CVE-2025-9138

A vulnerability was found in Scada-LTS 2.7.8.1. Affected is an unknown function of the file pointHierarchy/new/. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Th...

CVE-2025-9089

A vulnerability was determined in Tenda AC20 16.03.08.12. This issue affects the function sub48E628 of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and...

PT-2025-33723 · Scada-Lts · Scada-Lts

Name of the Vulnerable Software and Affected Versions: Scada-LTS version 2.7.8.1 Description: A cross-site scripting issue exists due to manipulation of the Title argument within the file pointHierarchy/new/. The attack can be carried out remotely. The vendor states that exploitation likely...

Best Salon Management System 1.0 SQL Injection

A remote SQL injection vulnerability exists in SourceCodester Best Salon Management System version 1.0...

Google Chrome < 139.0.7258.138 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 139.0.7258.138. It is, therefore, affected by a vulnerability as referenced in the 202508stable-channel-update-for-desktop19 advisory. - Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remot...

CVE-2025-9088

A vulnerability was found in Tenda AC20 16.03.08.12. This vulnerability affects the function savevirtualserdata of the file /goform/formSetVirtualSer. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed t...

CVE-2025-33090

CVE-2025-33090 describes a denial-of-service vulnerability in IBM Concert Software versions 1.0.0–1.1.0 . A remote attacker can trigger excessive resource consumption by sending a specially crafted regular expression, exploiting an underlying regex processing weakness. Public sources (NVD/Red Hat...

CVE-2025-9106

Portabilis i-Diario

CVE-2025-9100

A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The manipulation leads to authentication bypass by capture-replay. The attack can be initiated remotely. The...

PT-2025-33636 · Portabilis · I-Diario

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario versions up to 1.5.0 Description: A vulnerability exists in Portabilis i-Diario up to version 1.5.0, impacting an unknown function within the /alunos/search autocomplete file. Manipulation of the q argument can lead to...

My-Blog 安全漏洞

My-Blog is ZHENFENG13 individual developer by SpringBoot + Mybatis + Thymeleaf and other technologies to achieve the Java blog system, page beautiful, full-featured, easy to deploy and perfect code. A security vulnerability exists in My-Blog 1.0.0 and earlier versions, which stems from the Tag...

H2O HTTP Server HTTP/2 Protocol DoS Vulnerability (GHSA-mrjm-qq9m-9mjq, MadeYouReset)

H2O is prone to a denial of service DoS vulnerability in the HTTP/2 protocol dubbed SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-8973

A vulnerability has been found in SourceCodester Cashier Queuing System 1.0. Affected is an unknown function of the file /Actions.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and m...

CVE-2025-8971

A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument val-username leads to sql injection. The attack can be initiated remotely. The exploi...

CVE-2025-43984

An issue was discovered on KuWFi GC111 devices Hardware Version: CPE-LM321V3.2, Software Version: GC111-GL-LM321V3.020191211. They are vulnerable to unauthenticated /goform/goformsetcmdprocess requests. A crafted POST request, using the SSID parameter, allows remote attackers to execute arbitrary...

PT-2025-33606 · Tenda · Tenda Ac20

Name of the Vulnerable Software and Affected Versions: Tenda AC20 version 16.03.08.12 Description: A vulnerability exists in the sub 48E628 function of the /goform/SetIpMacBind file. Manipulation of the argument list leads to a stack-based buffer overflow, potentially allowing for remote...

CVE-2025-9053

A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubcategory.php. The manipulation of the argument t1/s1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the publ...

CVE-2025-9053

A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubcategory.php. The manipulation of the argument t1/s1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the publ...

CVE-2025-9019 tcpreplay tcpprep cidr.c mask_cidr6 heap-based overflow

A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function maskcidr6 of the file cidr.c of the component tcpprep. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitatio...

CVE-2025-9017 PHPGurukul Zoo Management System add-foreigner-ticket.php cross site scripting

A vulnerability has been found in PHPGurukul Zoo Management System 2.1. This vulnerability affects unknown code of the file /admin/add-foreigner-ticket.php. The manipulation of the argument visitorname leads to cross site scripting. The attack can be initiated remotely. The exploit has been...