CVE-2025-22415: Incorrect Privilege Assignment

In androidapp of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-21029

Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the cover display...

CVE-2025-21029

Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the cover display...

CVE-2025-21029

Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the cover display...

CVE-2025-50674

An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root...

openmediavault 安全漏洞

openmediavault is openmediavault open source a Debian Linux based network storage NAS solution. It includes services such as SSH, SFTP, SMB / CIFS, DAAP media server, RSync, BitTorrent client and more. Due to the modular design of the framework, it can be enhanced with plugins. A security...

CVE-2025-50674

An issue was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc in OpenMediaVault 7.4.17 allowing local authenticated attackers to escalate privileges to root...

CVE-2025-52392

The Soosyze CMS 2.0 (PHP-based content management system) is vulnerable to brute-force login attacks because the /user/login endpoint lacks rate-limiting and account lockout mechanisms . An attacker can submit unlimited POST requests with a known username/email and a password wordlist to potentia...

CVE-2012-10047

Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a...

CVE-2012-10047

Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a...

CVE-2012-10047: Improper Neutralization of Special Elements used in an SQL Command

Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a...

CVE-2025-51044

The phpgurukul Nipah virus (NiV) Testing Management System 1.0 is vulnerable to SQL injection in the /new-user-testing.php file. The root cause is the insufficient validation of user input provided via the govtissuedid parameter. This vulnerability could allow an attacker to execute unauthorized ...

CVE-2025-8127

A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. This vulnerability affects unknown code of the file /system/user/list. The manipulation of the argument paramsdataScope leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to...

deer-wms-2 注入漏洞

deer-wms-2 is a warehouse management system in China deerwms open source . The vulnerability exists in deerwms deer-wms-2 3.3 and earlier versions, the vulnerability stems from incorrect manipulation of the parameter paramsdataScope in the file /system/user/list resulting in SQL injection...

deer-wms-2 SQL注入漏洞

deer-wms-2 is a warehouse management system of China deerwms open source. A security vulnerability exists in deer-wms-2 3.3 and earlier versions, which originates from SQL injection due to incorrect manipulation of parameter paramsdataScope in file /system/user/export...

CVE-2025-7928

A vulnerability was found in code-projects Church Donation System 1.0 and classified as critical. This issue affects some unknown processing of the file /members/edituser.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has...

CVE-2025-34143

An authentication bypass vulnerability exists in ETQ Reliance on the CG legacy platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login pag...

CVE-2025-34143

CVE-2025-34143 affects ETQ Reliance on the CG (legacy) platform. The vulnerability enables authentication bypass by manipulating the username field to login as the internal SYSTEM account, which does not require a password, granting network-access attackers elevated access. After authentication, ...

CVE-2025-34143: Authentication Bypass Using an Alternate Path or Channel

An authentication bypass vulnerability exists in ETQ Reliance on the CG legacy platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login pag...

ETQ Reliance CG 安全漏洞

ETQ Reliance CG is a quality management system from ETQ Corporation. A security vulnerability exists in ETQ Reliance CG that originates from the ability to log in as a privileged internal SYSTEM user by bypassing authentication through manipulation of the username field, which could lead to remot...