TOTOLINK CA600-PoE msg_process function Port parameter command injection vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the msgprocess function Port parameter failing to correctly filter construct command special characters, commands, etc. N...

PCMan FTP Server QUOTE Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the QUOTE command handler failing to properly validate the length of input data, which can be exploited by an attacker to cause a denial of service...

Tenda W20E formSetDebugCfg function module parameter command injection vulnerability

The Tenda W20E is a router from the Chinese company Tenda. The Tenda W20E suffers from a command injection vulnerability that stems from the failure of the formSetDebugCfg function module parameter to properly filter constructor command special characters, commands, etc. The vulnerability is caus...

Tenda RX2 Pro Security Bypass Vulnerability (CNVD-2025-13837)

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. A security bypass vulnerability exists in Tenda RX2 Pro version 16.03.30.14, which can be exploited by an attacker to cause access to the router and other network resources...

IBM i Trust Management Issues Vulnerabilities

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. IBM i is vulnerable to a trust management issue vulnerability that stems from improper handling of IBM i Netserver authentication, no details of the vulnerability are...

WordPress aBlocks plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress aBlocks plugin, which stems from the application's lack of effective filtering and escaping of user-supplied data, and n...

PCMan FTP Server MGET Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the MGET command handler failing to properly validate the length and size of input data, which can be exploited by an attacker to cause a denial of...

Unspecified Vulnerability in RT-Labs P-Net

RT-Labs P-Net is an open source PROFINET protocol stack from RT-Labs that enables standard communication between industrial devices and PROFINET controllers. A security vulnerability exists in RT-Labs P-Net version 1.0.1 and prior versions, which stems from an unchecked loop condition that can be...

PCMan FTP Server 'APPEND' Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. A buffer overflow vulnerability exists in PCMan FTP Server 'APPEND', which originates from the APPEND command handler failing to properly validate the length and size of input data, and can be exploited by an attacker to execute...

PCMan FTP Server HASH Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the HASH command handler failing to properly validate the length of input data, which can be exploited by an attacker to cause a denial of service...

PCMan FTP Server LIST Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the LIST command handler failing to correctly validate the length and size of input data, which can be exploited by an attacker to cause a denial of...

Nero Social Networking Site index.php File SQL Injection Vulnerability

Nero Social Networking Site is a social networking site. Nero Social Networking Site suffers from a SQL injection vulnerability that originates from the incorrect manipulation of multiple parameters in the file /index.php, which can be exploited by an attacker to execute illegal SQL commands to...

Samsung PENUP Access Control Error Vulnerability

Samsung PENUP is a digital painting application from the South Korean company Samsung SAMSUNG. Samsung PENUP is vulnerable to an Access Control Error vulnerability that stems from improper access control, no details of the vulnerability are provided at this time...

Tenda RX2 Pro ate Management Service Input Validation Error Vulnerability

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an input validation error vulnerability that stems from a lack of input validation in the ate management service, no details of the vulnerability are provided at this time...

Google Chrome Security Bypass Vulnerability (CNVD-2025-10056)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome prior to version 136.0.7103.59, which stems from insufficient data validation in DevTools, and can be exploited by an attacker to cause an access control bypass...

WordPress AHAthat plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress AHAthat plugin, which stems from the WEB application not adequately verifying that a request is coming from a...

TOTOLINK CA300-PoE Command Injection Vulnerability (CNVD-2025-10606)

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to correctly filter constructive command special characters, commands, etc., which...

Park Ticketing Management System HTML Injection Vulnerability

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from an HTML injection vulnerability that stems from the mishandling of the searchdata parameter in the normal-search.php file, resulting in an HTML injection attack. No details of the...

Huawei HarmonyOS Unauthorized Access Vulnerability

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from an unauthorized access vulnerability that stems from unauthorized access to the application lock module. An attacker can exploit the vulnerability to authenticate and access unauthorized resourc...

Art Gallery Management System SQL Injection Vulnerability

Art Gallery Management System is an art gallery management system. Art Gallery Management System has a SQL injection vulnerability, the vulnerability stems from improper operation of the parameter arttype in the file /admin/add-art-type.php, which can be exploited by an attacker to query a string...

Linux kernel memory leak vulnerability (CNVD-2025-10174)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory leak vulnerability that stems from nfcmrvli2cncisend not freeing the skb, which could lead to a memory leak. No details of the vulnerability...

Linux kernel null pointer dereference vulnerability (CNVD-2025-10178)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a null pointer dereference vulnerability that stems from a failure to check the transportadddevice return value in sasphyadd, which could result in a...

Siemens OZW Web Servers Code Execution and SQL Injection Vulnerability

The OZW device web server is used for remote monitoring of building controller devices, e.g. for monitoring heating control or air conditioning status. A code execution and SQL injection vulnerability exists in the Siemens OZW672 and OZW772 web servers, which can be exploited by an attacker to...

Zoom Workplace Cross-Site Scripting Vulnerability

Zoom Workplace is an AI-first collaboration platform from Zoom that integrates core features such as team communication, meetings, document collaboration, and a built-in AI Companion smart assistant to boost productivity. Zoom Workplace suffers from a cross-site scripting vulnerability that can b...

Linux kernel null pointer dereference vulnerability (CNVD-2025-10176)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a null pointer dereference vulnerability that stems from not verifying the validity of a decoder, which could lead to a null pointer dereference. An...

Linux kernel null pointer dereference vulnerability (CNVD-2025-10179)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a null pointer dereference vulnerability that stems from an unverified region HPA order that could lead to a null pointer dereference. An attacker cou...

Online Birth Certificate System /admin/bwdates-reports-details.php File SQL Injection Vulnerability

Online Birth Certificate System is an online birth certificate system. Online Birth Certificate System has a SQL injection vulnerability that originates from an incorrect manipulation of the parameter fromdate in the /admin/bwdates-reports-details.php file that results in SQL injection. No detail...

Park Ticketing Management System /profile.php File SQL Injection Vulnerability

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from a SQL injection vulnerability that stems from an incorrect manipulation of the parameter adminname in the /profile.php file that results in SQL injection. No details of the...

Linux kernel competitive conditions vulnerability (CNVD-2025-10175)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a competitive condition vulnerability that stems from nftables not releasing stream rule objects in a timely manner, which could lead to a memory leak...

Huawei HarmonyOS Unauthorized Access Vulnerability

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from an unauthorized access vulnerability that stems from unauthorized access to the application lock module. An attacker can exploit the vulnerability to authenticate and access unauthorized resourc...

Huawei HarmonyOS Permission Issues Vulnerability

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from a privilege issue vulnerability that stems from an improper implementation of the file system module's authentication logic, which can be exploited by an attacker to steal sensitive information ...

ChurchCRM EventEditor.php Page SQL Injection Vulnerability

ChurchCRM is an open source church management system. ChurchCRM suffers from a SQL injection vulnerability that stems from a time-based SQL blind injection vulnerability in the EID POST parameter of the EventEditor.php page. No detailed vulnerability details are provided at this time...

Emergency Ambulance Hiring Portal /admin/edit-ambulance.php File SQL Injection Vulnerability

Emergency Ambulance Hiring Portal is an emergency ambulance hiring portal. Emergency Ambulance Hiring Portal suffers from a SQL injection vulnerability that stems from improper handling of the parameter dconnum in the file /admin/edit-ambulance.php, no details of the vulnerability are available a...

Linux kernel use-after-release vulnerability (CNVD-2025-10177)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux kernel suffers from a post-release reuse vulnerability that stems from Bluetooth L2CAP post-release reuse, which could lead to arbitrary code execution. No detailed...

Siemens OZW Web Server Code Execution and SQL Injection Vulnerabilities (CNVD-2025-10579 )

The OZW device web server is used for remote monitoring of building controller devices, e.g. for monitoring heating control or air conditioning status. A code execution and SQL injection vulnerability exists in the Siemens OZW672 and OZW772 web servers, which can be exploited by an attacker to...

Notice Board System bwdates-reports-details.php File SQL Injection Vulnerability

Notice Board System is a bulletin board system. Notice Board System has a SQL injection vulnerability that stems from improper handling of the parameters fromdate/tomdate in the file /bwdates-reports-details.php. No details of the vulnerability are available at this time...

Company Visitor Management System /admin-profile.php File SQL Injection Vulnerability

Company Visitor Management System is a visitor management system. Company Visitor Management System is vulnerable to a SQL injection vulnerability that originates from an incorrect manipulation of the parameter adminname in the file /admin-profile.php that results in SQL injection. No details of...

Park Ticketing Management System normal-bwdates-reports-details.php file SQL injection vulnerability

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from a SQL injection vulnerability that stems from improper handling of the todate parameter in the normal-bwdates-reports-details.php file. An attacker could use this vulnerability to...

Park Ticketing Management System foreigner-bwdates-reports-details.php file SQL injection vulnerability

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from a SQL injection vulnerability that stems from improper handling of the todate parameter in the foreigner-bwdates-reports-details.php file. An attacker can exploit this vulnerabili...

Huawei HarmonyOS Information Disclosure Vulnerability

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from an information disclosure vulnerability that stems from insufficient protection of information in the media library module, which affects service confidentiality. No details of the vulnerability...

Huawei HarmonyOS Unauthorized Access Vulnerability (CNVD-2025-11077)

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from an unauthorized access vulnerability that originates from a web search command authentication module bypass. An attacker can exploit the vulnerability to authenticate and access unauthorized...

Employee Record Management System editmyeducation.php File SQL Injection Vulnerability

Employee Record Management System is an employee record management system. Employee Record Management System suffers from a SQL injection vulnerability that stems from incorrect manipulation of the parameter coursepg in the file /editmyeducation.php resulting in SQL injection. No details of the...

Online Birth Certificate System between-dates-report.php File SQL Injection Vulnerability

Online Birth Certificate System is an online birth certificate system. Online Birth Certificate System is vulnerable to a SQL injection vulnerability that stems from incorrect manipulation of the parameter fromdate in the file /admin/between-dates-report.php resulting in SQL injection. No details...

Teacher Subject Allocation Management System /search.php File SQL Injection Vulnerability

Teacher Subject Allocation Management System a teacher subject allocation management system. The Teacher Subject Allocation Management System is vulnerable to a SQL injection vulnerability that results from incorrect manipulation of the searchdata parameter in the file /admin/search.php. No detai...

Cyber Cafe Management System add-computer.php File SQL Injection Vulnerability

Cyber Cafe Management System is an internet cafe management system. Cyber Cafe Management System suffers from a SQL injection vulnerability that stems from incorrect manipulation of the parameter compname/comploc in the file add-computer.php resulting in SQL injection. No details of the...

Huawei HarmonyOS Improper Privilege Control Vulnerability

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from an Improper Privilege Control vulnerability that stems from improper privilege control in the Contacts module. No details of the vulnerability are available at this time...

Huawei HarmonyOS Out-of-Bounds Read Vulnerability

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from an out-of-bounds read vulnerability, no details of the vulnerability are provided at this time...

Huawei HarmonyOS Process Residency Vulnerability

Huawei HarmonyOS is an operating system from the Chinese company Huawei. Huawei HarmonyOS suffers from a process-resident vulnerability. No details of the vulnerability are available at this time...

Park Ticketing Management System foreigner-search.php File HTML Injection Vulnerability

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System has an HTML injection vulnerability that stems from improper handling of the searchdata parameter in the foreigner-search.php file. No details of the vulnerability are available at this time...

Curfew e-Pass Management System /admin/pass-bwdates-reports-details.php File SQL Injection Vulnerability

Curfew e-Pass Management System is an electronic pass management system. Curfew e-Pass Management System suffers from a SQL injection vulnerability that originates from an incorrect operation of the parameter fromdate in the /admin/pass-bwdates-reports-details.php file that results in SQL...