CVE-2025-8808

CVE-2025-8808 affects xujeff tianti 天梯 up to 2.3. The vulnerability is in the exportOrder function of /tianti-module-admin/user/ajax/save within com.jeff.tianti.controller, enabling CSV injection. Exploitation appears possible remotely and public disclosures exist. Multiple connected sources conf...

CVE-2025-8806

CVE-2025-8806 affects the zhilink ADP Application Developer Platform (version 1.0.0) from Zhilink. The vulnerability allows SQL injection through the parameter extId in the endpoint /adpweb/a/sys/office/treeData. The issue is exploitable remotely and, according to sources, the exploit has been di...

CVE-2025-8796

A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic. This vulnerability affects unknown code of the file /auth/deleteproject/ of the component Delete Request Handler. The manipulation of the argument projectID leads to missing authorization. The attack...

CVE-2025-8796 LitmusChaos Litmus Delete Request delete_project authorization

A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic. This vulnerability affects unknown code of the file /auth/deleteproject/ of the component Delete Request Handler. The manipulation of the argument projectID leads to missing authorization. The attack...

CVE-2025-8795 LitmusChaos Litmus login access control

A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0. This affects an unknown part of the file /auth/login. The manipulation of the argument projectID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-8793 LitmusChaos Litmus resource injection

A vulnerability classified as problematic was found in LitmusChaos Litmus up to 3.19.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument projectID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has be...

CVE-2025-8792 LitmusChaos Litmus client-side enforcement of server-side security

A vulnerability classified as problematic has been found in LitmusChaos Litmus up to 3.19.0. Affected is an unknown function. The manipulation leads to client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been disclosed to the public and m...

PT-2025-32467 · Unknown · Litmuschaos

Name of the Vulnerable Software and Affected Versions: LitmusChaos Litmus versions up to 3.19.0 Description: A problematic issue exists in LitmusChaos Litmus due to improper control of resource identifiers resulting from the manipulation of the projectID argument. This issue can be exploited...

PT-2025-32461 · Portabilis · Portabilis I-Diario

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario versions up to 1.5.0 Description: A cross site scripting issue exists in the file /planos-de-aula-por-areas-de-conhecimento/ of the component Informações adicionais. The manipulation of the Parecer/Conteúdos/Objetivos...

PT-2025-32463 · Unknown · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.9.0 Description: A critical issue exists in Portabilis i-Educar related to improper authorization. The vulnerability is located in the API Endpoint component, specifically within the /module/Api/pessoa fil...

CVE-2025-8759

A vulnerability was found in TRENDnet TN-200 1.02b02. It has been declared as problematic. This vulnerability affects unknown code of the component Lighttpd. The manipulation of the argument secdownload.secret with the input neV3rUseMe leads to use of hard-coded cryptographic key . The attack can...

CVE-2025-8758

CVE-2025-8758 concerns TRENDnet TEW-822DRE FW103B02, where a vulnerability in the vsftpd component leads to a least privileged execution issue. Under the described conditions, exploitation requires local access and the attack complexity is high. Publicly disclosed exploit details exist, and the v...

CVE-2025-8757

A vulnerability was found in TRENDnet TV-IP110WN 1.2.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /server/boa.conf of the component Embedded Boa Web Server. The manipulation leads to least privilege violation. Local access is required to approa...

CVE-2025-8741 macrozheng mall login cleartext transmission

A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. The...

EUVD-2025-23988

A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to hard-coded credentials. The attack may be launched remotely. The exploit has been...

PT-2025-32418 · Unknown · Cesiumlab Web

Name of the Vulnerable Software and Affected Versions: CesiumLab Web versions prior to 4.1 Description: A critical vulnerability exists in CesiumLab Web. The issue affects unknown code within the /lodmodels/ file and allows for SQL injection through manipulation of the ID argument. This attack ca...

MAL-2025-47452 Malicious code in secmeasure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security f566db2e1359b455ca36524d9c066854754e71ac92deca9706f69d3d71cc8414 This package installs the SilentSync remote access trojan and allows remote code execution and data exfiltration. Windows machines are...

CVE-2025-30133

An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the "IROAD X View" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password...

CVE-2025-30133

An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the "IROAD X View" app for authentication, but its HTTP server lacks this restriction. Once connected to the dashcam's Wi-Fi network via the default password...

CVE-2025-30133

The IROAD Dashcam FX2 (affected versions not specified) is vulnerable to a device pairing/registration bypass . The device's HTTP server lacks the necessary restrictions required by the "IROAD X View" app for authentication. An attacker can connect to the dashcam's Wi-Fi network using the default...