Hikvision NVR/DVR Devices 安全漏洞

Hikvision NVR/DVR Devices are a series of network cameras from Hikvision, a Chinese company. A security vulnerability exists in Hikvision NVR/DVR Devices that stems from a stack overflow in the device's search and discovery function, which could allow an attacker on the same LAN to cause the devi...

MiracleLinux 7 : xorg-x11-server-1.20.4-99.0.1.el7.AXS7 (AXSA:2025-10843:03)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10843:03 advisory. CVE-2025-26594: refuse to free the root cursor and keep its ref CVE-2025-26595: fix buffer overflow in XkbVModMaskText CVE-2025-26596: xkb: fix...

Wordpress plugin WPForms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A cross-site...

PT-2026-2744

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description An issue exists in Microsoft Office where an untrusted search path can allow an unauthorized attacker to execute code locally. Recommendations At the moment, there is no information...

PT-2026-2776

Name of the Vulnerable Software and Affected Versions Illustrator versions 29.8.3 through 30.0 Description Illustrator versions 29.8.3 through 30.0 are subject to an Untrusted Search Path issue that may lead to arbitrary code execution with the privileges of the current user. This occurs when the...

CVE-2025-67146

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in 1 membersearch.php, 2 trainersearch.php, and 3 gymsearch.php, and via the 'id' parameter in 4 paymentsearch.php. An unauthenticated remote attacker can exploit these issues to inje...

CVE-2025-67146

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in 1 membersearch.php, 2 trainersearch.php, and 3 gymsearch.php, and via the 'id' parameter in 4 paymentsearch.php. An unauthenticated remote attacker can exploit these issues to inje...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the searchsend parameter, which is dynamically invoked using the send method. An attacker can execute arbitrary commands on the server by supplying crafted input to this parameter. Remediation Upgrade spree ...

WordPress Search & Go theme <= 2.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Search & Go versions = 2.8...

Origin Validation Error

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Origin Validation Error in the REST server, accessible via the...

PT-2026-2301

Name of the Vulnerable Software and Affected Versions AbhishekMali21 GYM-MANAGEMENT-SYSTEM version 1.0 Description The application contains multiple SQL Injection flaws. These issues are present via the name parameter in the member search.php, trainer search.php, and gym search.php files, and via...

CVE-2025-67146

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in 1 membersearch.php, 2 trainersearch.php, and 3 gymsearch.php, and via the 'id' parameter in 4 paymentsearch.php. An unauthenticated remote attacker can exploit these issues to inje...

CVE-2025-67146

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in 1 membersearch.php, 2 trainersearch.php, and 3 gymsearch.php, and via the 'id' parameter in 4 paymentsearch.php. An unauthenticated remote attacker can exploit these issues to inje...

CVE-2025-67146

Summary: CVE-2025-67146 affects AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 with multiple SQL Injection flaws. The issues occur via the name parameter in member_search.php, trainer_search.php, and gym_search.php, and via the id parameter in payment_search.php. An unauthenticated remote attacker coul...

GYM-MANAGEMENT-SYSTEM 安全漏洞

GYM-MANAGEMENT-SYSTEM is a gym management system by Abhishek S Personal Developer. A security vulnerability exists in GYM-MANAGEMENT-SYSTEM version 1.0, which stems from the unvalidated name parameter in membersearch.php, trainersearch.php, and gymsearch.php, and the id parameter in...

PT-2026-2347

Name of the Vulnerable Software and Affected Versions Hikvision Access Control Products affected versions not specified Description A stack overflow issue exists in the device Search and Discovery feature of Hikvision Access Control Products. An attacker on the same local area network LAN can cau...

PT-2026-2348

Name of the Vulnerable Software and Affected Versions Hikvision NVR/DVR/CVR/IPC models affected versions not specified Description A stack overflow issue exists in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. An attacker on the same local area network LAN could cau...

CVE-2026-22195

GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can...

CVE-2026-22195

GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can...

CVE-2026-22197

GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate...