CVE-2025-10759

A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of the argument token results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. The...

CVE-2025-10822

A vulnerability has been found in fuyanglipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed to the public and m...

CVE-2025-10278

A flaw has been found in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and...

CVE-2025-10277

CVE-2025-10277 affects YunaiV yudao-cloud (up to 2025.09). The flaw lies in processing the file /crm/receivable/submit where manipulation of the ID argument leads to improper authorization. The issue is exploitable remotely, and public exploits have been published. The vendor was contacted but di...

CVE-2025-33099

IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

CVE-2025-9151

A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /webconfig/json/name/web. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The...

CVE-2025-9151

A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /webconfig/json/name/web. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The...

CVE-2025-9151

The CVE-2025-9151 entry concerns LiuYuYang01 ThriveX-Blog (versions up to 3.1.7). The vulnerability resides in the updateJsonValueByName function within /web_config/json/name/web, enabling improper authorization and remote initiation. Public exploit material exists, and multiple sources confirm t...

CVE-2025-8840

A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclos...

CVE-2025-8839

A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may b...

CVE-2025-8756

A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of the file /manage/ of the component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor. The manipulation leads to improper...

CVE-2025-8756 TDuckCloud tduck-platform manage preHandle improper authorization

A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of the file /manage/ of the component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor. The manipulation leads to improper...

Digisol DG-GR6821AC Router 安全漏洞

Digisol DG-GR6821AC Router is a WiFi router from Digisol India. A security vulnerability exists in the Digisol DG-GR6821AC Router that originates in the explicit transmission of credentials in the web management interface, which could lead to a remote attacker intercepting network traffic to gain...

The vulnerability of the SMB protocol implementation of the IBM Storage Scale cluster file system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SMB protocol implementation in the IBM Storage Scale cluster file system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the KVv2 plugin for the Vault Community Edition and Vault Enterprise archiving platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the KVv2 plugin for the Vault Community Edition and Vault Enterprise archiving platform relates to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected informatio...

PT-2025-25309

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A remote unauthorized attacker may gather sensitive information of the application, due to missing authorization of configuration settings of the product. Recommendations At the moment, there ...

The vulnerability of the SolidWall WAF, related to insufficient protection of service data, allows attackers to gain unauthorized access to the protected information.

The vulnerability of the SolidWall WAF lies in the insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Service Account Audit Data component of the Windows Active Directory (AD) management and reporting software Zoho ManageEngine ADAudit Plus allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the “Service Account Audit Data” component of the Windows Active Directory AD management and reporting software Zoho ManageEngine ADAudit Plus is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow an attacker,...

CVE-2023-30467

This vulnerability exists in Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC, due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially...

CVE-2023-38433

Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions...