CVE-2025-25580

CVE-2025-25580 affects yimioa prior to v2024.07.04 and is a SQL injection vulnerability exposed via the listNameBySql() method in the /xml/UserMapper.xml. The entry indicates a local-privilege context with user interaction required and high confidentiality impact, but no exploit details or public...

CVE-2025-27281

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in cookforweb All In Menu all-in-menu allows Blind SQL Injection.This issue affects All In Menu: from n/a through = 1.1.5...

CVE-2025-26972

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5...

CVE-2025-26978

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through = 6.5.8...

SUSE CVE-2025-2309

A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5Tbitcopy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclos...

CVE-2024-12971

CVE-2024-12971 affects Pandora FMS versions 700–777.6. The issue is an OS command injection caused by improper neutralization of special elements in commands, enabling execution of arbitrary commands. Public exploitation is demonstrated by a Metasploit module that requires admin access to Pandora...

[20250401] - Framework - SQL injection vulnerability in quoteNameStr method of Database package

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package...

CVE-2025-0883

Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager. The vulnerability could reveal sensitive information retained by the browser. This issue affects Service Manager: 9.70, 9.71, 9.72, 9.80...

CVE-2025-28887

Cross-Site Request Forgery CSRF vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This issue affects Plugins Last Updated Column: from n/a through = 0.1.3...

CVE-2025-28867

Cross-Site Request Forgery CSRF vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue affects Frontpage category filter: from n/a through = 1.0.2...

CVE-2025-28923

Cross-Site Request Forgery CSRF vulnerability in philippe No Disposable Email no-disposable-email allows Stored XSS.This issue affects No Disposable Email: from n/a through = 2.5.1...

CVE-2025-28922

Cross-Site Request Forgery CSRF vulnerability in Terence D. Go To Top go-to-top allows Stored XSS.This issue affects Go To Top: from n/a through = 0.0.8...

CVE-2024-57882 affecting package kernel for versions less than 6.6.76.1-1

CVE-2024-57882 affecting package kernel for versions less than 6.6.76.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-27103 Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability​

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. ...

CVE-2025-26936

Improper Control of Generation of Code 'Code Injection' vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through = 1.70.0...

CVE-2025-27788 Ruby JSON Parser has Out-of-bounds Read

JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are...

CVE-2025-28909

CVE-2025-28909 describes a Cross-Site Request Forgery vulnerability in the WordPress plugin “WP No-Bot Question” (edwardw) affecting versions up to 0.1.7. Public sources (NVD/Red Hat/Patchstack) confirm the CSRF flaw but do not provide exploit details or a confirmed fixed version. CVSS 3.1 score ...

CVE-2025-27773

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to...

CVE-2025-26707

CVE-2025-26707 concerns ZTE GoldenDB. Multiple sources confirm an Improper Privilege Management vulnerability enabling privilege escalation. Affected product: ZTE GoldenDB, specifically versions 6.1.03 through 6.1.03.05. Root cause is improper privilege management that can allow an unauthorized a...

CVE-2025-26936

Improper Control of Generation of Code 'Code Injection' vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through = 1.70.0...