CVE-2025-15421

A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agentworksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now publ...

CVE-2025-15420

CVE-2025-15420 affects Yonyou KSOA 9.0. The vulnerability is in the file "/worksheet/agent_work_report.jsp" where manipulating the parameter ID leads to SQL injection. This can be exploited remotely, with the exploit publicly disclosed. Multiple sources (NVD, Red Hat, CVE lists) corroborate the i...

CVE-2025-15420 Yonyou KSOA agent_work_report.jsp sql injection

A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agentworkreport.jsp. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The...

EUVD-2025-206134

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing manipulation of the argument uri can lead to server-side request forgery. The attack may be launched remotely...

PT-2026-1132

Name of the Vulnerable Software and Affected Versions MessagePack for Java versions prior to 0.9.11 Description A denial-of-service issue exists in MessagePack for Java when processing .msgpack files. Specifically, versions before 0.9.11 are susceptible to unbounded heap allocation when...

PT-2026-1112

Name of the Vulnerable Software and Affected Versions code-projects Content Management System version 1.0 Description A flaw exists in code-projects Content Management System that allows for SQL injection. The issue is located in the /pages.php file, specifically through manipulation of the ID...

PT-2026-1054

Name of the Vulnerable Software and Affected Versions yeqifu carRental affected versions not specified Description A path traversal issue exists due to the manipulation of the path argument within the downloadShowFile function located in /file/downloadShowFile.action of the...

PT-2026-1043

Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description A SQL injection issue exists in Yonyou KSOA 9.0 due to manipulation of the ID argument within the HTTP GET parameter handler of the /worksheet/agent worksdel.jsp file. Remote exploitation is possible. The...

PT-2026-1039

Name of the Vulnerable Software and Affected Versions EmpireSoft EmpireCMS versions up to 8.0 Description A security issue exists in EmpireSoft EmpireCMS related to the IP Address Handler component. The issue resides in the egetip function within the e/class/connect.php file. This flaw results in...

PT-2026-1126

Name of the Vulnerable Software and Affected Versions yeqifu warehouse affected versions not specified Description A security flaw exists in yeqifu warehouse due to path traversal. The issue is related to the manipulation of the path argument within the createResponseEntity function located in th...

PT-2026-1042

Name of the Vulnerable Software and Affected Versions EmpireSoft EmpireCMS versions prior to 8.0 Description A flaw exists in EmpireSoft EmpireCMS that allows for unrestricted file uploads. This issue is located in the CheckSaveTranFiletype function within the e/class/connect.php file. Successful...

CVE-2025-15416

A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add Global Variable Handler. The manipulation of the argument Remark/Variable Value results in cross site scripting. The attack can be executed remotely. The...

CVE-2025-15398

A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack...

CVE-2025-15415

The CVE concerns xnx3 wangmarket (up to 6.4) in the XML File Handler, specifically the uploadImage function at /sits/uploadImage.do. The issue arises from manipulating the image parameter, enabling unrestricted file uploads and remote exploitation. Public exploitation has been disclosed; vendor d...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the opSetSloti32 function of m3exec.h. An attacker can cause memory corruption by manipulating the execution flow locally. Remediation There is no fixed version for pywasm3. References - GitHub Issue - GitHub Issu...

CVE-2025-15411

A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /src/repro/wabt/bin/wasm-decompile of the component wasm-decompile. This manipulation causes memory corruption. It is possible to launch the attack on the loc...

Bug-Bounty-and-Learning-Space

Bug Bounty & Learning Space A markdown backup of my personal...

CVE-2025-66150

Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appender: from n/a through = 1.1.1...

CVE-2025-15409

CVE-2025-15409 affects code-projects Online Guitar Store 1.0. The vulnerability is an SQL injection in /admin/Delete_product.php via manipulation of the del_pro parameter, exploitable remotely. Public disclosures exist. Impact includes potential disclosure/integrity/availability harm as per CVSS ...

EUVD-2026-0007

A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/Deleteproduct.php. Executing manipulation of the argument delpro can lead to sql injection. The attack may be performed from remote. The exploit h...