CVE-2025-45617

Incorrect access control in the component /user/list of productionssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload...

CVE-2025-45610

PassJava-Platform v3.0.0 is affected by CVE-2025-45610. The issue is an incorrect access control in the component "/scheduleLog/info/1" that allows access to sensitive information via a crafted payload. CVSS v3.1 base score 7.5 (HIGH) with NETWORK attack vector, LOW complexity, no privileges, no ...

CVE-2025-45614

The CVE-2025-45614 issue affects One v1.0, specifically the /api/user/manager component. Root cause: incorrect access control that may allow an attacker to access sensitive information via a crafted payload. Impact is described as exposure of sensitive data; no explicit exploitDetails or fixed ve...

CVE-2025-45608

Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload...

CVE-2025-45618

CVE-2025-45618 affects jeeweb-mybatis-springboot v0.0.1.RELEASE, with an incorrect access control issue in the component /admin/sys/datasource/ajaxList. The vulnerability allows an attacker to access sensitive information via a crafted payload. The public documentation consistently states imprope...

CVE-2025-45608

Summary : CVE-2025-45608 affects Xinguan v0.0.1-SNAPSHOT, where the /system/user/findUserList API has incorrect access control, enabling attackers to access sensitive information via a crafted payload. The vulnerability is described consistently across NVD/Red Hat/CVE/CNNVD-style records and thir...

CVE-2025-45609

CVE-2025-45609 affects the Kob project (latest v1.0.0-SNAPSHOT). The root cause is improper access control in the doFilter() function, enabling an attacker to access sensitive information via a crafted payload. The NVD entry lists a CVSSv3.1 base score of 7.5 (HIGH) with Network attack vector, Lo...

CVE-2025-45610

Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payload...

CVE-2025-45614

Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload...

CVE-2025-45613

Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload...

CVE-2025-45613

Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2025-09283)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from International Business Machines IBM. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for...

Regular Expression Denial of Service (ReDoS)

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the token2json function in the processingdonut module. An attacker can cause high CPU usage and potential...

Exploit for CVE-2025-43960

CVE-2025-43960 - PHP Object Injection in Adminer !2https:...

CVE-2025-29526

The CVE-2025-29526 entry affects Q4 Inc Investor Relations Platform v5.147.1.2, where an unfiltered input in the SearchTerm parameter of the search function enables Cross-Site Scripting (XSS), allowing arbitrary Javascript execution. Affected component: Search feature; root cause: insufficient in...

CVE-2024-53569

Volmarg Personal Management System (PWM) v1.4.65 is affected by a stored XSS in the New Goal Creation feature. The vulnerability is triggered by injecting a crafted payload into the description field, allowing an authenticated attacker to execute arbitrary web scripts or HTML in the context of th...

CVE-2024-53568

A stored cross-site scripting XSS vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the tag parameter...

CVE-2023-43378

A cross-site scripting XSS vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento11 parameter...

CVE-2024-53569

A stored cross-site scripting XSS vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the description parameter...

WorldCast Systems ECRESO FM/DAB/TV Transmitter 安全漏洞

The WorldCast Systems ECRESO FM/DAB/TV Transmitter is a series of all-digital transmitters for analog FM from WorldCast Systems. A security vulnerability exists in WorldCast Systems ECRESO FM/DAB/TV Transmitter version 1.10.1, which stems from a specially crafted JSON payload that could lead to...