CVE-2025-25759

An issue in the component admintemplate.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request...

CVE-2024-53542

Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request...

CVE-2025-25785

CVE-2025-25785 affects JizhiCMS v2.5.4 through a Server-Side Request Forgery (SSRF) in the c\PluginsController.php component. The vulnerability enables an attacker to initiate an intranet scan via a crafted request. The reported impact is high confidentiality and integrity risk (C/H, I/H) with no...

jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos

A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service...

CVE-2024-53542

Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request...

CVE-2025-25767

A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request...

jspxcms 安全漏洞

jspxcms is a content management system by rebic individual developers. A security vulnerability exists in jspxcms versions v9.0 through v9.5 that stems from the presence of cross-site request forgery CSRF, which allows an attacker to arbitrarily add an administrator account via a crafted request...

CVE-2025-25767

A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request...

Eval Injection

Overview Affected versions of this package are vulnerable to Eval Injection via the SolrSearch process. An attacker can execute arbitrary code on the server by sending a crafted request to the vulnerable endpoint. Workaround This vulnerability can be mitigated by editing Main.SolrSearchMacros in...

Tenda i12 安全漏洞

The Tenda i12 is an enterprise commercial high power AP wireless access point. A buffer overflow vulnerability exists in the Tenda i12 formwrlSSIDset processing list parameter, which can be exploited by a remote attacker to submit a special request that can crash the application and cause a denia...

BIT-GITLAB-2025-1212 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information...

CVE-2025-1212

An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information...

UBUNTU-CVE-2025-1212

An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information...

CVE-2025-1212

CVE-2025-1212 is an information-disclosure vulnerability in GitLab CE/EE (affecting all versions before 17.6.5, before 17.7.4 for 17.7, and before 17.8.2 for 17.8). A crafted request to a backend server can reveal sensitive information. Impact is limited to confidentiality (high in NVD metrics; e...

CVE-2024-46434

Tenda W18E V16.01.0.81625 suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain administrative access by sending a specially crafted HTTP request...

Tenda W18E 授权问题漏洞

The Tenda W18E is a wireless router from the Chinese company Tenda. An authorization issue vulnerability exists in the Tenda W18E version 16.01.0.81625, which stems from improper authentication of the device and can be exploited by an attacker to gain administrative access by sending a specially...

The vulnerability of the Kibana data visualization service, related to unlimited resource distribution, allows a perpetrator to cause a service failure.

The vulnerability of the Kibana data visualization service is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause a service failure by sending a specially crafted request...

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system for managing enterprise resources allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system relates to the lack of authenticity verification for a critical function. Exploitation of this vulnerability could allow an attacker, operating remotely, to compromise the confidentiality, integrity, a...

The vulnerability of the software for centralized device management of Fortinet’s FortiManager, as well as the security event monitoring and analysis tools FortiAnalyzer and FortiAnalyzer-BigData, arises from a buffer overflow in the stack. This vulnerability allows an attacker to execute arbitrary code.

The vulnerability of the Fortinet FortiManager software for centralized device management, as well as the FortiAnalyzer and FortiAnalyzer-BigData security event monitoring and analysis tools, is related to buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute...

The vulnerability of the CMSimple content management system, related to incorrect restrictions on the path to the restricted access catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the CMSimple content management system is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by sending a specially crafted GET request...