CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2020-0379

In the Bluetooth service, there is a possible spoofing attack due to a logic error. This could lead to remote information disclosure of sensitive information with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8...

CVE-2010-0228

Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key...

CVE-2019-5982

Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a malicous wireless LAN access point. A successful exploitation may result in a malicious file being downloaded/executed...

CVE-2019-10101

JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack...

CVE-2010-2968

The FTP daemon in Wind River VxWorks does not close the TCP connection after a number of failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2019-10244

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...

CVE-2012-0950

The Apport hook DistUpgradeApport.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. NOTE: this vulnerabilit...

PT-2025-22562 · Schule · Schule

Name of the Vulnerable Software and Affected Versions: Schule versions prior to 1.0.1 Description: The issue concerns the generateOTP function, which generates a 4-digit numeric One-Time Password OTP with a limited range of 9000 possible combinations. This small keyspace makes the OTP highly...

CVE-2006-5197

PDshopPro stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 /pdshoppro.mdb, 2 /data/pdshoppro.mdb, or 3 /shoppro/data/pdshoppro.mdb...

CVE-2005-3287

Incomplete blacklist vulnerability in Mailsite Express allows remote attackers to upload and possibly execute files via attachments with executable extensions such as ASPX, which are not converted to .TXT like other dangerous extensions, and which can be directly requested from the cache director...

CVE-2003-0355

Safari 1.0 Beta 2 v73 and earlier does not validate the Common Name CN field for X.509 Certificates, which could allow remote attackers to spoof certificates...

CVE-2002-2190

ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the passwords via an HTTP request to a .user file...

CVE-2006-6238

The AutoFill feature in Apple Safari 2.0.4 does not properly verify that all automatically populated form fields are visible to the user, which allows remote attackers to obtain sensitive information, such as usernames and passwords, via input fields of zero width, a variant of CVE-2006-6077...

PT-2025-21913 · Unknown · Phpgurukul Auto Taxi Stand Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Auto Taxi Stand Management System version 1.0 Description: A critical issue affects the processing of the file /admin/admin-profile.php, where the manipulation of the mobilenumber argument leads to SQL injection. The attack can be...

PT-2025-21931 · Unknown · Phpgurukul Online Marriage Registration System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Marriage Registration System version 1.0 Description: A critical issue affects an unknown part of the file /admin/between-dates-application-report.php. The manipulation of the fromdate and todate arguments leads to SQL...

CVE-2025-4773 PHPGurukul Online Course Registration level.php sql injection

A vulnerability was found in PHPGurukul Online Course Registration 3.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/level.php. The manipulation of the argument level leads to sql injection. The attack may be launched remotely. The exploit has...

Alibaba Cloud Linux 3 : 0091: trousers (ALINUX3-SA-2022:0091)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0091 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2020-24330: An issue was discovered in...

CVE-2025-4530

A vulnerability was found in fenghaha/megagao ssm-erp and productionssm 1.0. It has been declared as problematic. Affected by this vulnerability is the function handleFileDownload of the file FileController.java of the component File Handler. The manipulation leads to path traversal. The attack c...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2025-2850)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.452.b09-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2850 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...