EUVD-2025-36425

A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/autopost/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDi...

CVE-2025-12346 MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload

A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/autopost/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDi...

CVE-2025-12337 Campcodes Retro Basketball Shoes Online Store admin_feature.php sql injection

A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/adminfeature.php. Performing a manipulation of the argument pid results in sql injection. The attack may be initiated remotely. The exploit has been released t...

Yonyou U8 Cloud 代码问题漏洞

Yonyou U8 Cloud is a cloud-based enterprise management system from China's UFIDA Yonyou Corporation. A code issue vulnerability exists in Yonyou U8 Cloud 5.1sp and earlier versions, which stems from incorrect manipulation of the parameter ts/sign in the file/service/NCloudGatewayServlet, which...

PT-2025-44083

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 110 Description A flaw exists in MaxSite CMS that allows for unrestricted file uploads. This issue is related to the processing of the file path and content arguments within the file...

The vulnerability of the tee_shm_put() function in the Linux operating system, which allows a hacker to cause a service failure

The vulnerability of the teeshmput function in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

PT-2025-44199

Name of the Vulnerable Software and Affected Versions BLU-IC2 versions through 1.19.5 BLU-IC4 versions through 1.19.5 Description A flaw exists where protocol manipulation could result in a denial of service. Recommendations BLU-IC2 versions through 1.19.5: At the moment, there is no information...

The vulnerability of the smc_ib_is_sg_need_sync() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the smcibissgneedsync function in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2025-44084

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak where the /admin path can be accessed via a proxy, such as ha-proxy, by using relative or non-normalized paths. Keycloak documentation advises against exposing the...

Apache Tomcat Console Manipulation Vulnerability (Oct 2025) - Windows

Apache Tomcat is prone to a console manipulation vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; i...

Apache Tomcat Console Manipulation Vulnerability (Oct 2025) - Linux

Apache Tomcat is prone to a console manipulation vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; i...

The vulnerability of the ProFTPD FTP server, related to errors in the authentication process, allows attackers to manipulate data.

The vulnerability of the ProFTPD FTP server is related to errors in the authentication process. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2025-12330

CVE-2025-12330 affects Willow CMS up to 1.4.0. The vulnerability stems from improper handling of parameters in /admin/articles/add (Add Post Page), where manipulation of title/body leads to cross-site scripting. Exploitation can be remote, and public exploits exist. Impact is limited to the descr...

CVE-2025-12322 Tenda CH22 NatStaticSetting fromNatStaticSetting buffer overflow

A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. Executing a manipulation of the argument page can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published an...

CVE-2025-12315

A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulation of the argument itemPrice can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and ma...

CVE-2025-12314

A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing a manipulation of the argument itemID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made...

CVE-2025-62594 ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow...

CVE-2025-59151

Pi-hole Admin Interface prior to 6.3 is vulnerable to CRLF injection via redirects on requests for files ending with .lp, allowing an attacker to inject arbitrary HTTP response headers and potentially affect session fixation, cache poisoning, and weakening of CSP or X-XSS-Protection. Root cause: ...

CVE-2025-12307

A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfriend.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly...

CVE-2025-12307

A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfriend.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly...