SourceCodester Online Student Clearance System 授权问题漏洞

SourceCodester Online Student Clearance System is a SourceCodester open source online student management system. An authorization issue vulnerability exists in version 1.0 of the SourceCodester Online Student Clearance System, which stems from incorrect manipulation of the parameter ID in the fil...

The vulnerability of the `create_sdw_dailink()` function in the `sound/soc/intel/boards/sof_sdw.c` file of the processor support subsystem on the SoC, as well as portable audio decoders in the Linux operating system’s kernel, allows a hacker to cause a service failure.

The vulnerability of the createsdwdailink function in the sound/soc/intel/boards/sofsdw.c file, a part of the SoC support subsystem and used for portable audio decoders in the Linux operating system’s kernel, is related to pointer manipulation. Exploiting this vulnerability could allow an attacke...

The vulnerability of the vmap_udmabuf() function in the drivers/dma-buf/udmabuf.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the vmapudmabuf function in the drivers/dma-buf/udmabuf.c module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-14204

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

CVE-2025-14195 code-projects Employee Profile Management System add_file_query.php unrestricted upload

A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/addfilequery.php. The manipulation of the argument perfile results in unrestricted upload. The attack may be launched remotely. The exploit has been...

EUVD-2025-201598

A security vulnerability has been detected in UGREEN DH2100+ up to 5.3.0.251125. This impacts the function handlerfilebackupcreate of the file /v1/file/backup/create of the component nassvr. The manipulation of the argument path leads to command injection. The attack is possible to be carried out...

CVE-2025-14188

A security vulnerability has been detected in UGREEN DH2100+ up to 5.3.0.251125. This impacts the function handlerfilebackupcreate of the file /v1/file/backup/create of the component nassvr. The manipulation of the argument path leads to command injection. The attack is possible to be carried out...

CVE-2025-14188

CVE-2025-14188 affects UGREEN DH2100+ (nas_svr) up to version 5.3.0.251125. The vulnerability is in the function handler_file_backup_create at /v1/file/backup/create, where manipulation of the path argument enables remote command injection. Multiple connected sources confirm the issue and state t...

EUVD-2025-201596

A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handlerfilebackupcreate of the file /v1/file/backup/create of the component nassvr. Executing manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The...

CVE-2025-14187 UGREEN DH2100+ nas_svr create handler_file_backup_create buffer overflow

A weakness has been identified in UGREEN DH2100+ up to 5.3.0.251125. This affects the function handlerfilebackupcreate of the file /v1/file/backup/create of the component nassvr. Executing a manipulation of the argument path can lead to buffer overflow. The attack can be executed remotely. The...

CVE-2025-14187

Summary of CVE-2025-14187 (UGREEN DH2100+) Affects the nas_svr component of UGREEN DH2100+ up to 5.3.0.251125. The vulnerability resides in the function handler_file_backup_create for the API endpoint /v1/file/backup/create where manipulation of the path argument can cause a remote buffer overflo...

PT-2025-49417

A flaw has been found in code-projects Question Paper Generator up to 1.0. This vulnerability affects unknown code of the file /selectquestionuser.php. This manipulation of the argument subid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and m...

H3C Magic B1 安全漏洞

H3C Magic B1 is a wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic B1 100R004 and prior versions, which stems from incorrect manipulation of the parameter param in the file /goform/aspForm, which could result in a buffer overflow...

PT-2025-49397

A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the component Network Status Page. Performing manipulation of the argument vpn ip results in basic cross site scripting. Remote exploitation of t...

CVE-2025-14106

A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safedir leads to command injection. The attack is possible to be carried o...

Exploit for Unprotected Alternate Channel in Crushftp

CrushFTP AS2 Authentication Bypass Research !CVSS Scoreht...

BEACON: A Unified Behavioral-Tactical Framework for Explainable Cybercrime Analysis with Large Language Models

Cybercrime increasingly exploits human cognitive biases in addition to technical vulnerabilities, yet most existing analytical frameworks focus primarily on operational aspects and overlook psychological manipulation. This paper proposes BEACON, a unified dual-dimension framework that integrates...

CVE-2025-14116 xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery

A vulnerability was detected in xerrors Yuxi-Know up to 0.4.0. This vulnerability affects the function OtherEmbedding.aencode of the file /src/models/embed.py. Performing manipulation of the argument healthurl results in server-side request forgery. The attack can be initiated remotely. The explo...

CVE-2025-14108

A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safedir causes command injection. It is possible to initiate...

CVE-2025-14108

ZSPACE Q2C NAS 1.1.0210050) or apply vendor-provided fixes; restricting access to the affected API endpoint is a suggested workaround where feasible. If implementing, verify affected versions and monitor for vendor advisories.