CVE-2025-3563

The CVE-2025-3563 entry concerns WuzhiCMS 4.1. The vulnerability exists in the Setting Handler’s Set function of the /index.php?m=attachment&f=index&_su=wuzhicms&v=set&submit=1 path, where manipulating the Setting argument enables code injection. Documentation states remote exploitation is possib...

CVE-2025-3561 ghostxbh uzy-ssm-mall cross-site request forgery

A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2025-3556 ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication

A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be...

CVE-2025-3555 ScriptAndTools eCommerce-website-in-PHP login.php excessive authentication

A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The...

Information Disclosure

api-platform/core is vulnerable to Information disclosure. The vulnerability is due to improper handling of exception messages, where non-HTTP exceptions are not sanitized and are directly included in the JSON error response, allows potentially sensitive internal information to be exposed to...

CVE-2025-3550 wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System detail improper authorization

A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig/detail/. The manipulation leads to improper authorization. The attack can be launched...

CVE-2025-3550

CVE-2025-3550 affects wowjoy Internet Doctor Workstation System 1.0. The vulnerability is an improper authorization in the /v1/pushConfig/detail/ endpoint, enabling remote exploitation. Multiple sources confirm the issue exists in version 1.0 and describe the impact as unauthorized access to the ...

PT-2025-16275 · Zhenfeng13 · My-Blog-Layui

Name of the Vulnerable Software and Affected Versions: ZHENFENG13/code-projects My-Blog-layui version 1.0 Description: A problem was found in the software, affecting an unknown part of the file /admin/v1/link/edit. This issue leads to cross site scripting and can be initiated remotely. Multiple...

CVE-2025-3537 Tutorials-Website Employee Management System update-user.php improper authorization

A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely...

CVE-2025-3534 PowerCreator CMS OpenPublicCourse.aspx sql injection

A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to th...

CVE-2025-3534 PowerCreator CMS OpenPublicCourse.aspx sql injection

A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to th...

CVE-2025-3533 YouDianCMS index.html.Attackers cross site scripting

A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admin/Default/Channel/index.html.Attackers. The manipulation of the argument Parent leads to cross site scripting. The attack may be initiated...

PT-2025-16175 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YouDianCMS version 9.5.21 Description: A vulnerability has been found in YouDianCMS, affecting an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross-site scripting...

Advisory ROSA-SA-2025-2804

Software: httpd 2.4.37 OS: ROSA Virtualization 3.0 packageevrstring: httpd-2.4.37-65.rv30.3 CVE-ID: CVE-2023-31122 BDU-ID: 2023-07124 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the modmacro module of the Apache HTTP Server web server involves reading beyond memory boundaries. Exploitation of th...

DEBIAN-CVE-2025-32743

In ConnMan through 1.44, the lookup string in nsresolv in dnsproxy.c can be NULL or an empty string when the TC Truncated bit is set in a DNS response. This allows attackers to cause a denial of service application crash or possibly execute arbitrary code, because those lookup values lead to...

CVE-2025-32743

In ConnMan through 1.44, the lookup string in nsresolv in dnsproxy.c can be NULL or an empty string when the TC Truncated bit is set in a DNS response. This allows attackers to cause a denial of service application crash or possibly execute arbitrary code, because those lookup values lead to...

CVE-2025-3411

A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing of the file 3apiplatform/api-platform/src/main/java/top/aias/platform/controller/AsrController.java. The manipulation of the argument url leads to server-sid...

CVE-2025-3401

A vulnerability has been found in ESAFENET CDG 5.6.3.154.20520250114 and classified as critical. This vulnerability affects unknown code of the file /parameter/getLimitIPList.jsp. The manipulation of the argument noticeId leads to sql injection. The attack can be initiated remotely. The exploit h...

CVE-2025-32406

An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response...

CVE-2025-32743

In ConnMan through 1.44, the lookup string in nsresolv in dnsproxy.c can be NULL or an empty string when the TC Truncated bit is set in a DNS response. This allows attackers to cause a denial of service application crash or possibly execute arbitrary code, because those lookup values lead to...