Mattermost Authorization Issues Vulnerability (CNVD-2025-09242)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from insufficient permissions validation, which can be exploited by an attacker to cause deletion of posts...

Moodle Authorization Issues Vulnerability

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from an authorization issue vulnerability that stems from an insufficient capability check, which can be...

Unspecified Vulnerability in Moodle

Moodle is a free e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle, which stems from a lack of a checking mechanism that can be exploited by an attacker to delete sections o...

Art Gallery Management System aboutus.php File SQL Injection Vulnerability

Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter pagetitle in the file /admin/aboutus.php. An attacker can...

Apache HttpClient Logic Error Vulnerability

Apache HttpClient is the United States Apache Apache Foundation of a Java written to access HTTP resources client program. The program is used to access network resources using the HTTP protocol. A logic error vulnerability exists in Apache HttpClient versions prior to 5.4.3, which stems from a P...

Prison Management System Stack Buffer Overflow Vulnerability

Prison Management System is a prison management system. Prison Management System suffers from a stack buffer overflow vulnerability that originates from the parameter filename of the addrecord function in the PrisonMgmtSys component that fails to properly validate the length of the input data,...

Unspecified Vulnerability in Moodle

Moodle is a free e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle, which stems from an insufficient message service capability check, and can be exploited by an attacker to...

Delta Electronics ISPSoft Stack Buffer Overflow Vulnerability (CNVD-2025-12375)

Delta Electronics ISPSoft is a programmable logic controller PLC programming software from Delta Electronics. A stack buffer overflow vulnerability exists in Delta Electronics ISPSoft, which can be exploited by an attacker to execute arbitrary code using debugging logic when parsing CBDGL files...

Delta Electronics ISPSoft Out-of-Bounds Write Vulnerability (CNVD-2025-12373)

Delta Electronics ISPSoft is a programmable logic controller PLC programming software from Delta Electronics. An out-of-bounds write vulnerability exists in Delta Electronics ISPSoft, which can be exploited by an attacker to execute arbitrary code while parsing a DVP file...

Delta Electronics ISPSoft Stack Buffer Overflow Vulnerability

Delta Electronics ISPSoft is a programmable logic controller PLC programming software from Delta Electronics. A stack buffer overflow vulnerability exists in Delta Electronics ISPSoft, which can be exploited by an attacker to execute arbitrary code while parsing a DVP file...

SonicWall SMA1000 Cross-Site Request Forgery Vulnerability

The SonicWALL SMA1000 is a series of secure mobile access solutions from SonicWALL USA. The SonicWALL SMA1000 suffers from a cross-site request forgery vulnerability that originates from a server-side request forgery on the interface under certain conditions, which can be exploited by an attacker...

Moodle Cross-Site Request Forgery Vulnerability (CNVD-2025-09236)

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site request forgery vulnerability that stems from the lack of an anti-cross-site request forgery...

Student Record System change-password.php File SQL Injection Vulnerability

Student Record System is a software application. Student Record System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter currentpassword in the file /change-password.php. An attacker can exploit this...

Moodle Information Disclosure Vulnerability

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from an information disclosure vulnerability that stems from the fact that anonymous assignment submissions can...

Unauthorized Access Vulnerability in NetDrive Unified Communications Platform of Beijing NetDrive Network Technology Co.

NetDrive Unified Communications Platform is a comprehensive communications platform designed to enhance users' communication efficiency and convenience and provide a unified communications environment. An unauthorized access vulnerability exists in NetDrive Unified Communications Platform of...

COVID19 Testing Management System profile.php File SQL Injection Vulnerability

The COVID19 Testing Management System is a new crown pneumonia testing management system. COVID19 Testing Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter mobilenumber in file /profile.ph...

TOTOLINK N150RT home.htm cross-site scripting vulnerability

The TOTOLINK N150RT is a high power wireless router device. TOTOLINK N150RT suffers from a cross-site scripting vulnerability that originates from the parameter Comment in the file /home.htm, no details of the vulnerability are provided at this time...

Online Class and Exam Scheduling System class_sched.php file cross-site scripting vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. A cross-site scripting vulnerability exists in Online Class and Exam Scheduling System, which stems from a lack of validation of the class parameter in the file /Scheduling/pages/classsched.php against an...

TOTOLINK A830R Command Injection Vulnerability (CNVD-2025-09866)

The TOTOLINK A830R is a wireless dual-band router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK A830R version V4.1.2cu.5182B20201102, which stems from the failure of the NoticeUrl parameter in the setNoticeCfg function to correctly filter constructed...

TOTOLINK A810R setParentalRules function buffer overflow vulnerability

The TOTOLINK A810R is a wireless dual-band router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK A810R version V4.1.2cu.5182B20201026, which stems from the startTime and endTime parameters in the setParentalRules function failing to correctly validate t...

Tenda AC9 /goform/WifiWpsStart Interface Buffer Overflow Vulnerability

Tenda AC9 is a wireless router from Tenda, a Chinese company. The Tenda AC9 suffers from a buffer overflow vulnerability that originates from /goform/WifiWpsStart failing to properly validate the length and size of input data, which can be exploited by an attacker to execute arbitrary code on the...

Tenda AC9 /goform/SetSysAutoRebbotCfg Interface Buffer Overflow Vulnerability

Tenda AC9 is a wireless router from Tenda, a Chinese company. The Tenda AC9 suffers from a buffer overflow vulnerability that originates from the rebootTime parameter of /goform/SetSysAutoRebbotCfg that fails to properly validate the length of the input data, which can be exploited by an attacker...

Tenda AC9 /goform/WifiBasicSet Interface Buffer Overflow Vulnerability

Tenda AC9 is a wireless router from Tenda, a Chinese company. A buffer overflow vulnerability exists in Tenda AC9 version V15.03.05.14multi, which originates from the /goform/WifiBasicSet security parameter that fails to properly validate the length of the input data, and can be exploited by a...

TOTOLINK A800R v25 Parameter Buffer Overflow Vulnerability

TOTOLINK A800R is a wireless router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK A800R version V4.1.2cu.5137B20200730, which stems from the v25 parameter in downloadFile.cgi failing to correctly validate the length size of the input data, and can be...

TOTOLINK A800R v14 Parameter Buffer Overflow Vulnerability

The TOTOLINK A800R is a wireless router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK A800R version V4.1.2cu.5137B20200730, which stems from the v14 parameter in downloadFile.cgi failing to properly validate the length and size of the input data, and c...

IBM InfoSphere Information Server Plaintext Transfer Vulnerability

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A plaintext transfer vulnerability exists in IBM InfoSphere Information Server version 11.7, whi...

IBM InfoSphere Information Server Access Control Error Vulnerability

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. An access control error vulnerability exists in IBM InfoSphere Information Server version 11.7,...

TOTOLINK A810R Buffer Overflow Vulnerability (CNVD-2025-09863)

TOTOLINK A810R is a wireless dual-band router from China's Gion Electronics TOTOLINK. The TOTOLINK A810R suffers from a buffer overflow vulnerability, which stems from the v25 parameter in downloadFile.cgi failing to properly validate the length and size of the input data, which can be exploited ...

TOTOLINK A800R downloadFile.cgi Component Buffer Overflow Vulnerability

TOTOLINK A800R is a wireless router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK A800R version V4.1.2cu.5137B20200730, which stems from a security issue in the downloadFile.cgi component, and can be exploited by remote attackers to execute arbitrary...

TOTOLINK A800R Command Injection Vulnerability (CNVD-2025-09933)

TOTOLINK A800R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A800R suffers from a command injection vulnerability that stems from the QUERYSTRING parameter in downloadFile.cgi failing to correctly filter constructed command special characters, commands, and so on. No...

IBM InfoSphere Information Server Information Disclosure Vulnerability (CNVD-2025-09278)

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. An information disclosure vulnerability exists in IBM InfoSphere Information Server version 11.7...

IBM Operational Decision Manager Cross-Site Scripting Vulnerability

IBM Operational Decision Manager is a decision management solution from International Business Machines IBM used to help organizations better manage and enforce business rules and decisions. IBM Operational Decision Manager suffers from a cross-site scripting vulnerability that stems from the...

Information Disclosure Vulnerability in Logger1000 of Sunny Power Co.

Logger1000 is a data acquisition, power control and protocol conversion device for inverters and other photovoltaic equipment in photovoltaic power plants. Information leakage vulnerability exists in Logger1000 of Sunny Power Co. and can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in U8 Cloud of UFIDA Network Technology Co.

U8 Cloud is a digital platform for enterprises to go to the cloud, integrating transactions, services and management into a total ERP solution. A SQL injection vulnerability exists in UFIDA U8 Cloud, which can be exploited by attackers to gain access to sensitive database information...

Command Execution Vulnerability in MaxKB at Hangzhou Feizhiyun Information Technology Co.

MaxKB is an open source knowledge base Q&A system based on big language model and RAG under Hangzhou Feizhiyun Information Technology Co. MaxKB has a command execution vulnerability that can be exploited by attackers to execute commands...

File Upload Vulnerability in Multi-service Intelligent Gateway of Resconda Technology Development Co.

Focusing on the field of fiber optic broadband access, Riseconda Technology Development Co., Ltd. is committed to the convergence of fiber optic technology, Ethernet technology and broadband access technology. A file upload vulnerability exists in the Multi-service Intelligent Gateway of Risconda...

Rail Pass Management System /admin/search-pass.php File SQL Injection Vulnerability

Rail Pass Management System is a rail pass management system. The Rail Pass Management System suffers from a SQL injection vulnerability that occurs when the searchdata parameter in the /admin/search-pass.php file is not properly filtered. An attacker can exploit this vulnerability to obtain...

Dell PowerProtect Data Manager Reporting Information Disclosure Vulnerability

Dell PowerProtect Data Manager Reporting is a data protection management software. An information disclosure vulnerability exists in Dell PowerProtect Data Manager Reporting, which arises from the program's failure to properly handle template input and can be exploited by an attacker to obtain...

Siemens OpenV2G Buffer Overflow Vulnerability

Siemens OpenV2G is an open source implementation of a V2G infrastructure component from Siemens, Germany. A buffer overflow vulnerability exists in Siemens OpenV2G. The vulnerability is due to a lack of length checking by the OpenV2G EXI parsing function when parsing X509 serial numbers. An...

TOTOLINK N150RT Command Injection Vulnerability (CNVD-2025-09944)

The TOTOLINK N150RT is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK N150RT suffers from a command injection vulnerability that stems from the parameter localPin in the file /boafrm/formWsc failing to correctly filter constructed command special characters, commands, and ...

Binary Vulnerability in Damon New Cloud Cache Database of Wuhan Damon Database Co.

Damon New Cloud Cache Database is a self-developed Key-Value database that is deeply compatible with native Redis. A binary vulnerability exists in the Damon New Cloud Cache Database of Wuhan Damon Database Co. Ltd, which can be exploited by attackers to cause a denial of service...

WordPress Plugin Aeropage Sync for Airtable Has Unspecified Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

JetBrains TeamCity Path Traversal Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A path traversal vulnerability exists in JetBrains...

ZTE GoldenDB Input Validation Vulnerability

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. An input validation vulnerability exists in ZTE GoldenDB, which can be...

WordPress Add Google +1 plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Add Google...

WordPress plugin Able Player cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Able Playe...

WordPress Plugin 1 Decembrie 1918 Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site scripting...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2025-09283)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from International Business Machines IBM. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for...

ZTE GoldenDB Denial of Service Vulnerability

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. A security vulnerability exists in ZTE GoldenDB, which can be exploited ...

ZTE GoldenDB Access Control Error Vulnerability

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. An Access Control Error vulnerability exists in ZTE GoldenDB, which stem...