CVE-2025-14199 Verysync 微力同步 Web Administration text.txt unrestricted upload

A flaw has been found in Verysync 微力同步 up to 2.21.3. This impacts an unknown function of the file /rest/f/api/resources/f96956469e7be39d/tmp/text.txt?override=false of the component Web Administration Module. Executing manipulation can lead to unrestricted upload. The attack may be performed from...

EUVD-2025-201603

A vulnerability was found in RashminDungrani online-banking up to 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. This affects an unknown part of the file /site/dist/authlogin.php. Performing manipulation of the argument Username results in sql injection. The attack can be initiated remotely. The explo...

CVE-2025-14195

A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/addfilequery.php. The manipulation of the argument perfile results in unrestricted upload. The attack may be launched remotely. The exploit has been...

PT-2025-49413

Name of the Vulnerable Software and Affected Versions alokjaiswal Hotel-Management-services-using-MYSQL-and-php versions prior to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f Description A cross site scripting issue exists in alokjaiswal Hotel-Management-services-using-MYSQL-and-php. The issue is...

PT-2025-49412

Name of the Vulnerable Software and Affected Versions Verysync versions up to 2.21.3 Description A flaw exists in Verysync that allows for unrestricted file upload. This impacts an unknown function within the Web Administration Module, specifically related to the file...

CVE-2025-14141 UTT 进取 520W formArpBindConfig strcpy buffer overflow

A flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formArpBindConfig. Executing manipulation of the argument pools can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used...

PT-2025-49329

Name of the Vulnerable Software and Affected Versions fit2cloud Halo version 2.21.10 Description A cross-site request forgery issue exists in fit2cloud Halo version 2.21.10. The issue is related to an unknown function. The attack can be initiated remotely and the exploit has been publicly...

FIT2CLOUD Halo 安全漏洞

FIT2CLOUD Halo is a website builder from China-based FIT2CLOUD. A security vulnerability exists in FIT2CLOUD Halo version 2.21.10, which stems from a cross-site request forgery issue that could lead to a remote attack...

EUVD-2025-201426

A vulnerability was identified in Himool ERP up to 2.2. Affected by this issue is the function updateaccount of the file /api/admin/updateaccount/ of the component AdminActionViewSet. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is public...

CVE-2025-14089 Himool ERP AdminActionViewSet update_account improper authorization

A vulnerability was identified in Himool ERP up to 2.2. Affected by this issue is the function updateaccount of the file /api/admin/updateaccount/ of the component AdminActionViewSet. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is public...

RARLAB RAR App 路径遍历漏洞

RARLAB RAR App is a compression, decompression and file management software from RARLAB, Inc. A path traversal vulnerability exists in Rarlab RAR App 7.11 Build 127 and earlier versions, which stems from a path traversal issue in the component com.rarlab.rar, and could lead to a remote attack...

HimoolERP 授权问题漏洞

HimoolERP is an enterprise resource planning management system by Himool Individual Developer. An authorization issue vulnerability exists in HimoolERP 2.2 and earlier versions, which stems from improper authorization of the function updateaccount in the file /api/admin/updateaccount/, which coul...

CVE-2025-54159

The CVE-2025-54159 entry describes a missing authorization vulnerability in Synology BeeDrive for desktop prior to version 1.4.2-13960, where remote attackers could delete arbitrary files via unspecified vectors. Affected product: BeeDrive for desktop. Root cause: lack of authorization checks in ...

EUVD-2025-201171

A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec220c7e.php?c=api&m=testsitedomain of the component Project Domain Change Test. This manipulation of the argument v causes server-side request forgery. It is possible to initiate t...

NVIDIA Isaac-GR00T TorchSerializer Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Isaac-GR00T. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TorchSerializer class. The issue results from the lack of proper validation of...

PT-2025-49152

Name of the Vulnerable Software and Affected Versions Remote Keyboard Desktop version 1.0.1 Description The software allows remote attackers to execute system commands. This is possible through the rundll32.exe exported function export, leading to unauthenticated code execution. Recommendations A...

EUVD-2024-32452

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows...

CVE-2025-13947 Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser...

SUSE CVE-2025-13636

Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. Chromium security severity: Low...

Sulu XSS Vulnerability (GHSA-6784-9c82-vr85)

Sulu is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sulu:sulu"; if...