CVE-2025-12235

CVE-2025-12235 affects Tenda CH22 v1.0.0.1. The fromSetIpBind function in /goform/SetIpBind is vulnerable to a buffer overflow when the page argument is manipulated, requiring local-network access to exploit. Public exploits exist. Impact cited includes arbitrary code execution and DoS. Remediati...

CVE-2025-12226 SourceCodester Best House Rental Management System admin_class.php save_house sql injection

A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function savehouse of the file /adminclass.php. Performing manipulation of the argument houseno results in sql injection. Remote exploitation of the attack is possible. The exploit has been made...

CVE-2025-12208

SourceCodester Best House Rental Management System 1.0 is affected by a SQL injection in the login2 function of /admin_class.php, caused by improper handling of the Username argument. The vulnerability allows remote exploitation, and public proof-of-concept exploits exist. Red Hat/EUVD/NVD refere...

CVE-2025-12199

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Based on the analysis by MITRE and review of community feedback, the reported conditions represent...

EUVD-2025-36060

A vulnerability was found in dnsmasq up to 2.73rc6. Affected by this vulnerability is the function checkservers of the file src/network.c of the component Config File Handler. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been mad...

CVE-2025-12199

DNSmasq vulnerability CVE-2025-12199 (connected sources: SUSE/Red Hat/OSV/Ubuntu etc.) indicates a null pointer dereference in the Config File Handler, specifically in the check_servers function within src/network.c. Affected versions are reported as up to 2.73rc6. The issue is described as local...

PT-2025-43909

Name of the Vulnerable Software and Affected Versions OpenWGA version 7.11.12 Build 737 Description A security issue exists in OpenWGA that allows for cross site scripting. The issue impacts an unknown function within the Admin UI component and can be initiated remotely. The exploit for this issu...

PT-2025-43892

Name of the Vulnerable Software and Affected Versions Tenda CH22 version 1.0.0.1 Description A flaw exists in the fromDhcpListClient function within the /goform/DhcpListClient file. Manipulation of the page argument can lead to a buffer overflow. Remote exploitation is possible, and the exploit h...

PT-2025-43897

Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description A flaw exists in TOTOLINK A3300R that allows for remote attacks. The issue is a stack-based buffer overflow within the setLanguageCfg function located in the /cgi-bin/cstecgi.cgi file,...

PT-2025-43945

Name of the Vulnerable Software and Affected Versions LearnHouse affected versions not specified Description A flaw exists in LearnHouse related to the Image Handler component, leading to information disclosure. This issue can be exploited remotely. The exploit is publicly available. The vendor w...

PT-2025-43937

Name of the Vulnerable Software and Affected Versions LearnHouse versions prior to 98dfad76aad70711a8113f6c1fdabfccf10509ca Description A cross site scripting issue exists in LearnHouse. The issue is located in the Account Setting Page component, specifically within the file...

PT-2025-43963

Name of the Vulnerable Software and Affected Versions Bdtask Pharmacy Management System versions prior to 9.4 Description A flaw exists in Bdtask Pharmacy Management System that allows for authorization bypass. This occurs through manipulation of an unknown function within the /user/edit user/ fi...

PT-2025-43893

Name of the Vulnerable Software and Affected Versions projectworlds Advanced Library Management System version 1.0 Description A flaw exists in projectworlds Advanced Library Management System that allows for remote code execution through SQL injection. Manipulation of the keywords argument withi...

PT-2025-43952

Name of the Vulnerable Software and Affected Versions code-projects Client Details System version 1.0 Description A security issue exists in code-projects Client Details System 1.0 related to the processing of the /update-clients.php file. Manipulation of this file can lead to cross site scriptin...

CVE-2025-11938

A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DBPASSWORD/ROOTPATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as...

CVE-2025-11946

A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site...

EUVD-2025-34936

A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. The manipulation of the argument sortField results in sql injection. It is possible to launch the attack remotely. The exploit is now publi...

EUVD-2025-33912

A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local position. The attack is considered to have hig...

CVE-2025-11645

A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical...

CVE-2025-11592

A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used...