CVE-2025-13828

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges...

CVE-2025-13828

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges...

CVE-2025-13828 Mautic user without privileged access to the Marketplace can install and uninstall composer packages

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges...

CVE-2025-13828

Mautic platform; a flaw in the composer-based update/Marketplace flow allows a non-privileged user to install and remove arbitrary composer packages despite the enable-composer-based-update flag. Root cause: improper privilege management in the Marketplace integration enabling privilege escalatio...

CVE-2025-12465 Blind SQL Injection in QuickCMS

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of...

CVE-2025-12465 Blind SQL Injection in QuickCMS

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of...

EUVD-2025-200223

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of...

CVE-2025-58482

Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service...

CVE-2025-58475

Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory...

CVE-2025-58481

Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service...

CVE-2025-58475

Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory...

EUVD-2025-200136

Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service...

CVE-2025-58481

CVE-2025-58481 affects Samsung MotionPhoto/Motion Photo feature with MPRemoteService prior to v4.1.51. The vulnerability arises from improper access control in MPRemoteService, allowing a local attacker with low privileges to start a privileged service. The CVE is documented across multiple feeds...

EUVD-2025-200137

Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service...

CVE-2025-58475

The CVE-2025-58475 entry concerns improper input validation in libsec-ril.so prior to Samsung SMR Dec-2025 Release 1, which allows a local privileged attacker to write out-of-bounds memory. Affected component: libsec-ril.so (pre-December 2025 patch level). Root cause: input validation flaw leadin...

CVE-2025-58475

Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory...

EUVD-2025-200145

Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory...

CVE-2025-21072

CVE-2025-21072 is an out-of-bounds write vulnerability in the fingerprint trustlet metadata decoding on Samsung mobile devices, enabling a local privileged attacker to write memory outside allocated boundaries. Affected component: fingerprint trustlet. Root cause: improper handling during metadat...

CVE-2025-65622

Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session...

Entrust nShield Connect XC 安全漏洞

Entrust nShield Connect XC is a network-connected hardware security module from Entrust USA. A security vulnerability exists in Entrust nShield Connect XC that originates from a physical neighbor attacker with elevated privileges can read and write the contents of an unencrypted Appliance SSD...