CVE-2025-40061

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race in dotask when draining When dotask exhausts its iteration budget !ret, it sets the state to TASKSTATEIDLE to reschedule, without a secondary check on the current task-state. This can overwrite the...

CVE-2025-60800

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

CVE-2025-40035 Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak

In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinputffuploadcompat to avoid info leak Struct ffeffectcompat is embedded twice inside uinputffuploadcompat, contains internal padding. In particular, there is a hole after struct ffreplay to satis...

CVE-2025-40035

CVE-2025-40035 (Linux kernel) affects the input subsystem (uinput). The vulnerability arises from how struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, creating a padding hole after ff_replay. If the structure is not cleared before copy_to_user, stack data may be leaked to...

CVE-2025-62968

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Stored XSS.This issue affects WP Last Modified Info: from n/a through = 1.9.2...

CVE-2025-12202

A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been...

CVE-2025-60800

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

jshERP 安全漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of Ji Sheng Hua in China. A security vulnerability exists in jshERP 90c411a and earlier versions, which originates from improper access control of the /jshERP-boot/user/info interface, and may result in the disclosure of...

PT-2025-44195

Name of the Vulnerable Software and Affected Versions jshERP versions prior to commit 90c411a Description An access control issue exists in the /jshERP-boot/user/info interface of jshERP. An attacker can obtain sensitive information by sending a specially crafted GET request to this interface. Th...

The vulnerability of the SetValue() and GetValue() functions in the Tenda O3 wireless access point software allows a intruder to cause a service failure.

The vulnerability of the SetValue and GetValue functions in the Tenda O3 wireless access point software lies in the fact that the operation exceeds the buffer boundaries in memory when processing the dmzIP parameter at the setDmzInfo endpoint. Exploiting this vulnerability could allow an attacker...

CVE-2025-60800

The jshERP (Huaxia ERP) system is vulnerable to an improper access control flaw in the /jshERP-boot/user/info interface in versions up to commit 90c411a . Attackers can exploit this by sending a crafted GET request to obtain sensitive information from the API endpoint. To remediate this vulnerabi...

Linux Distros Unpatched Vulnerability : CVE-2025-40035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: uinput - zero-initialize uinputffuploadcompat to avoid info leak Struct ffeffectcompat is embedded twice inside uinputffuploadcompat, contains internal...

CVE-2025-60800: Improper Access Control

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

CVE-2025-40035: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinputffuploadcompat to avoid info leak Struct ffeffectcompat is embedded twice inside uinputffuploadcompat, contains internal padding. In particular, there is a hole after struct ffreplay to satis...

Vulnerability of the HTTP Meta Info fields, Footer Copyright, and Footer Version fields in the administration interface for creating collaborative web applications – XWiki Platform. This allows attackers to perform cross-site scripting attacks (XSS).

The vulnerabilities of the HTTP Meta Info, Footer Copyright, and Footer Version fields in the administration interface for the XWiki Platform’s collaborative web applications are related to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities could allow...

CVE-2025-12313

A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /mspinfo.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public an...

CVE-2025-12313

The CVE concerns D-Link DI-7001 MINI devices with firmware versions 19.09.19A1 and 24.04.18B1. The vulnerability is a command injection in the /msp_info.htm file, caused by improper handling of the cmd parameter in an unknown function. It is described as exploitable remotely and publicly disclose...

CVE-2025-12313 D-Link DI-7001 MINI msp_info.htm command injection

A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /mspinfo.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public an...

UBUNTU-CVE-2025-61099

FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaqueinfodetail function at ospfopaque.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted LS Update packet...

kernel: mm: swap: fix potential buffer overflow in setup_clusters()

A flaw was found in the Linux kernel's memory management mm swap component. A local attacker with low privileges could exploit a buffer overflow vulnerability in the setupclusters function. This issue arises from insufficient validation of page ranges, which could allow an attacker to write data...