EUVD-2025-32243

Malicious code in bioql PyPI...

EUVD-2024-48584

Malicious code in bioql PyPI...

EUVD-2021-28918

Malicious code in bioql PyPI...

CVE-2025-40636 SQL injection in the mod_vvisit_counter module

SQL injection vulnerability in Joomla module modvvisitcounter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cipvvisitcounter’ cookie at all endpoints where the plugin counts visits...

CVE-2025-52050

In Frappe ERPNext 15.57.5, the function getloyaltyprogramdetailswithpoints at erpnext/accounts/doctype/loyaltyprogram/loyaltyprogram.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expirydate parameter...

Simple Scheduling System addtime.php File SQL Injection Vulnerability

Simple Scheduling System is a simple scheduling system. Simple Scheduling System has a SQL injection vulnerability that originates from the starttime/endtime parameters in the /addtime.php file not being securely filtered. An attacker can exploit this vulnerability to execute malicious SQL comman...

CVE-2025-41715 Missing Authentication for Database Access in Web Application

The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it...

CVE-2025-41715

CVE-2025-41715 describes a missing authentication flaw where the database of a web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise the system. The CVE entry is corroborated across multiple sources (R...

CVE-2025-41715 Missing Authentication for Database Access in Web Application

The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it...

PT-2025-39237

Name of the Vulnerable Software and Affected Versions Web application affected versions not specified Description The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it...

CVE-2025-58156 Centurion ERP users can view hashed authentication tokens that belong to other users

Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed...

CVE-2025-58156

CVE-2025-58156 (Centurion ERP) affects Centurion ERP versions 1.12.0 to before 1.21.0. An authenticated user could view token details in the database, including the actual token in hashed form (no unhashed tokens were viewable). The issue has been patched in version 1.21.0. A workaround that disa...

CVE-2025-58061 OpenEBS Local PV RawFile persistent volume data is world readable

OpenEBS Local PV RawFile allows dynamic deployment of Stateful Persistent Node-Local Volumes & Filesystems for Kubernetes. Prior to version 0.10.0, persistent volume data is world readable and that would allow non-privileged users to access sensitive data such as databases of k8s workload. The...

CVE-2024-13807 Xagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files

The Xagio SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.1.0.5 via the backup functionality due to weak filename structure and lack of protection in the directory. This makes it possible for unauthenticated attackers to extract...

Hospital Management System about-us.php File SQL Injection Vulnerability

Hospital Management System is a PHP and MySQL based hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally-entered SQL statements in the pagetitle parameter of about-us.php. An attacker can exploit thi...

Mahara < 24.04.9 Information Disclosure Vulnerability

Mahara is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if...

CVE-2025-29992

Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy...

CVE-2025-29992

Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy...

CVE-2025-29992

CVE-2025-29992 affects Mahara prior to 24.04.9. When the database becomes unreachable (e.g., temporarily down or overloaded), Mahara may disclose database connection information. The issue is documented across multiple sources (Red Hat, NVD, OpenVAS, CVE lists) with a consistent description: expo...

CVE-2025-57772 Dataease H2 JDBC RCE Bypass

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's...