CVE-2025-3942

CVE-2025-3942 affects Tridium Niagara Framework and Tridium Niagara Enterprise Security on Windows, Linux, and QNX, due to Improper Output Neutralization for Logs that enables Input Data Manipulation. Affected versions are Niagara Framework before 4.14.2, before 4.15.1, and before 4.10.11; Niagar...

CVE-2019-17080

mintinstall aka Software Manager 7.9.9 for Linux Mint allows code execution if a REVIEWSCACHE file is controlled by an attacker, because an unpickle occurs. This is resolved in 8.0.0 and backports...

The vulnerability of the virtual learning environment Moodle, related to the manipulation of cross-site requests, allows a violator to influence the integrity of the protected information.

The vulnerability in the virtual learning environment Moodle is related to the manipulation of cross-site requests. Exploiting this vulnerability could allow a malicious actor to influence the integrity of the protected information...

CVE-2025-46400

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via readarcobject function...

CVE-2025-2572

In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup...

CVE-2025-2572

CVE-2025-2572 affects Progress WhatsUp Gold before 2024.0.3. A database manipulation vulnerability allows an unauthenticated attacker to modify WhatsUp.dbo.WrlsMacAddressGroup. Impact is integrity loss of that table; no explicit exploit details provided in the documents. Remediation: upgrade to v...

CVE-2025-29922

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By...

CVE-2025-2606

CVE-2025-2606 affects SourceCodester Best Church Management Software 1.0. The vulnerability arises from improper handling of the photo/photo1 parameter in /admin/app/soulwinning_crud.php, enabling unrestricted file upload. It is possible to trigger remotely, and the exploit has been disclosed pub...

The vulnerability of the is_dsc_need_re_compute() function in the drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c file of the driver support infrastructure for AMD graphics cards in Linux operating systems allows a attacker to cause a service failure.

The vulnerability of the isdscneedrecompute function in the drivers/gpu/drm/amd/display/amdgpudm/amdgpudmmsttypes.c file of the DRI support driver for AMD graphics cards in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a...

CVE-2025-30152 Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout

The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered vulnerability allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. If a user initiates a PayPal...

CVE-2025-30152 Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout

The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. Prior to 1.6.2, 1.7.2, and 2.0.2, a discovered vulnerability allows users to modify their shopping cart after completing the PayPal Checkout process and payment authorization. If a user initiates a PayPal...

Sylius PayPal Plugin Payment Amount Manipulation Vulnerability

A vulnerability allows users to manipulate the final payment amount processed by PayPal. If a user modifies the item quantity in their shopping cart after initiating the PayPal Checkout process, PayPal will not receive the updated total amount. As a result, PayPal captures only the initially...

The vulnerability of the Adobe Substance 3D Modeler software-related to pointer manipulation allows a hacker to trigger a service failure.

The vulnerability of the Adobe Substance 3D Modeler software for 3D modeling is related to pointer manipulation. Exploiting this vulnerability can allow an attacker to cause a system failure...

File Manipulation

drupal/core is vulnerable to File Manipulation. The vulnerability is due to insufficient validation and sanitization of user-provided file paths, which can lead to unauthorized file access or manipulation...

CVE-2024-11489 115cms file.html cross site scripting

A vulnerability was found in 115cms up to 20240807. It has been classified as problematic. Affected is an unknown function of the file /index.php/admin/web/file.html. The manipulation of the argument ks leads to cross site scripting. It is possible to launch the attack remotely. The exploit has...

CVE-2024-51997

Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART Attestation Results Token token, generated by AS, could be manipulated by MITM attacker, but the verifier CoCo Verification Demander like KBS could still verify it successfully. In th...

CVE-2024-10414 PHPGurukul Vehicle Record System edit-brand.php cross site scripting

A vulnerability, which was classified as problematic, was found in PHPGurukul Vehicle Record System 1.0. This affects an unknown part of the file /admin/edit-brand.php. The manipulation of the argument Brand Name leads to cross site scripting. It is possible to initiate the attack remotely. The...

CVE-2024-45806 Potential manipulate `x-envoy` headers from external sources in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration ...

The vulnerability of the LoadMaster application deployment and management platform, related to the manipulation of cross-site requests, allows a hacker to perform a CSRF attack.

The vulnerability of the LoadMaster application deployment and management platform relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using specially crafted HTTP requests...

The vulnerability of the software environment of Siemens Tecnomatix Plant Simulation, related to the manipulation of the zero indicator, allows a perpetrator to trigger a service failure.

The vulnerability of the software environment of Siemens Tecnomatix Plant Simulation relates to the manipulation of the zero indicator. Exploiting this vulnerability can allow attackers to trigger a maintenance failure using specially created SPP files...