Tenda AC7 Buffer Overflow Vulnerability

Tenda AC7 is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in Tenda AC7 version 15.03.06.44, which originates from the function formSetMacFilterCfg in the file /goform/setMacFilterCfg that fails to correctly validate the length and size of the input data,...

WeGIA SQL Injection Vulnerability (CNVD-2025-17269)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the /html/saude/profilepaciente.php endpoint idfuncionario parameter. An attacker could exploit this vulnerability...

WeGIA Cross-Site Scripting Vulnerability (CNVD-2025-17259)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the adicionarraca.php endpoint raca parameter, no details of the vulnerability are provided at this time...

Microsoft Azure DevOps Elevation of Privilege Vulnerability

Microsoft Azure DevOps is a team collaboration services platform from Microsoft Corporation USA. Microsoft Azure DevOps has a security vulnerability that can be exploited by an attacker to potentially cause elevation of privilege...

Code Execution Vulnerabilities in Multiple Mozilla Products (CNVD-2025-20065)

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A code execution vulnerability exists in multiple Mozilla products, whic...

MB CONNECT LINE mbNET.mini Operating System Command Injection Vulnerability

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from an operating system command injection vulnerability that stems from improper...

WordPress bSecure plugin elevation of privilege vulnerability

WordPress bSecure plugin is a plugin used to enhance the security of the website, mainly for the payment page of GiveWP to provide security features. An elevation of privilege vulnerability exists in the WordPress bSecure plugin, which stems from a lack of authorization in the orderinfo REST...

Tenda FH451 formSafeEmailFilter Function Buffer Overflow Vulnerability

The Tenda FH451 is a router from the Chinese company Tenda. The Tenda FH451 version 1.0.0.9 suffers from a buffer overflow vulnerability that originates from a failure to properly validate the length of the input data for the parameter page in the file /goform/SafeEmailFilter, which can be...

GNU Binutils bfd_elf_set_group_contents function buffer overflow vulnerability

GNU Binutils is a set of open source tools for working with binaries such as target files, executables, libraries, etc., mainly used in the areas of compilation, debugging, reverse engineering and so on. A buffer overflow vulnerability exists in GNU Binutils, which stems from the failure of the...

WordPress Orion Login with SMS plugin authentication bypass vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An authentication bypass vulnerability exists in the WordPress Orion Login with SMS plugin, which stems from an insufficiently strong OTP value for the olwshandleverifyphone...

Microsoft Azure Machine Learning Elevation of Privilege Vulnerability

Microsoft Azure Machine Learning is a machine learning services platform from Microsoft USA. Microsoft Azure Machine Learning has a security vulnerability that can be exploited by an attacker to potentially cause elevation of privilege...

MB CONNECT LINE mbNET.mini OS Command Injection Vulnerability (CNVD-2025-21143)

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from an operating system command injection vulnerability that stems from improper...

Apartment Visitors Management System pass-details.php file cross-site scripting vulnerability

Apartment Visitors Management System is an apartment visitor management system. Apartment Visitors Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the parameter visname in the file...

D-Link DI-8100 Buffer Overflow Vulnerability

The D-Link DI-8100 is a broadband router from D-Link designed for small to medium-sized network environments. It supports 4 Internet ports and 4 LAN ports, and utilizes a network-specific processor to meet the needs of 80 devices for simultaneous networking. The D-Link DI-8100 suffers from a buff...

Apartment Visitors Management System bwdates-reports.php file cross-site scripting vulnerability

Apartment Visitors Management System is an apartment visitor management system. Apartment Visitors Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter visname in the file...

Zoom Clients Cross-Site Scripting Vulnerability

Zoom Clients is a multi-platform video conferencing client application developed by Zoom Inc. for video conferencing, online collaboration and other functions. A cross-site scripting vulnerability exists in Zoom Clients, which can be exploited by attackers to cause information leakage...

Tenda FH451 formPPTPUserSetting function buffer overflow vulnerability

Tenda FH451 is a single-band 2.4GHz SOHO wireless router launched by China Tenda, with a maximum transmission rate of 450Mbps, belonging to the series of products of the King of Wall Penetration. The Tenda FH451 suffers from a buffer overflow vulnerability, which originates from the failure to...

Tenda FH451 formPPTPDClient function buffer overflow vulnerability

Tenda FH451 is a single-band 2.4GHz SOHO wireless router launched by China Tenda, with a maximum transmission rate of 450Mbps, belonging to the series of products of the King of Wall Penetration. The Tenda FH451 suffers from a buffer overflow vulnerability, which originates from the parameter...

WordPress Ajax Load More plugin license issue vulnerability

WordPress Ajax Load More plugin is an open source plugin , mainly used to achieve infinite scrolling of website content and lazy loading function , optimize the user experience through AJAX technology . WordPress Ajax Load More plugin has an authorization issue vulnerability, the vulnerability...

WeGIA Cross-Site Scripting Vulnerability (CNVD-2025-17266)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the personalizacaoselecao.php endpoint nomecar parameter, for which no detailed vulnerability details are...

D-Link DIR-817L Command Injection Vulnerability

D-Link DIR-817L is a home-grade dual-band wireless router from D-Link that supports IEEE 802.11ac standard with dual-band concurrency 2.4GHz/5GHz and a maximum wireless transmission rate of 750Mbps. A command injection vulnerability exists in the D-Link DIR-817L, which stems from the failure of t...

Online Security Guards Hiring System Cross-Site Scripting Vulnerability

Online Security Guards Hiring System is an online security guard hiring system. Online Security Guards Hiring System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter searchdata in the file...

Church Donation System Tithes.php File SQL Injection Vulnerability

The Church Donation System is a system of church giving. The Church Donation System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter trcode in the file /members/Tithes.php. An attacker can exploit this...

Apartment Visitors Management System visitor-detail.php file cross-site scripting vulnerability

Apartment Visitors Management System is an apartment visitor management system. Apartment Visitors Management System has a cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the parameter visname in the file...

Zoom Clients for iOS Information Disclosure Vulnerability

Zoom Clients for iOS is Zoom's official video conferencing app for iOS devices e.g., iPhone, iPad, supporting meeting convening, screen sharing, chatting and other features for business office, distance learning and other scenarios. Zoom Clients for iOS has an information leakage vulnerability,...

Online Ordering System edit_product.php File Upload Vulnerability

Online Ordering System is an online ordering system. A file upload vulnerability exists in Online Ordering System that stems from a lack of valid validation of uploaded files by the parameter image in the file /admin/editproduct.php. No details of the vulnerability are available at this time...

WeGIA SQL Injection Vulnerability (CNVD-2025-17268)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the /html/funcionario/profiledependente.php endpoint iddependente parameter. An attacker could exploit this...

Zoom Clients for Windows Buffer Overflow Vulnerability

Zoom Clients for Windows is a video conferencing software client developed by Zoom Inc. for Windows operating systems. A buffer overflow vulnerability exists in Zoom Clients for Windows, which can be exploited by an attacker to cause a denial of service...

Church Donation System update_password_admin.php File SQL Injection Vulnerability

The Church Donation System is a system of church giving. The Church Donation System suffers from a SQL injection vulnerability that originates from the lack of validation of the parameter newpassword in the file /members/updatepasswordadmin.php against an externally entered SQL statement. An...

WeGIA Cross-Site Scripting Vulnerability (CNVD-2025-17253)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the parameter err in the file personalizacaoimagem.php, for which no detailed vulnerability details are...

Online Appointment Booking System addmanagerclinic.php File SQL Injection Vulnerability

Online Appointment Booking System is an online appointment booking system. Online Appointment Booking System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter clinic in the file /admin/addmanagerclinic.php...

MB CONNECT LINE mbNET.mini Resource Management Error Vulnerability

The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from a resource management error vulnerability that originates from exhausting critic...

TOTOLINK T6 dest parameter buffer overflow vulnerability

TOTOLINK T6 is a wireless dual-band router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK T6 version 4.1.5cu.748B20211015, which originates from the parameter dest of the recvSlaveStaInfo function of the MQTT service failing to correctly validate the...

Apartment Visitors Management System create-pass.php file cross-site scripting vulnerability

Apartment Visitors Management System is an apartment visitor management system. Apartment Visitors Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter visname in the file...

IBM Security QRadar Network Threat Analytics Resource Management Error Vulnerability

IBM Security QRadar Network Threat Analytics is an advanced network security analysis tool from International Business Machines IBM. A resource management error vulnerability exists in IBM Security QRadar Network Threat Analytics version 1.3.1 and prior versions, which stems from a resource...

WeGIA SQL Injection Vulnerability (CNVD-2025-17261)

WeGIA is a web manager for welfare organizations. WeGIA suffers from an SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter cargo in the /controle/control.php endpoint. An attacker can exploit this vulnerability to execute illeg...

WordPress Nginx Cache Purge Preload plugin code injection vulnerability

WordPress Nginx Cache Purge Preload plugin is a plugin for optimizing the loading speed of your website. The WordPress Nginx Cache Purge Preload plugin suffers from a code injection vulnerability that stems from insufficient cleanup of the HTTPREFERERER parameter in the nppppreloadcacheonupdate...

Zoom Workplace for Linux Improper Certificate Validation Vulnerability

Zoom Workplace for Linux is a Linux application for enterprise communication and collaboration, offering features such as video conferencing, online meetings, chat and mobile collaboration. Zoom Workplace for Linux suffers from an improper certificate validation vulnerability that can be exploite...

Tenda FH451 fromVirtualSer Function Buffer Overflow Vulnerability

The Tenda FH451 is a router from the Chinese company Tenda. A buffer overflow vulnerability exists in the Tenda FH451 version 1.0.0.9, which originates from the failure of the fromVirtualSer function in file /goform/VirtualSer to correctly validate the length of the input data for the parameter...

Open5GS Denial of Service Vulnerability (CNVD-2025-18570)

Open5GS is Open5GS open source an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS suffers from a denial of service vulnerability that can be exploited by an attacker to cause reachable assertions...

Microsoft Azure Machine Learning elevation of privilege vulnerability (CNVD-2025-17135)

Microsoft Azure Machine Learning is a machine learning services platform from Microsoft USA. Microsoft Azure Machine Learning has a security vulnerability that can be exploited by an attacker to potentially cause elevation of privilege...

Emby Windows Server Request Forgery Vulnerability

Emby Windows is a media playback application for the Windows platform developed by Emby LLC that supports Windows 10, 11 and later systems. Emby Windows suffers from a server-side request forgery vulnerability that stems from the server not implementing an adequate authentication mechanism to...

Code Execution Vulnerabilities in Multiple Mozilla Products (CNVD-2025-20058)

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A code execution vulnerability exists in multiple Mozilla products, whic...

D-Link DIR-816L Command Injection Vulnerability

The D-Link DIR-816L is a wireless router from China's AUO D-Link. A command injection vulnerability exists in the D-Link DIR-816L 2.06B01 and earlier versions, which stems from the lxmldbcsystem function in the environment variable handling component failing to properly filter construct command...

E-Commerce Site Cross-Site Request Forgery Vulnerability

E-Commerce Site is an e-commerce site. E-Commerce Site suffers from a cross-site request forgery vulnerability that stems from the WEB application not adequately verifying that a request is coming from a trusted user. No details of the vulnerability are available at this time...

Emby Windows Cross-Site Scripting Vulnerability

Emby Windows is a media playback application for the Windows platform developed by Emby LLC that supports Windows 10, 11 and later systems. Emby Windows suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied...

WordPress Shortcodes Ultimate plugin cross-site scripting vulnerability

WordPress Shortcodes Ultimate plugin is a plugin for WordPress that provides a rich set of visual component features that allow users to insert a wide range of pre-defined shortcodes such as buttons, accordions, image rotations, etc. into post editors, text widgets, or template files, helping to...

Tenda FH451 Buffer Overflow Vulnerability

The Tenda FH451 is a router from the Chinese company Tenda. The Tenda FH451 version 1.0.0.9 suffers from a buffer overflow vulnerability, which originates from the parameter PPW in the file /goform/WizardHandle that fails to correctly validate the length of the input data, which can be exploited ...

WeGIA Cross-Site Scripting Vulnerability (CNVD-2025-17254)

WeGIA is a web manager for welfare organizations. WeGIA suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the precadastroatendido.php endpoint, for which no detailed vulnerability details are currently available...

WordPress Funnel Builder by FunnelKit plugin SQL Injection Vulnerability

WordPress Funnel Builder by FunnelKit plugin is a professional sales funnel builder plugin for WordPress platform, which is mainly used to optimize the WooCommerce shopping process and increase the conversion rate. The WordPress Funnel Builder by FunnelKit plugin suffers from a SQL injection...