Simple Cafe Ordering System login.php File SQL Injection Vulnerability

Simple Cafe Ordering System is a simple coffee ordering system. The Simple Cafe Ordering System suffers from a SQL injection vulnerability that originates from the /login.php file not securely filtering the Username parameter. An attacker can exploit this vulnerability to remotely obtain sensitiv...

CVE-2025-36460

Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An...

CVE-2025-3717

When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is n...

Sensitive Information Exposure

com.liferay.portal.template.freemarker is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper data handling in Freemarker templates, where sensitive user data is unintentionally included in the template context, allowing an unauthorized actor to access and potential...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the SysFileApi function. An attacker can access arbitrary files on the server by supplying crafted input to the fileName parameter. Details A Directory Traversal attack also known as path traversal aims to access...

CVE-2025-10460

A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input...

The vulnerability of the hfi1_ipoib_tx_timeout() function in the drivers/infiniband/hw/hfi1/ipoib_tx.c module of the Linux operating system’s InfiniBand driver allows a hacker to gain access to protected information.

The vulnerability of the hfi1ipoibtxtimeout function in the drivers/infiniband/hw/hfi1/ipoibtx.c module of the Linux operating system’s InfiniBand driver lies in the absence of memory release after the effective lifespan has ended. Exploiting this vulnerability could allow an attacker to gain...

The vulnerability of the cmaCancelRoute() function in the drivers/infiniband/core/cma.c module of the Linux operating system’s kernel driver allows a hacker to gain access to protected information.

The vulnerability of the cmaCancelRoute function in the drivers/infiniband/core/cma.c module of the Linux operating system’s InfiniBand support driver relates to the lack of memory release after the effective lifespan of the function. Exploiting this vulnerability could allow an attacker to gain...

ROS-20251117-04

A vulnerability in the LXD container and lightweight virtual machine management system is related to redundant API data output. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to potentially sensitive information The vulnerability in the LXD container and...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to insufficient protection of operational data, allows attackers to disclose protected information.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD lies in the insufficient protection of sensitive data at the final endpoint /api/v1/projects/project/detailed. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

SQL Injection Vulnerability in Multimedia Integrated Service Display System of Beijing Divine Vision Han Technology Co., Ltd (CNVD-C-2025-859399)

Ltd. is a deep-rooted enterprise in the field of visualization. A SQL injection vulnerability exists in the multimedia integrated business display system of Beijing Divine Vision Han Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

The vulnerability of the fsl_ifc_ctrl_probe() function in the drivers/memory/fsl_ifc.c file of the memory controller driver for the Linux operating system allows a attacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the fslifcctrlprobe function in the drivers/memory/fslifc.c file of the Linux kernel’s memory controller driver is related to security configuration errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of protected...

The vulnerability of the `create_core_data()` function in the `drivers/hwmon/coretemp.c` file of the Linux kernel allows a attacker to access protected information or cause service failures.

The vulnerability of the createcoredata function in the drivers/hwmon/coretemp.c file of the Linux kernel lies in the handling of operations that go beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

CVE-2025-13200 SourceCodester Farm Management System exposure of information through directory listing

A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation causes exposure of information through directory listing. The attack is possible to be carried out remotely. The exploit has been publicly...

The vulnerability of the usdGltf plugin in Adobe Format Plugins allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the usdGltf plugin relates to the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created file...

CVE-2025-59780

CVE-2025-59780 affects the General Industrial Controls Lynx+ Gateway. The connected documents confirm a lack of authentication in the device’s embedded web server, enabling an attacker to send GET requests that could reveal sensitive device information. There are multiple sources (NVD/Red Hat/CNN...

CVE-2023-7328

Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values...

CVE-2023-7328

Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values...

CVE-2023-7328

CVE-2023-7328 affects Screen SFT DAB 600/C firmware versions up to and including 1.9.3, due to improper access control on the user management API that permits unauthenticated retrieval of structured user data and connection metadata (e.g., account names, client IP, timeout values). Public referen...

CVE-2022-4984

ZenTao Biz 6.5, ZenTao Max 3.0, ZenTao Open Source Edition 16.5, and ZenTao Open Source Edition 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database...