CVE-2025-8839 jshERP Endpoint addUser improper authorization

A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may b...

OpenEXR Buffer Overflow Vulnerability (CNVD-2025-24798)

OpenEXR is an open standard for high dynamic range image HDR file formats. A buffer overflow vulnerability exists in OpenEXR version 3.3.2, which stems from incorrect pointer arithmetic leading to an out-of-bounds read operation when decompressing a DWAA compressed scanline EXR file with...

UBUNTU-CVE-2025-8733

A flaw has been found in GNU Bison up to 3.8.2. This affects the function obstackvprintfinternal of the file obprintf.c. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been published and may be used. It is still unclear if this...

CVE-2025-8748

MiR software versions prior to 3.0.0 are affected by a command injection vulnerability that allows an authenticated user to execute arbitrary OS commands via a crafted HTTP request. Affected product: MiR robots software. Root cause: inadequate input handling in HTTP request processing leading to ...

PT-2025-32354 · Mobile Industrial Robots · Mobile Industrial Robots

Name of the Vulnerable Software and Affected Versions: Mobile Industrial Robots MiR versions prior to 3.0.0 Description: A path traversal vulnerability exists in an API endpoint within Mobile Industrial Robots MiR software. Authenticated users can extract files from the robot file system by...

OpenPLC Runtime version 3 代码问题漏洞

OpenPLC Runtime version 3 is a programmable logic controller by the individual developer Thiago Alves. A code issue vulnerability exists in OpenPLC Runtime version 3 that originates from allowing an authenticated user to upload arbitrary files and access them publicly...

UBUNTU-CVE-2025-48073

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a...

CVE-2025-5253

Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS. This issue affects Kron PAM: before 3.7...

Vulnerabilities fixed in Cisco ISE and ISE-PIC

Cisco has fixed vulnerabilities in Cisco ISE and ISE-PIC. The vulnerabilities are in the way Cisco ISE and ISE-PIC process files through APIs and validate user input. Unauthenticated attackers with access to the API interface can exploit these vulnerabilities to upload and execute arbitrary files...

fastapi-guard 安全漏洞

fastapi-guard is a security library for FastAPI by Renzo F Individual Developer that provides middleware to control IPs, log requests and detect penetration attempts. A security vulnerability exists in fastapi-guard version 3.0.1, which stems from an improperly restricted regular expression lengt...

Developers Insight on Manifest V3 Privacy and Security Webextensions

Webextensions can improve web browser privacy, security, and user experience. The APIs offered by the browser to webextensions affect possible functionality. Currently, Chrome transitions to a modified set of APIs called Manifest v3. This paper studies the challenges and opportunities of Manifest...

xxl-job 命令注入漏洞

XXL-JOB is a distributed task scheduling platform by the individual developer Xu Xueli xuxueli. A command injection vulnerability exists in xxl-job 3.1.1 and earlier versions, which stems from a misuse of the commandJobHandler function leading to os command injection attacks...

MRCMS 安全漏洞

MRCMS is a content management system by the individual developers at marker. A security vulnerability exists in MRCMS version 3.1.2, which stems from mishandling of the component /admin/group/save.do, which could lead to a cross-site scripting attack...

CVE-2025-6982

Use of Hard-coded Credentials in TP-Link Archer C50 V3 = 180703/V4 = 250117 /V5 = 200407 , and C20 V5...

SUSE CVE-2025-48924

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass... can throw StackOverflowError on very long input...

SUSE CVE-2025-51591

A Server-Side Request Forgery SSRF in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilitie...

Auto-Root-Exploit

Auto-Root-Exploit Auto Root Exploit Tool Author : Nilotpal Biswas Facebook : https://www.facebook.com/nilotpal.biswas.73 Twitter : https://twitter.com/nilotpalhacker USAGE : for kernel version 2.6 all bash autoroot.sh 2 for kernel version 3 all bash autoroot.sh 3 for kernel version 4 all bash...

CVE-2025-6756

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7CUSTOMFIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PHPGurukul Student Record System 注入漏洞

PHPGurukul Student Record System is an application from PHPGurukul Inc. An injection vulnerability exists in PHPGurukul Student Record System version 3.2, which results from SQL injection due to incorrect manipulation of parameter aemailid in file /admin-profile.php...

WordPress Litho theme <= 3.0 - Arbitrary File Deletion Vulnerability

Arbitrary File Deletion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Litho versions = 3.0...