CVE-2025-29592

oasys v1.1 is vulnerable to Directory Traversal in ProcedureController...

PT-2025-37288

Name of the Vulnerable Software and Affected Versions: linlinjava litemall versions up to 1.8.0 Description: A weakness exists in linlinjava litemall up to version 1.8.0. The issue affects the WxAftersaleController function within the /wx/aftersale/cancel file. Manipulation of the ID argument can...

CVE-2025-9166

A denial-of-service security issue exists in the affected product and version. The security issue stems from the controller repeatedly attempting to forward messages. The issue could result in a major nonrecoverable fault on the controller...

Advisory ROSA-SA-2025-3007

software: qt5-qtconnectivity 5.15.10 OS: ROSA-CHROME unaffected versions = qt5-qtconnectivity-5.15.15-3 affected versions qt5-qtconnectivity-5.15.15-3 CVE-ID: CVE-2025-23050 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: In the Qt Bluetooth module QLowEnergyController on Linux when using the Bluetooth...

CVE-2025-10232 299ko FileManagerAPIController.php delete path traversal

A weakness has been identified in 299ko up to 2.0.0. Affected by this issue is the function getSentDir/delete of the file plugin/filemanager/controllers/FileManagerAPIController.php. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has...

CVE-2025-10232 299ko FileManagerAPIController.php delete path traversal

A weakness has been identified in 299ko up to 2.0.0. Affected by this issue is the function getSentDir/delete of the file plugin/filemanager/controllers/FileManagerAPIController.php. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has...

kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix use-after-free in vhciflush syzbot reported use-after-free in vhciflush without repro. 0 From the splat, a thread closed a vhci file descriptor while its device was being used by iotcl on another thread...

CVE-2025-10211 yanyutao0402 ChanCMS getArticle CollectController server-side request forgery

A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getArticle. The manipulation of the argument taskUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit ha...

CVE-2025-10211 yanyutao0402 ChanCMS getArticle CollectController server-side request forgery

A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getArticle. The manipulation of the argument taskUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit ha...

CVE-2025-29592

oasys v1.1 is vulnerable to Directory Traversal in ProcedureController...

CVE-2025-41682

An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password...

CVE-2025-10086

A weakness has been identified in fuyanglipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component AdPositionController. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been made...

CVE-2025-10084

A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLogController. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly...

PT-2025-83: Improper permission assignment to a critical resource in Fastwel PLC web server

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. Exploitation of the vulnerability allows an attacker with administrative permissions in a restricted environment to execute arbitrary code in the operating system and escalate thei...

oasys 安全漏洞

oasys is an OA office automation system by the individual developer misstt123. A security vulnerability exists in oasys v1.1, which stems from the vulnerability of ProcedureController to directory traversal attacks...

CVE-2025-29592

CVE-2025-29592 affects oasys v1.1 and involves a Directory Traversal vulnerability in the ProcedureController. The root cause, as described across multiple sources, is an unsafe handling in the controller that could allow access to restricted files/directories. Reported CVSSv3.1 base score is 5.6...

PT-2025-86: Disclosure of confidential data via controller configuration request in Fastwel PLC web server

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. The discovered vulnerability can be exploited by an attacker to obtain administrator‑level privileges. Vulnerability status: Confirmed by vendor Date of vulnerability remediation:...

PT-2025-88: Cross‑site scripting and open redirect in Fastwel PLC web interface

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. The discovered vulnerability stems from the lack of user input filtering in the redirect parameter. Exploitation of the vulnerability allows a remote attacker to execute arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2013-6647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in AnimationController::endAnimationUpdate in Google Chrome. CVE-2013-6647 Note that Nessus relies on the presence of the package as reported b...

PT-2025-85: Insufficient access control in Fastwel PLC web server

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. Exploitation of the vulnerability allows an attacker with an unprivileged account to gain the access to protected information. Vulnerability status: Confirmed by vendor Date of...