4729 matches found
CVE-2025-60961
Cross Site Scripting XSS vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information, and possibly other unspecified impacts...
CVE-2025-10692
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
CVE-2025-60962
OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information, and possibly other unspecified impacts...
PT-2025-40924
Name of the Vulnerable Software and Affected Versions EndRun Technologies Sonoma D12 Network Time Server GPS version 4.00 Description A Cross Site Scripting XSS issue exists in EndRun Technologies Sonoma D12 Network Time Server GPS. This flaw may allow attackers to obtain sensitive information...
PT-2025-40929
Name of the Vulnerable Software and Affected Versions EndRun Technologies Sonoma D12 Network Time Server GPS version 4.00 Description An issue exists in EndRun Technologies Sonoma D12 Network Time Server GPS that allows attackers to execute arbitrary code, cause a denial of service, gain escalate...
CVE-2025-60961
EndRun Technologies Sonoma D12 Network Time Server (GPS) firmware 4.00 (6010-0071-000) is affected by a Cross-Site Scripting (XSS) vulnerability. Attackers could exfiltrate sensitive information; other impacts are unspecified. The issue is documented across multiple sources (NVD, Red Hat, EU ENIS...
EndRun Technologies Sonoma D12 Network Time Server 安全漏洞
EndRun Technologies Sonoma D12 Network Time Server is a time synchronization device from EndRun Technologies, USA. A security vulnerability exists in EndRun Technologies Sonoma D12 Network Time Server version 4.00, which stems from susceptibility to path traversal attacks that could lead to the...
CVE-2025-60958
Cross Site Scripting XSS vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information...
WordPress Nelio Content plugin <= 4.0.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Abu Hurayra in WordPress Plugin Nelio Content versions = 4.0.5...
CVE-2023-53547
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix sdma v4 sw fini error Fix sdma v4 sw fini error for sdma 4.2.2 to solve the following general protection fault +0.108196 general protection fault, probably for non-canonical address 0xd5e5a4ae79d24a32: 0000 1...
EUVD-2025-32419
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the registerAssociateFormsWithCampaign function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticat...
CVE-2025-11228
The CVE-2025-11228 issue affects GiveWP – Donation Plugin and Fundraising Platform for WordPress (versions
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a sdma v4 sw fini error that could lead to a general protection failure...
CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party the target user, who can then view the...
EUVD-2025-32372
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
EUVD-2025-26369
Malicious code in bioql PyPI...
EUVD-2025-27777
Malicious code in bioql PyPI...
EUVD-2021-32526
Malicious code in bioql PyPI...