CVE-2025-63695: Unrestricted Upload of File with Dangerous Type

DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php...

CVE-2025-63749: Improper Neutralization of Special Elements used in a Command

pnetlab 5.3.11 is vulnerable to Command Injection via the qemuoptions parameter...

CVE-2025-37160: Exposure of Sensitive Information to an Unauthorized Actor

A broken access control BAC vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data...

CVE-2025-63694: Improper Neutralization of Special Elements used in an SQL Command

DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage...

CVE-2025-37162: Improper Neutralization of Special Elements used in a Command

A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2025-12119: Expired Pointer Dereference

A mongocbulkoperationt may read invalid memory if large options are passed...

CVE-2025-37161: Uncontrolled Resource Consumption

A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting...

CVE-2025-53843: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets...

Photon OS 5.0: Linux PHSA-2025-5.0-0676

An update of the Linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0676. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-55055: Improper Neutralization of Special Elements used in an OS Command

CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

CVE-2025-36299: Inclusion of Sensitive Information in Source Code

IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system...

CVE-2024-44651: Improper Neutralization of Special Elements used in an SQL Command

Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the recoveremail parameter in userpasswordrecover.php...

CVE-2025-55056: Improper Neutralization of Input During Web Page Generation

Multiple CWE-79 Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting'...

CVE-2025-58410: Improper Handling of Insufficient Permissions or Privileges

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only. This is caused by improper handling of the memory protections for the buffer resource...

CVE-2025-55059: Improper Neutralization of Input During Web Page Generation

CWE-79 Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting'...

CVE-2024-44664: Improper Neutralization of Special Elements used in an SQL Command

PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in product-details.php...

CVE-2025-13284: Improper Neutralization of Special Elements used in an OS Command

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-55057: Cross-Site Request Forgery (CSRF)

Multiple CWE-352 Cross-Site Request Forgery CSRF...

Wapiti Web Application Vulnerability Scanner 3.2.10 Source Code

Wapiti is a web application vulnerability scanner. It will scan the web pages of a deployed web application and will fuzz the URL parameters and forms to find common web vulnerabilities. This is the source code release...

ProxyPrints: From Database Breach to Spoof, a Plug-And-Play Defense for Biometric Systems

Fingerprint recognition systems are widely deployed for authentication and forensic applications, but the security of stored fingerprint data remains a critical vulnerability. While many systems avoid storing raw fingerprint images in favor of minutiae-based templates, recent research shows that...