EUVD-2025-16544

Malicious code in bioql PyPI...

Unity Runtime 参数注入漏洞

Unity Runtime is an underlying system responsible for executing logic, rendering, physics and interaction from Unity, Inc. in the United States. A parameter injection vulnerability exists in versions of Unity Runtime prior to 2025-10-02, which stems from a parameter injection that could lead to t...

CVE-2025-11113

A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the argument city results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Other parameters...

go-mail 参数注入漏洞

go-mail is a Golang library with mail sending functionality by the individual developer Winni Neessen. A parameter injection vulnerability exists in go-mail version 0.7.0 and earlier, which stems from mishandling of the mail.Address value, which can lead to incorrect address routing or ESMTP...

CVE-2025-11114 CodeAstro Online Leave Application leaveAplicationForm.php sql injection

A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.php. Executing manipulation of the argument absence can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2025-11076

A vulnerability was found in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/editteacher.php. Performing manipulation of the argument department results in sql injection. Remote exploitation of the attack is possible. The exploit has been made...

CVE-2025-3193

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the merge function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is...

CVE-2025-55848

An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the setcassword settings interface, as the httpcasswd parameter is not filtered by '&'to allow injection of reverse connection commands...

CVE-2025-9353

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-10808

A weakness has been identified in Campcodes Farm Management System 1.0. Impacted is an unknown function of the file /uploadProduct.php. This manipulation of the argument Type causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and...

CVE-2025-0875

Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS Student Affairs Information System allows Parameter Injection.This issue affects OBS Student Affairs Information System: before v26.0328...

CVE-2025-43779

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via...

CVE-2025-0875

Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS Student Affairs Information System allows Parameter Injection. This issue affects OBS Student Affairs Information System: before v26.0328...

CVE-2025-0875 IDOR in Proliz Software's OBS

Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS Student Affairs Information System allows Parameter Injection. This issue affects OBS Student Affairs Information System: before v26.0328...

CVE-2025-0875

Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS Student Affairs Information System allows Parameter Injection. This issue affects OBS Student Affairs Information System: before v26.0328...

CVE-2025-0875

Summary: CVE-2025-0875 affects PROLIZ OBS (Student Affairs Information System) prior to version 26.0328. The issue is an authorization bypass caused by a user-controlled key, enabling parameter injection. The vulnerability impact includes a potential bypass of access controls with high privileges...

CVE-2025-0875 IDOR in Proliz Software's OBS

Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS Student Affairs Information System allows Parameter Injection. This issue affects OBS Student Affairs Information System: before v26.0328...

PROLIZ OBS 安全漏洞

PROLIZ OBS is a student information system from PROLIZ Turkey. A security vulnerability exists in PROLIZ OBS versions prior to 26.0328, which stems from a user-controllable key leading to an authorization bypass that could lead to parameter injection...

PT-2025-38682

Name of the Vulnerable Software and Affected Versions: CodeAstro Simple Pharmacy Management version 1.0 Description: A SQL injection issue exists due to the manipulation of the bar code argument in the /view.php file. Remote exploitation is possible. The exploit has been publicly disclosed...

PT-2025-38697

Name of the Vulnerable Software and Affected Versions PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS Student Affairs Information System versions prior to v26.0328 Description An authorization bypass exists due to a user-controlled key issue in OBS Student Affairs Information System...