CVE-2025-7907

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/src/main/resources/application-druid.yml of the component Druid. The manipulation leads to use of default credentials. It is possible to...

CVE-2025-7905 itsourcecode Insurance Management System insertPayment.php sql injection

A vulnerability has been found in itsourcecode Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /insertPayment.php. The manipulation of the argument reciptno leads to sql injection. The attack can be initiated remotely. The exploit ha...

CVE-2025-7903 yangzongzhuan RuoYi Image Source ui layer

A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The...

CVE-2025-7902

CVE-2025-7902 affects YangZongZhuan RuoYi up to version 4.8.1. The vulnerability is in the function addSave of file com/ruoyi/web/controller/system/SysNoticeController.java , causing a cross-site scripting (XSS) issue. It can be triggered remotely and exploitation details have been disclosed publ...

CVE-2025-7894

Onyx is affected up to version 0.29.1, with the SQL injection vulnerability arising via the generate_simple_sql function in backend/onyx/agents/agent_search/kb_search/nodes/a3_generate_simple_sql.py (Chat Interface). The issue allows remote exploitation and has been publicly disclosed. Connected ...

CVE-2025-7874 Metasoft 美特软件 MetaCRM env.jsp information disclosure

A vulnerability was found in Metasoft 美特软件 MetaCRM up to 6.4.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /env.jsp. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2025-7870 Portabilis i-Diario justificativas-de-falta Endpoint cross site scripting

A vulnerability, which was classified as problematic, was found in Portabilis i-Diario 1.5.0. This affects an unknown part of the component justificativas-de-falta Endpoint. The manipulation of the argument Anexo leads to cross site scripting. It is possible to initiate the attack remotely. The...

CVE-2025-7858 PHPGurukul Apartment Visitors Management System HTTP POST Request admin-profile.php cross site scripting

A vulnerability classified as problematic has been found in PHPGurukul Apartment Visitors Management System 1.0. This affects an unknown part of the file /admin-profile.php of the component HTTP POST Request Handler. The manipulation of the argument adminname leads to cross site scripting. It is...

CVE-2025-7800 cgpandey hotelmis HTTP GET Request admin.php cross site scripting

A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown code of the file admin.php of the component HTTP GET Request Handler. The manipulation of the argument Search leads to cross site scripting...

CVE-2025-7797

A vulnerability was found in GPAC up to 2.4. It has been rated as problematic. Affected by this issue is the function gfdashdownloadinitsegment of the file src/mediatools/dashclient.c. The manipulation of the argument baseiniturl leads to null pointer dereference. The attack may be launched...

PT-2025-30090 · Wx-Discuz · Wx-Discuz

Name of the Vulnerable Software and Affected Versions: descreekert wx-discuz versions prior to 12bd4745c63ec203cb32119bf77ead4a923bf277 Description: A vulnerability exists in the validToken function of the /wx.php file. Manipulation of the echostr argument can lead to cross-site scripting. The...

CVE-2025-7577

A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16. It has been classified as problematic. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The complexity of an attack is rather...

CVE-2025-7523

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-7565 LB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosure

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possib...

CVE-2025-7528

A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14408. Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit ha...

CVE-2025-7523 Jinher OA DelTemp.aspx xml external entity reference

A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has bee...

CVE-2025-7165

A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely...

CVE-2025-7156

The CVE-2025-7156 entry concerns hitsz-ids airda 0.0.3. The vulnerable element is the execute function in /v1/chat/completions, where manipulating the question parameter triggers an SQL injection. This is exploitable remotely and has public disclosure. Multiple connected sources corroborate the i...

CVE-2025-7139 SourceCodester Best Salon Management System Update Customer Details Page edit-customer-detailed.php cross site scripting

A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /panel/edit-customer-detailed.php of the component Update Customer Details Page. The manipulation of the argument Name leads to...

CVE-2025-7122 Campcodes Complaint Management System index.php sql injection

A vulnerability was found in Campcodes Complaint Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has...