KLA85525 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, bypass security restrictions, cause denial of service, spoof user interface. Below is a complete list of...

CVE-2024-37656

An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php...

CVE-2025-52895 Frappe possibility of SQL injection due to improper validations

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There...

CVE-2025-52895 Frappe possibility of SQL injection due to improper validations

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There...

CVE-2025-52895: Improper Neutralization of Special Elements used in an SQL Command

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There...

PDF-XChange Editor Information Disclosure Vulnerability (CNVD-2025-16294)

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. An information disclosure vulnerability exists in PDF-XChange Editor, which is caused by a lack of proper validation of user-supplied data. An attacker could exploit this vulnerabilit...

CVE-2025-48026

A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow an attacker to read files from the underlying OS and...

CVE-2023-47030

A security vulnerability exists in NCR Terminal Handler v.1.5.1 (also referred to as NCR Atleos Terminal Handler ) due to the improper handling of GET requests by the UserService SOAP API endpoint used for user validation. This flaw allows a remote attacker to execute arbitrary code and obtain se...

Dmacroweb DM Corporative CMS Insecure Direct Elephant Reference Vulnerability (CNVD-2025-14361)

Dmacroweb DM Corporative CMS is a content management system from the Spanish company Dmacroweb. Dmacroweb DM Corporative CMS suffers from an insecure direct object reference vulnerability, which originates from the parameter option in the file /administer/selectionnode/selection.asp that fails to...

PT-2025-25752 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: A SQL Injection issue allows a remote attacker to obtain sensitive information via the "admin datarelate.php" component. Recommendations: For SeaCMS version 12.9, update to a version that fixes this issue, as...

CVE-2024-40570

A SQL Injection vulnerability exists in SeaCMS v.12.9 within the admin_datarelate.php component. This flaw allows a remote attacker to obtain sensitive information from the system. While documentation confirms the existence of the vulnerability and its impact on confidentiality, there is currentl...

TencentOS Server 3: linux-firmware (TSSA-2023:0222)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0222 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2025-30507 CyberData 011209 SIP Emergency Intercom SQL Injection

CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections...

CVE-2025-31264

An authentication issue exists in Apple macOS caused by improper state management. An attacker with physical access to a locked device could potentially view sensitive user information . This vulnerability is addressed in macOS Sequoia 15.4 , macOS Sonoma 14.7.5 , and macOS Ventura 13.7.5 . Explo...

VMWare Cloud Foundation Multiple Vulnerabilities (VMSA-2025-0009)

The remote host is running a version of Cloud Foundation version 4.5.x or earlier than 4.5.2.0 with Hotpatch KB398008 or 5.x earlier than 5.2.1.2. It is, therefore, affected by multiple vulnerabilities: - A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit thi...

CVE-2025-40672

A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the file panLoad.exe that will be executed by SYSTEM user via a programmed task. This would allow an attacker to obtain administrator permission...

CVE-2025-40672 Privilege Escalation in Panloader.exe

A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the file panLoad.exe that will be executed by SYSTEM user via a programmed task. This would allow an attacker to obtain administrator permission...

ROS-20250526-06

A vulnerability in HashiCorp's Vault and Vault Enterprise enterprise information archiving platforms is related to the fact that the Shamir implementation uses pre-computed table lookups. Exploitation of the vulnerability could allow an attacker to gain access to potentially sensitive information...

CVE-2025-20167

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-0058

In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the...