2156 matches found
CVE-2025-41251 Weak password recovery vulnerability
VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. Attack Vector: Remote, unauthenticated...
CVE-2025-48703
CWP aka Control Web Panel or CentOS Web Panel before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. A valid non-root username must be known...
Malicious code in @zalastax/nolb-eslint-t (npm)
The package @zalastax/nolb-eslint-t was found to contain malicious code...
CVE-2025-41030
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain information from other users via GET ‘/ajax/TInnovav2/IntegrantesRecursov21/llamadaAjax/buscarPersona’ using the ‘dni’ parameter...
CVE-2025-41031
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...
CVE-2025-41030
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain information from other users via GET ‘/ajax/TInnovav2/IntegrantesRecursov21/llamadaAjax/buscarPersona’ using the ‘dni’ parameter...
CVE-2025-41031 Multiple vulnerabilities in Deporsite by T-INNOVA
Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnovac/FotoUsuario/llamadaAjax/uploadImage’...
CVE-2025-41030
CVE-2025-41030 affects Deporsite by T-INNOVA. The root cause is lack of authorization, allowing an unauthenticated attacker to obtain information about other users via GET /ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona using the dni parameter. The CVSSv4 base score is 6.9 (ME...
PT-2025-35544
Name of the Vulnerable Software and Affected Versions: Deporsite by T-INNOVA affected versions not specified Description: A lack of authorization exists in Deporsite by T-INNOVA. An unauthenticated attacker can modify other users' profile pictures by sending a POST request to the /ajax/TInnova...
T-INNOVA Deporsite 安全漏洞
T-INNOVA Deporsite is an application from T-INNOVA. A security vulnerability exists in T-INNOVA Deporsite that stems from a lack of authorization and could lead to obtaining information about other users via GET requests and dni parameters...
Linux Distros Unpatched Vulnerability : CVE-2022-43272
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DCMTK v3.6.7 was discovered to contain a memory leak via the TASCAssociation object. CVE-2022-43272 Note that Nessus relies on the presence of the package as...
CVE-2025-9645
The CVE-2025-9645 entry concerns itsourcecode Apartment Management System 1.0. Multiple connected sources confirm a SQL injection in the r_all_info.php endpoint, triggered by manipulating the mid parameter without proper validation. The flaw appears to be exploitable remotely, and several reports...
Linux Distros Unpatched Vulnerability : CVE-2021-26717
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When...
Linux Distros Unpatched Vulnerability : CVE-2025-22040
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix session use-after-free in multichannel connection There is a race condition between session setup and ksmbdsessionsderegister. The session can be fre...
Malicious code in @zalastax/nolb-ngx-t (npm)
The package @zalastax/nolb-ngx-t was found to contain malicious code...
Malicious code in @zalastax/nolb-json-t (npm)
The package @zalastax/nolb-json-t was found to contain malicious code...
Malicious code in @zalastax/nolb-gulp-t (npm)
The package @zalastax/nolb-gulp-t was found to contain malicious code...
MAL-2025-13589 Malicious code in @zalastax/nolb-random-t (npm)
The package @zalastax/nolb-random-t was found to contain malicious code...