CVE-2025-68111

ChurchCRM is affected by a SQL injection in the eGive.php file (ReImport) for versions prior to 6.5.3. An authenticated user with finance privileges can manipulate the MissingEgive_FamID_... POST parameter to execute arbitrary SQL, leading to unauthorized data access, modification, or deletion wi...

EUVD-2025-203991

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the src/CartToFamily.php file, specifically in how the PersonAddress POST parameter is handled. Unlike other parameters in the same file which are correctly cast to integers using t...

EUVD-2025-203938

AVideo versions prior to 20.0 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations...

CVE-2025-66396

ChurchCRM exposes a SQL injection in src/UserEditor.php affecting versions prior to 6.5.3. The vulnerability arises when an administrator saves user configuration settings: the code iterates over the POST type parameter array, uses the array key (expected numeric id) directly in SELECT/UPDATE que...

EUVD-2025-203917

ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server...

CVE-2025-14304 ASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism Failure

Certain motherboard models developed by ASRock and its subsidiaries, ASRockRack and ASRockInd. has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory...

CVE-2025-14303

Certain motherboard models developed by MSI has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are...

EUVD-2025-203865

Certain motherboard models developed by GIGABYTE has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security feature...

SUSE CVE-2017-18877

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...

SUSE CVE-2025-68249

In the Linux kernel, the following vulnerability has been resolved: most: usb: hdmprobe: Fix calling putdevice before device initialization The early error path in hdmprobe can jump to errfreemdev before &mdev-dev has been initialized with deviceinitialize. Calling putdevice&mdev-dev there trigge...

Zed 命令注入漏洞

Zed is an open source code editor from Zed Industries. A command injection vulnerability exists in versions prior to Zed 0.218.2-pre that stems from loading a malicious MCP configuration from the settings.json file in the project.zed subdirectory, which could lead to arbitrary code execution...

Bounty Hunter: Autonomous, Comprehensive Emulation of Multi-Faceted Adversaries

Adversary emulation is an essential procedure for cybersecurity assessments such as evaluating an organization's security posture or facilitating structured training and research in dedicated environments. To allow for systematic and time-efficient assessments, several approaches from academia an...

AVideo 输入验证错误漏洞

AVideo is an open source broadcast network creation tool from World Wide Broadcast Network. An input validation error vulnerability exists in AVideo versions prior to 20.0 that stems from a lack of validation of the cancelUri parameter during user login, which could lead to open redirection and...

Linux Distros Unpatched Vulnerability : CVE-2025-68249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - most: usb: hdmprobe: Fix calling putdevice before device initialization The early error path in hdmprobe can jump to errfreemdev before &mdev-dev has been...

MSI Motherboards 安全漏洞

MSI Motherboards are a line of motherboards from Taiwan, China-based Micro-Star MSI. A security vulnerability exists in MSI Motherboards that stems from not properly enabling the IOMMU, which could allow an unauthenticated physical attacker to read or write arbitrary physical memory before the...

ChurchCRM SQL注入漏洞

ChurchCRM is an open source church management system. ChurchCRM suffers from a SQL injection vulnerability that originates from the unvalidated familyId parameter in legacy endpoints/Reports/ConfirmReportEmail.php, and no details of the vulnerability are provided at this time...

ChurchCRM 安全漏洞

ChurchCRM is an open source church management system. ChurchCRM suffers from an information disclosure vulnerability that originates from the disclosure of database information in an error message, which can be exploited by an attacker to cause the disclosure of database information, including...

SLiMS 安全漏洞

SLiMS Senayan Library Management System is a free library management system from SLiMS open source. A security vulnerability exists in SLiMS versions prior to 9.6.0, which stems from improper handling of $SERVERPHPSELF in index.php/sysconfig.inc.php, which could lead to a reflected cross-site...

Linux Distros Unpatched Vulnerability : CVE-2025-68142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption...

UBUNTU-CVE-2025-68146

filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use TOCTOU race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulnerability exists in both Unix and Windows lock file creation...