CVE-2025-48093: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through = 0.2...

Photon OS 4.0: Perl PHSA-2025-4.0-0890

An update of the perl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0890. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-60226: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through = 1.5.2...

CVE-2025-59564: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through 4.4.5...

CVE-2025-59555: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through 1.9.7...

CVE-2025-11151: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. CityPLus allows Detect Unpublicized Web Pages. This issue affects CityPLus: before...

CVE-2025-6541: Improper Neutralization of Special Elements used in an OS Command

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface...

CVE-2025-10612: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in giSoft Information Technologies City Guide allows Reflected XSS. This issue affects City Guide: before 1.4.45...

Custom HTTP Header Detected

This is an informational notice that the scanner was able to detect custom HTTP headers in the target application's responses. No source data...

CVE-2025-61194: Improper Neutralization of Special Elements used in an SQL Command

daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php...

CVE-2025-7473: XML Injection (aka Blind XPath Injection)

Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection...

CVE-2025-60751: Stack-based Buffer Overflow

GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode...

CVE-2025-62763: Server-Side Request Forgery (SSRF)

Zimbra Collaboration ZCS before 10.1.12 allows SSRF because of the configuration of the chat proxy...

CVE-2025-9428: Improper Neutralization of Special Elements used in an SQL Command

Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api...

CVE-2025-10020: Improper Neutralization of Special Elements used in a Command

Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component...

CVE-2025-59438: Observable Timing Discrepancy

Mbed TLS through 3.6.4 has an Observable Timing Discrepancy...

CVE-2025-6542: Improper Neutralization of Special Elements used in an OS Command

An arbitrary OS command may be executed on the product by a remote unauthenticated attacker...

CVE-2025-6239: Exposure of Sensitive Information to an Unauthorized Actor

Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor...

CVE-2025-61181: Unrestricted Upload of File with Dangerous Type

daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature...

CVE-2025-57838: Exposure of Sensitive Information to an Unauthorized Actor

Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality...