ABB Cylon FLXeon 9.3.5 (capture.js) Authenticated File Disclosure/Delete

Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...

CVE-2025-4476

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 Unauthorized HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed...

CVE-2025-47928

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

CVE-2025-29688

A cross-site scripting XSS vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java...

CVE-2025-29690

A cross-site scripting XSS vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java...

CVE-2025-29688

CVE-2025-29688 affects OA System prior to version 2025.01.01. It is a cross-site scripting (XSS) vulnerability where a crafted payload injected into the title parameter of the /daymanager/daymanageabilitycontroller.java endpoint allows execution of arbitrary web scripts or HTML. Root cause: insuf...

PT-2025-21246 · Oa System · Oa System

Name of the Vulnerable Software and Affected Versions: OA System versions prior to 2025.01.01 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at the "/inform/InformManageController.java...

oa_system 跨站脚本漏洞

oasystem is a hailey individual developer's application for the day-to-day operation and management of organizations, used by employees and managers. A security vulnerability exists in oasystem versions prior to v2025.01.01, which stems from improperly cleaned input of the parameter password in t...

Online Birth Certificate System /admin/bwdates-reports-details.php File SQL Injection Vulnerability

Online Birth Certificate System is an online birth certificate system. Online Birth Certificate System has a SQL injection vulnerability that originates from an incorrect manipulation of the parameter fromdate in the /admin/bwdates-reports-details.php file that results in SQL injection. No detail...

PT-2025-20970

Name of the Vulnerable Software and Affected Versions: Remote Desktop Gateway Service versions affected versions not specified Description: The issue is a heap-based buffer overflow in the Remote Desktop Gateway Service, allowing an unauthorized attacker to execute code over a network. This enabl...

CVE-2025-4499

A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Affected by this vulnerability is the function Add of the component Add Information. The manipulation of the argument xi.name/xi.disease leads to stack-based buffer overflow. The attack needs ...

Code-Projects Album Management System 安全漏洞

Code-Projects Album Management System is an open source album management system from Code-Projects. A security vulnerability exists in Code-Projects Album Management System version 1.0, which stems from vulnerability to stack buffer overflow attacks...

CVE-2025-1330 IBM CICS TX code execution

IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyname function...

Security Bulletin: Vulnerability in requests affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-35195].

Summary The requests package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-35195. Vulnerability Details CVEID:CVE-2024-35195 DESCRIPTION: Psf Requests could allow a local authenticated attacker to bypass security...

CVE-2025-47540

Summary: CVE-2025-47540 affects WordPress weMail up to version 1.14.13, enabling exposure of sensitive system information to an unauthorized control sphere and retrieval of embedded sensitive data. The NVD/CVSS metrics indicate a high-severity, network-exploitable issue (CVSS v3.1: AV:N/AC:L/PR:N...

CVE-2025-46584

Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

Brilliance Golden Link Secondary System 安全漏洞

Brilliance Golden Link Secondary System is a management system from Brilliance, China. A security vulnerability exists in Brilliance Golden Link Secondary System version 20250424 and earlier, which is caused by a SQL injection due to incorrect manipulation of the parameter dictCn1 in the file...

PT-2025-24447

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: A logic error in the code may allow a lock screen bypass, potentially leading to local privilege escalation without requiring additional execution privileges or user interaction. The...

PT-2025-24453

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The vulnerability resides within the System component of the Android operating system, stemming from improper code generation management. Remote attackers can potentially execute arbitrary...

PT-2025-18952 · Unknown · Phpgurukul Teacher Subject Allocation Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Teacher Subject Allocation Management System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Teacher Subject Allocation Management System. The issue affects an unknown function of the file...