Kentico Xperience Authentication Bypass Vulnerability

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from an authentication bypass vulnerability that can be exploited by an attacker to cause control of managed objects...

Bank Locker Management System edit-locker.php?ltid=6 File SQL Injection Vulnerability

Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the lockersize parameter of the edit-locker.php?ltid=6 file. An attacker c...

Yonyou UFIDA ERP-NC /menu.jsp file cross-site scripting vulnerability

Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...

Bank Locker Management System search-report-details.php File SQL Injection Vulnerability

Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally-entered SQL statements in the searchinput parameter of the search-report-details.php file. An attacker ca...

Bank Locker Management System changeimage1.php File SQL Injection Vulnerability

Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter editid of the changeimage1.php file. An attacker can exploit...

Tenda AC7 Buffer Overflow Vulnerability

Tenda AC7 is a wireless router from Tenda, a Chinese company. The Tenda AC7 suffers from a buffer overflow vulnerability that originates from the formWifiBasicSet function failing to correctly validate the length and size of the input data, which can be exploited by an attacker to execute arbitra...

Yonyou UFIDA ERP-NC /help/systop.jsp file cross-site scripting vulnerability

Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability, whi...

Dell Secure Connect Gateway Information Disclosure Vulnerability

The Dell Secure Connect Gateway Dell SCG is a secure connectivity gateway from Dell, USA. The Dell Secure Connect Gateway suffers from an information disclosure vulnerability that originates when sensitive system information is exposed to an unauthorized control domain, which can be exploited by ...

GNU GRUB Buffer Overflow Vulnerability (CNVD-2025-08310)

GNU GRUB is a Linux system boot program from the GNU community. A buffer overflow vulnerability exists in GNU GRUB. The vulnerability stems from the romsfs module containing an integer overflow issue when handling symbolic links, resulting in a heap-based out-of-bounds write when reading data. No...

Siemens Teamcenter Visualization Buffer Overflow Vulnerability (CNVD-2025-09960)

Siemens Teamcenter Visualization is software that provides teamwork capabilities for designing 2D and 3D scenarios. The software simplifies the engineering and manufacturing process by creating virtual prototypes from a variety of mechanical computer-aided design MCAD formats.Siemens Tecnomatix...

Unspecified Vulnerability in SAP S/4HANA (CNVD-2025-08314)

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. A security vulnerability exists in SAP S/4HANA that stems from a lack of authorization checking, which could be exploited by an attacker to gain unauthorized access to...

GPT Academic Cross-Site Scripting Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a cross-site scripting vulnerability that stems from the Latex Proof-Reading Module's lack of effective filtering and escaping of user-supplied data, which ca...

Apple macOS Sequoia Information Disclosure Vulnerability

Apple macOS Sequoia is an operating system announced by Apple at the WWDC24 developer conference on June 10, 2024, with the official version launched in the fall of the same year, primarily for Mac devices, emphasizing cross-device collaboration and integration of AI functionality to significantl...

SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2025-07541)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. SAP Business Objects Business Intelligence Platform suffers from a cross-site scripting vulnerability that stems from the application's lack of effective...

GPT Academic Markdown_Translate.get_files_from_everything function server-side request forgery vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. A server-side request forgery vulnerability exists in the GPT Academic MarkdownTranslate.getfilesfromeverything function, which can be exploited by an attacker to cause unauthorized...

D-Link DIR-605L/DIR-618 formAdvNetwork Function Access Control Error Vulnerability

The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An Access Control Error vulnerability exists in the D-Link DIR-605L version 3.02 and the D-Link DIR-618 version 2.02, which stems from improper access control in the file /goform/formAdvNetwork, and can...

LibreChat groupid parameter access control error vulnerability

LibreChat is an enhanced ChatGPT clone. An Access Control Error vulnerability exists in versions of LibreChat prior to 0.7.6, which stems from the groupid parameter not verifying that the prompt ID provided belongs to the current user, and can be exploited by an attacker to cause the deletion of...

SAP CRM and SAP S/4HANA server-side request forgery vulnerability (CNVD-2025-07595)

SAP CRM and SAP S/4HANA are both products of SAP, a customer relationship management system, and SAP S/4HANA, an enterprise resource management software based on the SAP HANA in-memory database system. SAP CRM and SAP S/4HANA suffer from a server-side request forgery vulnerability, which stems fr...

D-Link DAP-1620 check_dws_cookie function stack buffer overflow vulnerability

The D-Link DAP-1620 is a wireless repeater extender from D-Link. The D-Link DAP-1620 suffers from a stack buffer overflow vulnerability that stems from the cookie handling component checkdwscookie function failing to properly validate the length and size of input data, which can be exploited by a...

lunary denial of service vulnerability (CNVD-2025-07601)

lunary is lunary open source a production toolkit for LLM . A denial of service vulnerability exists in lunary that stems from the use of insecure regular expressions in the /v1/checklists endpoint. An attacker can exploit this vulnerability to cause a denial of service...

D-Link DAP-1620 Stack Buffer Overflow Vulnerability

The D-Link DAP-1620 is a wireless repeater extender from D-Link. The D-Link DAP-1620 suffers from a stack buffer overflow vulnerability. The vulnerability stems from improper handling of the parameter uid and can be exploited by an attacker to trigger a denial of service or execute malicious code...

Remote Code Execution Vulnerability in Ingress NGINX Controller (CNVD-2025-05885)

Ingress NGINX Controller is an open source portal controller that uses NGINX as a reverse proxy and load balancer. Ingress NGINX Controller suffers from a remote code execution vulnerability that stems from the mirror-target and mirror-host Ingress annotations can be used to inject arbitrary...

Mattermost Authorization Issues Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from improper authorization of the Viewer role, which can be exploited by an attacker to still view team and site statistics...

Siemens SCALANCE LPE9403 SFTP Functional Path Traversal Vulnerability

Siemens SCALANCE LPE9403 is a local processing engine for industrial field data processing from Siemens. It is used to capture, collect and pre-process industrial field data. A path traversal vulnerability exists in Siemens SCALANCE LPE9403 6GK5998-3GS00-2AC2 V4.0 and earlier versions, which stem...

IBM InfoSphere Information Server Authorization Issues Vulnerability (CNVD-2025-06810)

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. An authorization issue vulnerability exists in IBM InfoSphere Information Server version 11.7 th...

lunary access control error vulnerability (CNVD-2025-07600)

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from improper access control on the /prompts/promptid endpoint, and no detailed vulnerability details are provided at this time...

lunary /users/me/org endpoint improper authorization vulnerability

lunary is lunary open source a production toolkit for LLM . An improper authorization vulnerability exists in lunary, which stems from an insufficient access control mechanism at the /users/me/org endpoint, and can be exploited by an attacker to obtain sensitive information...

D-Link DIR-605L/DIR-618 formSetPortTr Function Access Control Error Vulnerability

The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An Access Control Error vulnerability exists in the D-Link DIR-618 version 2.02 and the D-Link DIR-605L version 3.02, which stems from improper access control in the file /goform/formSetPortTr, and can ...

HDF5 H5T__bit_copy function buffer overflow vulnerability

HDF5 is a library of HDF open source . HDF5 has a buffer overflow vulnerability , the vulnerability stems from the H5Tbitcopy function fails to correctly validate the length of the input data size , an attacker can use this vulnerability to cause a denial of service...

Art Gallery Management System view-enquiry-detail.php File SQL Injection Vulnerability

Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of the viewid parameter of /admin/view-enquiry-detail.php against an externally entered SQL statement. An attacke...

GPT Academic Open Redirect Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from an open redirection vulnerability that originates from a user redirecting to a URL specified by the user-controlled file parameter without proper validation o...

GPT Academic Resource Management Error Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a Resource Management Error vulnerability that stems from an excessive number of characters at the end of a multi-part boundary during a file upload that caus...

lunary information disclosure vulnerability (CNVD-2025-08308)

lunary is lunary open source a production toolkit for LLM . An information disclosure vulnerability exists in lunary that stems from a GET /projects API endpoint exposing all project public and private API keys to users with least privileges, which can be exploited by an attacker to obtain...

Tenda AC8 Stack Buffer Overflow Vulnerability (CNVD-2025-07606)

Tenda AC8 is a wireless router from Tenda, a Chinese company. The Tenda AC8 suffers from a stack buffer overflow vulnerability, which stems from the deviceid parameter in the getparentControllistInfo function failing to properly validate the length of the input data, which can be exploited by an...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-06305)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

lunary /v1/templates/{id}/versions endpoint access control error vulnerability

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary, which stems from improper access control in the /v1/templates/id/versions endpoint, and can be exploited by an attacker to modify any user's templates...

LiteLLM Resource Management Error Vulnerability

LiteLLM is a Berri AI open source application. All LLM APIs can be called using the OpenAI format. LiteLLM has a resource management error vulnerability that stems from an insecure parsing of user input in ast.literaleval, which can be exploited by an attacker to cause a denial of service...

Doctor Appointment Management System appointment-bwdates-reports-details.php file SQL injection vulnerability

Doctor Appointment Management System is a doctor appointment management system. Doctor Appointment Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter fromdate/todate of...

Unspecified vulnerability in Lunary (CNVD-2025-06939)

Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary version be54057 that stems from allowing users to upload and execute arbitrary regular expressions, which can be exploited by an attacker to potentially cause a denial of service...

D-Link DIR-605L/DIR-618 formSetDomainFilter Function Access Control Error Vulnerability

The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An access control error vulnerability exists in the D-Link DIR-618 version 2.02 and the D-Link DIR-605L version 3.02, which stems from improper access control in the file /goform/formSetDomainFilter, an...

Art Gallery Management System Cross-Site Scripting Vulnerability

Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter artname of /product.php, which can be exploited by...

Apache Commons VFS Information Disclosure Vulnerability

Apache Commons VFS is a public virtual file system from the Apache USA Foundation. Apache Commons VFS prior to version 2.10.0 suffers from an information disclosure vulnerability that stems from the FtpFileObject class that may disclose the original URI containing the password if the file is not...

Unspecified vulnerability in Lunary (CNVD-2025-06937)

Lunary is Lunary open source a production toolkit for LLM . Lunary has a security vulnerability that stems from improper privilege management, which can be exploited by an attacker to cause an administrator to bypass role controls to access billing information...

SAP Web Dispatcher and SAP Internet Communication Manager Log Information Disclosure Vulnerability

SAP Web Dispatcher and SAP Internet Communication Manager SAP ICM are both products of SAP, Germany. SAP Web Dispatcher is a core component of Load Balancing, which supports load balancing and provides reverse proxy functionality to enable external users to access internal applications. SAP...

Tenda i12 Buffer Overflow Vulnerability (CNVD-2025-08309)

The Tenda i12 is a Tenda Ceiling Mount Wireless Access Point from Tenda China. The Tenda i12 suffers from a buffer overflow vulnerability that originates from the ping1 parameter in the formSetAutoPing function failing to properly validate the length of the input data, which can be exploited by a...

Art Gallery Management System search.php File SQL Injection Vulnerability

Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Search of /search.php. An attacker can exploit this...

Mattermost Command Execution Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a command execution vulnerability that stems from unrestricted command execution in an archive channel, which can be exploited by an attacker to run commands in an archive chann...

Unspecified Vulnerability in LibreChat

LibreChat is an enhanced ChatGPT clone. LibreChat has a security vulnerability that stems from an unhandled exception that can be exploited by an attacker to cause a server crash...

SAP NetWeaver Server ABAP Information Disclosure Vulnerability (CNVD-2025-07609)

SAP NetWeaver Server ABAP is an application server from SAP Germany. An information disclosure vulnerability exists in SAP NetWeaver Server ABAP. The vulnerability stems from the server generating different responses depending on the presence or absence of a particular user, thereby disclosing...

lunary denial of service vulnerability (CNVD-2025-07604)

lunary is lunary open source a production toolkit for LLM . A denial of service vulnerability exists in lunary that stems from the use of an insecure regular expression in the compileTextTemplate function. An attacker can exploit this vulnerability to cause a denial of service...