131391 matches found
Apple macOS Sequoia has an unspecified vulnerability (CNVD-2025-18408)
Apple macOS Sequoia is an operating system from the American company Apple Apple. A security vulnerability exists in Apple macOS Sequoia, which can be exploited by an attacker to cause a sandboxed process to bypass sandboxing restrictions...
GLPI Cross-Site Scripting Vulnerability (CNVD-2025-17793)
GLPI is a free asset and IT management software suite. A phishing attack vulnerability exists in GLPI versions 9.1.0 through 10.0.18, which stems from a planning feature that does not effectively filter malicious links sent by unauthenticated users. An attacker could use this vulnerability to...
Apple macOS Sequoia has an unspecified vulnerability (CNVD-2025-18403)
Apple macOS Sequoia is an operating system from the American company Apple Apple. A security vulnerability exists in Apple macOS Sequoia versions prior to 15.6 that stems from insufficient authentication and can be exploited by an attacker to cause access to sensitive user data...
Unspecified vulnerability in Apple macOS Sequoia and Apple macOS Sonoma (CNVD-2025-18416)
Apple macOS Sequoia and Apple macOS Sonoma are both operating systems from the American company Apple. Apple macOS Sequoia and Apple macOS Sonoma contain a security vulnerability that can be exploited by attackers to gain root privileges...
Unspecified Vulnerability in Apple macOS (CNVD-2025-22274)
Apple macOS is a specialized operating system developed by Apple for Mac computers. Apple macOS has a security vulnerability that can be exploited by an attacker to break through sandbox restrictions...
Apple macOS input validation error vulnerability
Apple macOS is a specialized operating system developed by Apple for Mac computers. Apple macOS suffers from an input validation error vulnerability that can be exploited by an attacker to gain access to sensitive user data...
Unspecified Vulnerability in Apple macOS (CNVD-2025-22272)
Apple macOS is a specialized operating system developed by Apple for Mac computers. Apple macOS has a security vulnerability that can be exploited by an attacker to cause an application to break through sandboxing restrictions...
Apple macOS Sequoia has an unspecified vulnerability (CNVD-2025-18409)
Apple macOS Sequoia is an operating system from the American company Apple Apple. A security vulnerability exists in Apple macOS Sequoia, which stems from an insufficient check, and can be exploited by an attacker to cause a process memory leak when processing malicious images...
Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-18563)
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...
Online Farm System register.php File SQL Injection Vulnerability
Online Farm System is an online farm system. Online Farm System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Username in the file /register.php. An attacker can exploit this vulnerability to execute...
Apple macOS Sequoia has an unspecified vulnerability (CNVD-2025-18401)
Apple macOS Sequoia is an operating system from the American company Apple Apple. A security vulnerability exists in Apple macOS Sequoia versions prior to 15.6, which can be exploited by attackers to access sensitive user data...
Unspecified Vulnerability in Apple macOS (CNVD-2025-18454)
Apple macOS is a specialized operating system developed by Apple for Mac computers. Apple macOS has a security vulnerability that can be exploited by attackers to access protected user data...
Google Chrome post-release reuse vulnerability (CNVD-2025-20470)
Google Chrome is a free web browser developed by Google. It is the world's largest browser in terms of market share due to its speed, security, simplicity, multi-platform support and built-in privacy protection. Google Chrome suffers from a post-release reuse vulnerability that stems from a...
Bank Locker Management System Session Hijacking Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a session hijacking vulnerability that stems from improper session invalidation of the component /banker/change-password.php. No detailed vulnerability details are available at this time...
Unspecified Vulnerability in FileBrowser
FileBrowser is an open source web file browser . Provides a file management interface in a specified directory , can be used to upload , delete , preview , rename and edit your files . FileBrowser has a security vulnerability that stems from a flaw in the authentication system that can be exploit...
Exam Form Submission update_s3.php File SQL Injection Vulnerability
Exam Form Submission is an exam form. Exam Form Submission has a SQL injection vulnerability that stems from improper handling of the credits parameter in the /admin/updates3.php file. No details of the vulnerability are provided at this time...
NETGEAR XR300 Stack Buffer Overflow Vulnerability
The NETGEAR XR300 is the entry-level Nighthawk Pro Gaming series wireless router from NETGEAR. The NETGEAR XR300 suffers from a stack buffer overflow vulnerability that stems from a stack buffer overflow in the HTTPD service when processing a POST request from the usbdevice.cgi endpoint, no detai...
MedDream PACS Premium cecho.php Function Server-Side Request Forgery Vulnerability
MedDream PACS Premium is an enterprise-class image storage and management server suite from MedDream. A server-side request forgery vulnerability exists in the MedDream PACS Premium cecho.php function, and no detailed vulnerability details are available at this time...
WordPress WebinarIgnition Authentication Bypass Vulnerability
WordPress WebinarIgnition is an open source plugin for WordPress that focuses on creating real-time interactive webinars. WordPress WebinarIgnition suffers from an authentication bypass vulnerability that stems from a lack of capability checking, which can be exploited by an attacker to generate...
TOTOLINK X6000R Command Injection Vulnerability
TOTOLINK X6000R is a WiFi 6 technology-enabled wireless router from China's Gion Electronics TOTOLINK with high concurrent connections and dual-band transmission. The TOTOLINK X6000R suffers from a command injection vulnerability that stems from not strictly filtering tz parameters. No detailed...
WordPress Dataverse Integration Missing Authorization Vulnerability
WordPress Dataverse Integration is a plugin mainly used to connect WordPress with Dataverse to achieve two-way data synchronization and business application integration. WordPress Dataverse Integration suffers from a lack of authorization vulnerability, which stems from a lack of authorization...
WordPress WPBakery Page Builder for WordPress Cross-Site Scripting Vulnerability
WordPress WPBakery Page Builder for WordPress is a powerful visual page builder plugin for the WordPress platform, providing an intuitive drag-and-drop interface and a wealth of preset templates, so that non-professional developers can quickly build responsive websites. WordPress WPBakery Page...
WordPress muse.ai video embedding cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress muse.ai video embedding, which stems from insufficient input cleanup and output escaping, and can be exploited by a...
Tenda AC8V4 Buffer Overflow Vulnerability (CNVD-2025-17343)
The Tenda AC8V4 is a wireless router from Tenda China. Tenda AC8V4 suffers from a buffer overflow vulnerability that originates from a stack buffer overflow in the shareSpeed parameter in /goform/WifiGuestSet, no detailed vulnerability details are provided at this time...
WordPress Station Pro Cross-Site Scripting Vulnerability
WordPress Station Pro is a plugin designed for the WordPress platform, mainly used to enhance the functionality of the website and provide audio streaming management solutions. WordPress Station Pro suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and...
WordPress Voltax Video Player Cross-Site Scripting Vulnerability
WordPress Voltax Video Player is a video plugin for the WordPress platform, developed by Minute Media, which is mainly used to embed videos and playlists from Minute Media's online video platform into WordPress websites. WordPress Voltax Video Player suffers from a cross-site scripting...
WordPress Post Grid Master Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Post Grid Master, which stems from insufficient input cleanup and output escaping, and can be exploited by an...
WordPress structured content cross-site scripting vulnerability
WordPress structured content is a technology that improves search result display and click-through rates by optimizing semantic markup of web page elements e.g., titles, descriptions, images, etc. to enhance search engine understanding of page content. A cross-site scripting vulnerability exists ...
WordPress hiWeb Export Posts Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress hiWeb Export Posts, which stems from missing or incorrect random number validation, and can be exploited by a...
MedDream PACS Premium Access Control Error Vulnerability
MedDream PACS Premium is an enterprise-class image storage and management server suite from MedDream. MedDream PACS Premium suffers from an Access Control Error vulnerability that is caused by an error in the login.php function. An attacker can exploit the vulnerability to elevate privileges...
HCL IEM Information Disclosure Vulnerability (CNVD-2025-20021)
HCL IEM is an intelligent event management platform from HCL India. HCL IEM suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
WordPress ebook store cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress ebook store, which stems from a lack of file type validation in the ebookstoresaveform function and can be exploite...
Small CRM Session Hijacking Vulnerability
Small CRM is a customer relationship management system. Small CRM suffers from a session hijacking vulnerability that stems from the /crm/change-password.php component not terminating a session properly. No details of the vulnerability are available at this time...
IBM Db2 for Linux Buffer Overflow Vulnerability
IBM Db2 for Linux is a relational database management system from IBM. A stack-based buffer overflow vulnerability exists in IBM Db2 for Linux versions 12.1.0, 12.1.1, and 12.1.2, which stems from the db2fm component not adequately checking boundaries. A local user can exploit this vulnerability ...
JetBrains TeamCity Cross-Site Scripting Vulnerability
JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from a cross-site scripting vulnerability that stems from the presence of reflective cross-site scripting on the...
JetBrains TeamCity Information Disclosure Vulnerability (CNVD-2025-22935)
JetBrains TeamCity is a Continuous Integration/Continuous Deployment CI/CD tool developed by JetBrains to automate the software build, test, and deployment process with support for multiple programming languages and tools. JetBrains TeamCity suffers from an information disclosure vulnerability th...
NETGEAR XR300 Stack Buffer Overflow Vulnerability (CNVD-2025-20497)
The NETGEAR XR300 is the entry-level Nighthawk Pro Gaming series wireless router from NETGEAR. The NETGEAR XR300 suffers from a stack buffer overflow vulnerability that stems from a stack buffer overflow in the HTTPD service when processing a POST request from the usbdevice.cgi endpoint, no detai...
NETGEAR XR300 Stack Buffer Overflow Vulnerability (CNVD-2025-20496)
The NETGEAR XR300 is the entry-level Nighthawk Pro Gaming series wireless router from NETGEAR. The NETGEAR XR300 suffers from a stack buffer overflow vulnerability that stems from a stack buffer overflow in the HTTPD service when processing a POST request from the usbdevice.cgi endpoint, no detai...
WordPress Taeggie Feed Cross-Site Scripting Vulnerability
WordPress Taeggie Feed is a plugin on WordPress that is mainly used to integrate social media content into a website, supporting dynamic syndication on platforms like Facebook, Instagram, Twitter and LinkedIn. WordPress Taeggie Feed suffers from a cross-site scripting vulnerability that originate...
IBM DB2 for Linux Denial of Service Vulnerability
IBM Db2 for Linux is a relational database management system developed by IBM and designed for the Linux operating system to provide high-performance, highly reliable data storage and management services. A denial of service vulnerability exists in IBM DB2 for Linux, which can be exploited by an...
HCL IEM Information Disclosure Vulnerability (CNVD-2025-20023)
HCL IEM is an intelligent event management platform from HCL India. HCL IEM suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
Tenda AC8V4 Buffer Overflow Vulnerability (CNVD-2025-17344)
The Tenda AC8V4 is a wireless router from Tenda China. Tenda AC8V4 suffers from a buffer overflow vulnerability that originates from a stack buffer overflow in the timeZone parameter in /goform/fastsettingwifiset, no detailed vulnerability details are provided at this time...
Doctor Appointment Management System Session Hijacking Vulnerability
Doctor Appointment Management System is a doctor appointment management system. Doctor Appointment Management System suffers from a session hijacking vulnerability that stems from the /doctor/change-password.php component not properly terminating a session. No details of the vulnerability are...
JetBrains TeamCity Cross-Site Request Forgery Vulnerability
JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from a cross-site request forgery vulnerability that stems from a security flaw in the GitHub application connection...
JetBrains TeamCity Information Disclosure Vulnerability
JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from an information disclosure vulnerability that stems from an hg pull command line parameter resulting in an exposed...
WordPress Mine CloudVod Cross-Site Scripting Vulnerability
WordPress Mine CloudVod is a plugin for audio and video playback and online education management. WordPress Mine CloudVod suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and output escaping, which can be exploited by an attacker to inject malicious...
IBM Db2 Denial of Service Vulnerability (CNVD-2025-18013)
IBM Db2 is a relational database management system from IBM that supports a variety of operating systems, including Linux. A denial of service vulnerability exists in IBM Db2 for Linux versions 12.1.0, 12.1.1, and 12.1.2, which originates from executable segments waiting for each other to release...
WordPress Affiliate Plus Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress Affiliate Plus, which stems from missing or incorrect random number validation, and can be exploited by an...
FileBrowser Denial of Service Vulnerability
FileBrowser is an open source web file browser . Provides a file management interface in a specified directory , can be used to upload , delete , preview , rename and edit your files . FileBrowser has a denial of service vulnerability , the vulnerability stems from a flaw in the file handling log...
WordPress AI Engine Information Disclosure Vulnerability
WordPress AI Engine is a plugin based on OpenAI technology, which is mainly used to integrate artificial intelligence features into WordPress websites to improve the efficiency of content generation, automated operations and so on. WordPress AI Engine suffers from an information disclosure...