Quanta QOCA aim AI Medical Cloud Platform SQL注入漏洞

Quanta QOCA aim AI Medical Cloud Platform is an artificial intelligence AI medical cloud computing integration platform from Quanta Taiwan, China that provides comprehensive AI model development tools covering the entire process from AI development to clinical applications. The Quanta QOCA aim AI...

CVE-2025-62857

A cross-site scripting XSS vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuMagie 2.8.1 and later...

CVE-2025-62857 QuMagie

A cross-site scripting XSS vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuMagie 2.8.1 and later...

PT-2026-3728

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 and 7.2.4 Description An easily exploitable issue exists in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. A high-privileged attacker with access to the system where Oracle VM...

The vulnerability of the Mattermost GitHub plugin for instant messaging applications arises from insufficient validation of certain input types. This allows attackers to bypass security restrictions and gain access to read and modify data.

The vulnerability of the Mattermost GitHub plugin for a real-time messaging application relates to insufficient validation of the input data type. Exploiting this vulnerability can allow an attacker to bypass security restrictions and gain access to read and modify data...

The vulnerability of the Financials General Ledger component of the SAP S/4HANA software platform allows a hacker to gain access to read and modify data.

The vulnerability of the Financials General Ledger component of the SAP S/4HANA software platform is related to uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to read and modify data...

EUVD-2025-204333

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling...

CVE-2019-25229

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling...

CVE-2019-25229

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling...

CVE-2019-25229

CVE-2019-25229 concerns Kentico Xperience MVC Forms Unrestricted File Upload. Multiple connected sources describe an issue where authenticated users with only the 'Read data' permission can upload arbitrary file types through the MVC form file uploader components, by manipulating file names, enab...

CVE-2019-25229 Kentico Xperience <= 12.0.29 MVC Forms Unrestricted File Upload

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling...

PT-2025-52295

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling...

CVE-2019-25229: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling...

PT-2025-51347

Name of the Vulnerable Software and Affected Versions YAOOK Operator affected versions not specified Description An incorrect configuration of replication security within the MariaDB component of the infra-operator in YAOOK Operator could allow an on-path attacker to read database contents, which...

EUVD-2025-203403

EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been...

CVE-2025-42876

Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud Financials General Ledger, an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could...

CVE-2025-42876

CVE-2025-42876 concerns a Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger). An authenticated user limited to one company code could read data and post/modify documents across all company codes. Impact: confidentiality high, integrity low; availability unchange...

CVE-2025-42876 Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)

Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud Financials General Ledger, an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could...

CVE-2025-14255

Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents...

CVE-2025-14255 Galaxy Software Services｜Vitals ESP - SQL Injection

Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents...