21902 matches found
CVE-2025-2743
A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path...
CVE-2025-2742 zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversal
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack...
CVE-2025-2733
CVE-2025-2733 affects mannaandpoem OpenManus up to 2025.3.13. The vulnerability is an OS command injection in the Prompt Handler’s file app/tool/python_execute.py, enabling remote exploitation. Exploitation information is publicly disclosed and the vendor was contacted but did not respond. No rem...
CVE-2025-2729 H3C Magic BE18000 HTTP POST Request networkSetup command injection
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to...
MAL-2025-2663 Malicious code in datahub-react-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d82378a4b4eeb1355f9d5fbee783eb02ebfd625e5b7480f1ab594461b8d90d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-2727
The CVE-2025-2727 case affects H3C Magic NX30 Pro up to version V100R007. The vulnerability resides in the HTTP POST Request Handler’s /api/wizard/getNetworkStatus function, where an injection flaw in the targeted API endpoint enables command injection. An attacker within local network access can...
CVE-2025-2726
This CVE affects H3C Magic NX15, NX30 Pro, NX400, R3010 and BE18000 (up to V100R014). The vulnerability resides in the HTTP POST Request Handler’s /api/esps endpoint, where exploitation leads to command injection. Access from the local network is required; the issue has been disclosed publicly. R...
CVE-2025-2725 H3C Magic BE18000 HTTP POST Request auth command injection
A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads ...
CVE-2025-2723
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "the call is invalid as the buffer pointed to by "data" must have...
CVE-2025-2722
Removed by vendor...
CVE-2025-2720
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: According to the code maintainer the call of the POC is invalid because the buffer pointed to by "data...
CVE-2025-2720
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: According to the code maintainer the call of the POC is invalid because the buffer pointed to by "data...
CVE-2025-2721
Removed by vendor...
CVE-2025-2714 JoomlaUX JUX Real Estate addagent cross site scripting
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the argument planid leads to cross site scripting. T...
CVE-2025-2712 Yonyou UFIDA ERP-NC top.jsp cross site scripting
A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploi...
CVE-2025-2711
CVE-2025-2711 affects Yonyou UFIDA ERP-NC v5.0. Affected component: the /help/systop.jsp (and /help/top.jsp via langcode). Root cause: manipulation of the langcode input leads to reflected cross-site scripting (XSS). Impact: attackers can remotely exploit to execute arbitrary JavaScript in victim...
Web Push Denial of Service via malicious Web Push endpoint
Prior to version 0.10.3, the built-in clients of the web-push crate eagerly allocated memory based on the Content-Length header returned by the Web Push endpoint. Malicious Web Push endpoints could return a large Content-Length without ever having to send as much data, leading to denial of servic...
CVE-2025-2707 zhijiantianya ruoyi-vue-pro Front-End Store Interface upload path traversal
A vulnerability, which was classified as critical, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this issue is some unknown functionality of the file /app-api/infra/file/upload of the component Front-End Store Interface. The manipulation of the argument path leads to path...
CVE-2025-2705 Digiwin ERP FileUploadApi.ashx DoWebUpload unrestricted upload
A vulnerability classified as critical has been found in Digiwin ERP 5.1. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...