CVE-2025-53018 Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery SSRF vulnerability exists in the /api/v2/Photo::fromUrl endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose...

CVE-2025-53018 Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery SSRF vulnerability exists in the /api/v2/Photo::fromUrl endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose...

CVE-2025-5194

The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Emergency Ambulance Hiring Portal index.php File SQL Injection Vulnerability

Emergency Ambulance Hiring Portal is an emergency ambulance hiring portal. Emergency Ambulance Hiring Portal suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in /index.php. An attacker can exploit this vulnerability to execute...

PT-2025-27074 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issu...

Inventory Management System changePassword.php File SQL Injection Vulnerability

Inventory Management System is an inventory management system. Inventory Management System suffers from a SQL injection vulnerability that originates from the lack of validation of the userid parameter in the /phpaction/changePassword.php file against an externally entered SQL statement. An...

Pre-School Enrollment System Project update-class-pic.php File Directory Traversal Vulnerability

The Pre-School Enrollment System Project is a preschool enrollment system project. A directory traversal vulnerability exists in Pre-School Enrollment System Project, which stems from a lack of validity checking of paths in the file update-class-pic.php when processing directory requests, and can...

Inventory Management System changeUsername.php File SQL Injection Vulnerability

Inventory Management System is an inventory management system. Inventory Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter userid in the file /changeUsername.php. An attacker can exploit...

Online Shoe Store admin_index.php File SQL Injection Vulnerability

Online Shoe Store is an online shoe store system. Online Shoe Store suffers from a SQL injection vulnerability that originates from the lack of validation of the parameter Username in the file /admin/adminindex.php for externally entered SQL statements. An attacker can exploit this vulnerability ...

Simple Pizza Ordering System addcatexec.php File SQL Injection Vulnerability

Simple Pizza Ordering System is a simple pizza ordering system. Simple Pizza Ordering System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter textfield in the file /addcatexec.php. An attacker can exploit...

CVE-2025-52560

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the applicationurl configuration is unset default behavior. This allows an attacker to...

PHPGurukul Pre-School Enrollment System Project 安全漏洞

The Pre-School Enrollment System Project is a preschool enrollment system project. A directory traversal vulnerability exists in Pre-School Enrollment System Project, which stems from a lack of validity checking of paths when handling directory requests in manage-classes.php, and can be exploited...

The vulnerability of the diNewExt() function in the fs/jfs/jfs_imap.c module of the JFS file system support in Linux kernel allows a attacker to cause a service failure.

The vulnerability of the diNewExt function in the fs/jfs/jfsimap.c module of the Linux file system support library is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a service failure...

Vulnerability of the amdgpu_discovery_reg_base_init() function in the drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c file – This driver provides support for AMD GPU cores in Linux operating systems’ Direct Rendering Infrastructure (DRI) components. This vulnerability allows attackers to cause system failures.

Vulnerability of the amdgpudiscoveryregbaseinit function in the drivers/gpu/drm/amd/amdgpu/amdgpudiscovery.c file – The drivers for AMD GPU cores in Linux operating systems are vulnerable due to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a system...

The vulnerability of the function ieee80211_get_rate_duration() in the net/mac80211/airtime.c module of the mac80211 stack in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the ieee80211getrateduration function in the net/mac80211/airtime.c module of the mac80211 stack in the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the dbAllocBits() function in the fs/jfs/jfs_dmap.c module of the Linux file system support for JFS kernels allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dbAllocBits function in the fs/jfs/jfsdmap.c module of the Linux file system support module JFS is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

c3crm 跨站脚本漏洞

c3crm is a CRM software by dfar2008 individual developer. A security vulnerability exists in c3crm 3.0.4 and earlier versions, which stems from an unvalidated input of the loginerror parameter in the component/Login.php, which could lead to a cross-site scripting attack...

The vulnerability of the dtSplitRoot() function in the fs/jfs/jfs_dtree.c module of the JFS file system support in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dtSplitRoot function in the fs/jfs/jfsdtree.c module of the Linux operating system’s file system support module is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility ...

Vulnerability of the ath9k_htc_txstatus() function in the drivers/net/wireless/ath/ath9k/htc_drv_txrx.c file – This driver provides support for Atheros/Qualcomm wireless adapter devices in the Linux operating system. It can be exploited by attackers to cause service failures.

Vulnerability of the ath9khtctxstatus function in the drivers/net/wireless/ath/ath9k/htcdrvtxrx.c file – The Atheros/Qualcomm wireless adapter support driver for Linux operating systems has a vulnerability related to unvalidated array indexing. Exploiting this vulnerability could allow an attacke...

The vulnerability of the dbAdjTree() function in the fs/jfs/jfs_dmap.c module of the JFS file system support module in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the dbAdjTree function in the fs/jfs/jfsdmap.c module of the JFS file system support in Linux’s operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a service failure...