Auto Taxi Stand Management System SQL Injection Vulnerability

Auto Taxi Stand Management System is an auto cab stand management system. Auto Taxi Stand Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter searchdata. An attacker can exploit this vulnerability ...

EulerOS 2.0 SP12 : libcap (EulerOS-SA-2025-1594)

According to the versions of the libcap package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The PAM module pamcap.so of libcap configuration supports group names starting with @, during actual parsing, configurations not starting with @ ar...

Huawei EulerOS: Security Advisory for libcap (EulerOS-SA-2025-1594)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The Security Overview and Analysis of 3GPP 5G MAC CE

To more effectively control and allocate network resources, MAC CE has been introduced into the network protocol, which is a type of control signaling located in the MAC layer. Since MAC CE lacks encryption and integrity protection mechanisms provided by PDCP, the control signaling carried by MAC...

WordPress Bold Page Builder plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Bold Page Builder plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of...

Medium: ecs-init

Issue Overview: The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result i...

PT-2025-25234

Name of the Vulnerable Software and Affected Versions CryptX for Perl versions prior to 0.065 Description The issue concerns a potential Unicode vulnerability in CryptX for Perl. It is related to a dependency that may be susceptible to malformed Unicode. Specifically, CryptX embeds the tomcrypt...

CVE-2025-46899

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2025-47713

Apache CloudStack

CIRCL-Fourq: Missing and wrong validation can lead to incorrect results

Impact The CIRCL implementation of FourQ fails to validate user-supplied low-order points during Diffie-Hellman key exchange, potentially allowing attackers to force the identity point and compromise session security. Moreover, there is an incorrect point validation in ScalarMult can lead to...

OctoPrint vulnerable to possible file extraction via upload endpoints

Impact OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILEUPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. The primary ris...

GeoServer Missing Authorization on REST API Index

Summary It is possible to bypass the default REST API security and access the index page. Details The REST API security handles rest and its subpaths but not rest with an extension e.g., rest.html. Impact The REST API index can disclose whether certain extensions are installed. Workaround In...

CVE-2024-50562

An Insufficient Session Expiration vulnerability CWE-613 in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session...

CVE-2025-47169

CVE-2025-47169 affects Microsoft Word (Office) via a heap-based buffer overflow in Word, enabling local code execution. The vulnerability is confirmed by multiple sources (MSRC and related advisories) and is addressed by June 2025 Word security updates (e.g., KB5002729/KB5002732). Remediation: in...

CVE-2025-47167

Microsoft Office remote/local code execution vulnerability CVE-2025-47167 arises from an incompatible type (type confusion) when accessing resources, allowing an unauthenticated or authenticated attacker to execute code with the user’s context. Affected products span Office suite components (Word...

CVE-2025-47962

CVE-2025-47962 is an elevation-of-privilege vulnerability in Windows SDK caused by improper access control, allowing an authorized local attacker to gain SYSTEM/privilege-level access. A PoC exploit exists in a GitHub repo (CVE-2025-47962-POC) showing local DLL loading and service manipulation (I...

CVE-2025-32714 Windows Installer Elevation of Privilege Vulnerability

...

CVE-2025-32712

CVE-2025-32712 is a use-after-free in Windows Win32K GRFX that enables local privilege escalation for an authorized attacker. Connected docs corroborate a GRFX-related privilege-elevation issue associated with Windows components; the NCSC advisory explicitly lists CVE-2025-32712 under Windows Win...

CVE-2023-20599

Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor CCP registers from x86 resulting in potential loss of control of cryptographic key pointer/index leading to loss of integrity or confidentiality...

CVE-2025-40585

A vulnerability has been identified in Energy Services All versions with G5DFR. Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device...