CVE-2025-7936

A vulnerability has been found in fuyanglipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a and classified as critical. Affected by this vulnerability is the function queryPage of the file com/platform/controller/ScheduleJobLogController.java. The manipulation of the argument...

CVE-2025-7934

A vulnerability, which was classified as critical, has been found in fuyanglipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a. This issue affects the function queryPage of the file platform-schedule/src/main/java/com/platform/controller/ScheduleJobController.java. The manipulation ...

JPACookieShop 代码问题漏洞

JPACookieShop is a cake mall platform software by Jerryshensjf individual developer. A code issue vulnerability exists in JPACookieShop version 1.0, which stems from an incorrect operation of the function addGoods in the file GoodsController.java resulting in unlimited uploads...

Weitong Mall 注入漏洞

Weitong Mall Weitong Mall is a shopping mall system by fuyanglipengjun, an individual developer. Weitong Mall has an injection vulnerability, the vulnerability stems from a SQL injection problem in the function queryPage in the file...

TRENDnet TEW-WLC100P 安全漏洞

The TRENDnet TEW-WLC100P is a wireless LAN controller from Trendnet, Inc. A security vulnerability exists in the TRENDnet TEW-WLC100P version 2.03b03, which stems from enabling aggressive mode in the racoon configuration file, which could lead to an offline dictionary attack...

CVE-2025-7906 yangzongzhuan RuoYi CommonController.java uploadFile unrestricted upload

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to unrestricted upload. The...

Thinkgem JeeSite 代码问题漏洞

Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform of China Joyuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components , workflo...

GHSA-565H-44M8-4C2V xxl-job has Inadequate Encryption Strength

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with...

CVE-2025-7763 thinkgem JeeSite Site Controller SiteController.java select redirect

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...

CVE-2025-7763

CVE-2025-7763 affects thinkgem JeeSite up to version 5.12.0. The vulnerability lies in the Site Controller’s SiteController.java, where manipulation of the redirect argument in the select function causes an open redirect. Exploitation can be performed remotely, and public disclosure of the exploi...

CVE-2025-41238

VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI Paravirtualized SCSI controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine'...

PT-2025-29981

Name of the Vulnerable Software and Affected Versions thinkgem JeeSite versions up to 5.12.0 Description A problematic vulnerability exists in thinkgem JeeSite. The select function within the src/main/java/com/jeesite/modules/cms/web/SiteController.java file of the Site Controller component is...

Thinkgem JeeSite 输入验证错误漏洞

Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform of China Zhuo Yuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components ,...

CVE-2025-41238

VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI Paravirtualized SCSI controller that leads to an out of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine'...

The vulnerability of the access controller service allows attackers to exploit the Capability Access Management Service (camsvc) of Windows operating systems, thereby enabling them to increase their privileges.

The vulnerability of the access controller service related to the Capability Access Management Service camsvc on Windows operating systems is associated with competitive access to resources during a “race condition”. Exploiting this vulnerability can allow an attacker to enhance their privileges...

(Pwn2Own) Oracle VirtualBox OHCI USB Controller Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the...

FoxCMS 注入漏洞

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS. FoxCMS 1.2.5 and previous versions exist injection vulnerability, the vulnerability stems from the file app/admin/controller/Video.php in the parameter ids of the wrong operation leads to SQL injection...

Tenda AC500 安全漏洞

Tenda AC500 is a wireless controller device from Tenda, designed for small and medium-sized businesses, supporting cross-VLAN management of wireless networks. Tenda AC500 has a stack buffer overflow vulnerability, which originates from the parameter radio2g1 in the file /goform/setWtpData fails t...

CVE-2025-1384 Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers

Least Privilege Violation CWE-272 Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the...

CAN-Trace Attack: Exploit CAN Messages to Uncover Driving Trajectories

Driving trajectory data remains vulnerable to privacy breaches despite existing mitigation measures. Traditional methods for detecting driving trajectories typically rely on map-matching the path using Global Positioning System GPS data, which is susceptible to GPS data outage. This paper...