CVE-2025-10275 YunaiV yudao-cloud transfer improper authorization

A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. Executing manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The attack may be launched remotely. The exploit has been made availab...

PT-2025-37339

Name of the Vulnerable Software and Affected Versions: Wavlink WL-WN578W2 version 221110 Description: A flaw has been found in Wavlink WL-WN578W2 221110. Exploitation of a manipulation vulnerability in the /live online.shtml file’s unknown function can lead to information disclosure. The attack c...

CVE-2025-9828

A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitabili...

CVE-2025-9799

CVE-2025-9799 affects Langfuse up to version 3.88.0. The vulnerability is in the Webhook Handler’s WebSocket/HTTP code path, specifically the function promptChangeEventSourcing in web/src/features/prompts/server/routers/promptRouter.ts. Manipulation of this function can lead to server-side reques...

CVE-2025-9736 O2OA Personal Profile statement cross site scripting

A security vulnerability has been detected in O2OA up to 10.0-410. This impacts an unknown function of the file /xqueryassembledesigner/jaxrs/statement of the component Personal Profile Page. Such manipulation of the argument description/queryName leads to cross site scripting. The attack may be...

CVE-2025-9619

A security flaw has been discovered in E4 Sistemas Mercatus ERP 2.00.019. The affected element is an unknown function of the file /basico/webservice/imprimir-danfe/id/. Performing manipulation results in improper control of resource identifiers. It is possible to initiate the attack remotely. The...

CVE-2025-9619

A security flaw has been discovered in E4 Sistemas Mercatus ERP 2.00.019. The affected element is an unknown function of the file /basico/webservice/imprimir-danfe/id/. Performing manipulation results in improper control of resource identifiers. It is possible to initiate the attack remotely. The...

CVE-2025-9419

A vulnerability was detected in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /unit/addunit.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be...

CVE-2025-9146

A flaw has been found in Linksys E5600 1.1.0.26. The affected element is the function verifygemtekheader of the file checkFw.sh of the component Firmware Handler. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. The attack requires a high leve...

CVE-2025-9108 Portabilis i-Diario Login Page ui layer

Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the attack remotely...

CVE-2025-8980

A vulnerability has been found in Tenda G1 16.01.7.83660. Affected by this issue is the function checkuploadfile of the component Firmware Update Handler. The manipulation leads to insufficient verification of data authenticity. The attack may be launched remotely. The complexity of an attack is...

Resource Injection

Overview Affected versions of this package are vulnerable to Resource Injection via the projectID argument. An attacker can gain unauthorized access to information by manipulating resource identifiers remotely. Remediation There is no fixed version for...

CVE-2025-7096

A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cisupdatex64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be...

CVE-2025-6352

A vulnerability classified as problematic has been found in code-projects Automated Voting System 1.0. Affected is an unknown function of the file /vote.php of the component Backend. The manipulation leads to direct request. It is possible to launch the attack remotely. The exploit has been...

PT-2025-24050

Name of the Vulnerable Software and Affected Versions code-projects Traffic Offense Reporting System version 1.0 Description A problematic issue was found in the system, affecting an unknown part, and leading to cross-site request forgery. The manipulation can be initiated remotely. Recommendatio...

CVE-2023-33468

KramerAV VIA Connect 2 and VIA Go 2 devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical scree...

CVE-2023-1682

A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui/My/Config/Install.txt. The manipulation leads to direct request. The attack can be launched remotely. The exploit has been disclosed to t...

Netgear DGND3700 Information Disclosure Vulnerability

The Netgear DGND3700 is an integrated, multi-functional wireless router for home and small office environments. An information disclosure vulnerability exists in the Netgear DGND3700. The vulnerability originates from unknown code in the minihttp component file /currentsetting.htm. An attacker ca...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE lies in the lack of authentication mechanisms. This allows attackers to compromise the integrity of the protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE relates to the absence of authentication. Exploiting this vulnerability allows a malicious actor to remotely influence the integrity of the protected information...

CVE-2022-3941

A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack can be initiated remotely...