PT-2025-53631

Name of the Vulnerable Software and Affected Versions OpenCart versions prior to 4.1.0.4 Description A security issue exists in OpenCart related to the Single-Use Coupon Handler component. Manipulation of this component can lead to a race condition. The issue can be exploited remotely and is...

PT-2025-53671

Name of the Vulnerable Software and Affected Versions floooh sokol affected versions not specified Description A flaw exists in the sg pipeline desc defaults function within the sokol gfx.h library. This issue leads to a stack-based buffer overflow and requires local access for exploitation. The...

EUVD-2025-205482

A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/ProductImageController.class.php of the component Backend. Such manipulation of the argument File leads to unrestricted upload. It is...

CVE-2025-15106

A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploi...

CVE-2025-15106

The CVE-2025-15106 vulnerability affects the getmaxun project’s Authentication Endpoint, specifically the router.get in file server/src/routes/auth.ts. The underlying issue is improper authorization caused by manipulation of router.get, with remote exploit potential and a publicly available explo...

CVE-2025-15097

A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used...

CVE-2025-15095

A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used...

CVE-2025-15094

A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing a manipulation of the argument redirectUrl ca...

CVE-2025-15092

A vulnerability was identified in UTT 进取 512W up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/ConfigExceptMSN. Such manipulation of the argument remark leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be us...

PT-2025-53618

Name of the Vulnerable Software and Affected Versions getmaxun versions prior to 0.0.28 Description A weakness exists in the Authentication Endpoint component of getmaxun. Specifically, the router.get function within the server/src/routes/auth.ts file is susceptible to improper authorization due ...

PT-2025-53626

Name of the Vulnerable Software and Affected Versions jackq XCMS versions prior to 3fab5342cc509945a7ce1b8ec39d19f701b89261 Description A flaw exists in jackq XCMS that allows for unrestricted file upload. The issue is located in the Upload function within the...

PT-2025-53628

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-800MB version 1.0.1.0 Description A command injection issue exists in the TRENDnet TEW-800MB. The issue is located in the NTPSyncWithHost.cgi file, specifically within the sub F934 function. Successful exploitation allows for remo...

PT-2025-53627

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-800MB version 1.0.1.0 Description A security issue has been identified in TRENDnet TEW-800MB version 1.0.1.0. The issue resides in the Management Interface component, specifically within the do setWizard asp function located in th...

CVE-2025-15086

A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access controls. The attack may be initiated...

CVE-2025-15084

A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to...

CVE-2025-15082

A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/procpost of the component Web Management Interface. Performing manipulation of the argument goformId results in information disclosure. It is possible to initiate the attack remotely. The...

CVE-2025-15078

A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /listreport.php. The manipulation of the argument sy results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

CVE-2025-15076

A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks...

CVE-2025-15099 simstudioai sim CRON Secret internal.ts improper authentication

A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the component CRON Secret Handler. The manipulation of the argument INTERNALAPISECRET leads to improper authentication. It is possible to initiate t...

CVE-2025-15074

A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customerdetails.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be...