CVE-2025-7862 TOTOLINK T6 Telnet Service cstecgi.cgi setTelnetCfg missing authentication

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnetenabled with the input 1 leads to...

CVE-2025-7833 code-projects Church Donation System giving.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Church Donation System 1.0. This issue affects some unknown processing of the file /members/giving.php. The manipulation of the argument Amount leads to sql injection. The attack may be initiated remotely. The...

PT-2025-30142 · Unknown · Church Donation System

Name of the Vulnerable Software and Affected Versions: Church Donation System version 1.0 Description: A critical vulnerability exists in Church Donation System 1.0. The vulnerability affects unknown code within the /members/offering.php file. Manipulation of the trcode argument results in a SQL...

CVE-2025-34121

An unauthenticated arbitrary file upload vulnerability exists in Idera Up.Time Monitoring Station versions up to and including 7.2. The wizards/post2file.php script accepts arbitrary POST parameters, allowing attackers to upload crafted PHP files to the webroot. Successful exploitation results in...

CVE-2025-23269

CVE-2025-23269 affects the NVIDIA Jetson Linux kernel, where a vulnerability in the shared microarchitectural predictor state that influences transient execution could lead to information disclosure. The issue is documented across multiple feeds; NVIDIA’s security bulletin notes a software update...

CVE-2025-40919

Authen::DigestMD5 versions 0.01 through 0.02 for Perl generate the cnonce insecurely. The cnonce client nonce is generated from an MD5 hash of the PID, the epoch time and the built-in rand function. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not...

CVE-2025-53924

Summary: CVE-2025-53924 affects Emlog up to and including pro-2.5.17. The vulnerability is a cross-site scripting (XSS) flaw in the siteurl parameter that authenticated attackers can abuse to inject arbitrary script/HTML, resulting in Stored XSS when a link is clicked. The available connected doc...

Microsoft Brokering File System Windows 11 Version 22H2 - Elevation of Privilege

Titles: Microsoft Brokering File System Windows 11 Version 22H2 - Elevation of Privilege Author: nu11secur1ty Date: 07/09/2025 Vendor: Microsoft Software: https://www.microsoft.com/en-us/windows/windows-11?r=1 Reference: https://portswigger.net/web-security/access-control CVE-2025-49677 Descripti...

CVE-2025-50106

CVE-2025-50106 affects Oracle Java SE and Oracle GraalVM family (including JDK/Enterprise Edition) with affected component 2D (also appears under JSSE/Networking and Scripting in some advisories). Affected Oracle Java SE versions include 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; affect...

CVE-2025-50076

Removed by vendor...

PT-2025-29627 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 12.2.1.4.0 Oracle WebLogic Server versions 14.1.1.0.0 Oracle WebLogic Server versions 14.1.2.0.0 Description: An easily exploitable issue exists in the Oracle WebLogic Server Core component, allowing an...

CVE-2025-7628

CVE-2025-7628 affects YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. The vulnerability is in the deleteFile function at /deleteFile where manipulat ing the fileName parameter enables path traversal. It is described as exploitable remotely and has public exploit di...

CVE-2025-7585

CVE-2025-7585 affects PHPGurukul Online Fire Reporting System v1.2, specifically the vulnerable code path in the file , where manipulation of the parameter webtitle enables an SQL injection. The vulnerability is exploitable remotely and has been publicly disclosed. Multiple connected sources conf...

CVE-2025-7419 Tenda O3V2 httpd setRateTest fromSpeedTestSet stack-based overflow

A vulnerability was found in Tenda O3V2 1.0.0.123880. It has been classified as critical. This affects the function fromSpeedTestSet of the file /goform/setRateTest of the component httpd. The manipulation of the argument destIP leads to stack-based buffer overflow. It is possible to initiate the...

WordPress DocCheck Login Access Control Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. An Access Control Error vulnerability exists in WordPress DocCheck Login, which originates from a page load that redirects a user to login, and can be exploited by an...

CVE-2025-7127

A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System up to 1.0. This affects an unknown part of the file /admin/changepassword.php. The manipulation of the argument currentpassword leads to sql injection. It is possible to initiate the attack...

PT-2025-29848 · Gnu +1 · Gpac +1

Уязвимость функции gf filter pid get packet утилиты MP4Box мультимедийной платформы GPAC связана с разыменованием указателя с истекшим сроком действия. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании или выполнить произвольный код...

PT-2025-29372 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: A critical vulnerability exists in the fromPptpUserSetting function of the /goform/PPTPUserSetting file. Manipulation of the delno argument leads to a stack-based buffer overflow, allowing for...

Hash Collision

llamaindexreaderspapers is vulnerable to Hash Collision. The vulnerability is due to the use of MD5 hashing to generate filenames for downloaded papers, which allows an attacker to exploit hash collisions by submitting papers with identical titles but different content...

CVE-2025-7152

CVE-2025-7152 affects Campcodes Advanced Online Voting System 1.0. Affected component: an unknown function in /admin/candidates_add.php where manipulating the photo parameter enables unrestricted file upload. The vulnerability can be exploited remotely and the exploit has been publicly disclosed....