access control

A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0. This affects an unknown part. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be...

PT-2025-22860 · Wcms · Wcms

Name of the Vulnerable Software and Affected Versions: WCMS versions up to 8.3.11 Description: A critical issue has been found in the Login component, specifically affecting the getMemberByUid function. The manipulation of the uid argument leads to improper authentication, allowing for remote...

CVE-2024-38863

Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions 2.3.0p18, 2.2.0p35 and 2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks...

CVE-2024-7416

The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...

CVE-2024-3961

The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tagsubscriber function in all versions up to, and including, 2.4.9. This makes it possible for...

CVE-2024-5280

The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack...

CVE-2024-48272

D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack...

CVE-2023-34235

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-50714

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the authCodeVerifier should be removed after usage similar to authStat...

CVE-2023-46385

LOYTEC electronics GmbH LINX Configurator all versions is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration...

CVE-2023-2446

The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for...

CVE-2022-29882

A vulnerability has been identified in SICAM T All versions V3.0. Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses the error logs - perform arbitrary...