131179 matches found
phpIPAM circuits options page cross-site scripting vulnerability
phpIPAM is phpIPAM open source set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in phpIPAM version 1.5.2, which stems from the lack of effective filtering and escaping of user-supplied data on the circuits options page, whi...
ChuanhuChatGPT File Containment Vulnerability
ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. A file inclusion vulnerability exists in ChuanhuChatGPT version d4ec6a3, which stems from the gr.JSON component not effectively filtering cal...
Microsoft Edge (Chromium-based) Update elevation of privilege vulnerability (CNVD-2025-23062)
Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. An elevation of privilege vulnerability exists in Microsoft Edge Chromium-based Update, which is caused by improper link resolution before file access. An attacker could exploit the...
Remote code execution vulnerability in Ingress NGINX Controller (CNVD-2025-05883)
Ingress NGINX Controller is an open source portal controller that uses NGINX as a reverse proxy and load balancer. Ingress NGINX Controller suffers from a remote code execution vulnerability that can be exploited by an attacker to gain access to sensitive data such as credentials and keys across...
Tenda AC7 Buffer Overflow Vulnerability (CNVD-2025-07593)
Tenda AC7 is a wireless router from Tenda, a Chinese company. The Tenda AC7 suffers from a buffer overflow vulnerability that originates from the timeZone parameter of the formfastsettingwifiset function failing to properly validate the length of the input data, which can be exploited by an...
SAP Business Objects Business Intelligence Platform Information Disclosure Vulnerability (CNVD-2025-07542)
SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. An information disclosure vulnerability exists in SAP Business Objects Business Intelligence Platform, which stems from the application's inadequate...
HDF5 H5MM_strndup function buffer overflow vulnerability
HDF5 is a library of HDF open source . HDF5 has a buffer overflow vulnerability , the vulnerability stems from the H5MMstrndup function fails to correctly validate the length of the input data size , an attacker can use this vulnerability to cause a denial of service...
ChuanhuChatGPT Access Control Error Vulnerability
ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. An access control error vulnerability exists in ChuanhuChatGPT version 20240802, which stems from improper handling of session data and lack ...
GPT Academic Denial of Service Vulnerability (CNVD-2025-22736)
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a denial of service vulnerability that stems from the use of insecure regular expressions. An attacker could exploit this vulnerability to cause a regular...
GPT Academic Denial of Service Vulnerability
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a denial of service vulnerability that can be exploited by an attacker to cause a regular expression denial of service attack...
GPT Academic Remote Code Execution Vulnerability
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a remote code execution vulnerability that stems from not properly validating a user-supplied RAR file, which can be exploited by an attacker to cause remote...
GPT Academic File Read Vulnerability
GPT Academic is an interface that provides pragmatic interactions for LLM large language models such as GPT/GLM. A file read vulnerability exists in GPT Academic, which stems from a failure of the HotReload feature to properly validate user input, and can be exploited by an attacker to read...
Apache Oozie Cross-Site Scripting Vulnerability
Apache Oozie is an application from the Apache Apache Foundation, USA. Provides a workflow scheduler system for managing Apache Hadoop job functions. Apache Oozie has a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied...
Art Gallery Management System contactus.php File SQL Injection Vulnerability
Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter pagetitle of /admin/contactus.php. An attacker can exploit...
Art Gallery Management System art-enquiry.php File SQL Injection Vulnerability
Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter eid of art-enquiry.php. An attacker can exploit this...
CicadasCMS Code Injection Vulnerability (CNVD-2025-06474)
CicadasCMS is a content management system. CicadasCMS code injection vulnerability can be exploited by attackers to conduct cross-site scripting attacks...
Unspecified vulnerability in Lunary (CNVD-2025-06940)
Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary version 105a3f6 that originates from allowing users to upload and execute arbitrary regular expressions, which can be exploited by an attacker to potentially cause a regular expression denial of...
Art Gallery Management System edit-art-product-detail.php file SQL Injection Vulnerability
Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter editide/sprice/description of...
LibreChat Denial of Service Vulnerability
LibreChat is an enhanced ChatGPT clone. LibreChat suffers from a denial of service vulnerability that can be exploited by an attacker to cause a server crash...
lunary access control error vulnerability (CNVD-2025-07602)
lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary, which stems from improper access control on the /v1/datasets endpoint, and can be exploited by an attacker to gain access to unauthorized datasets...
phpIPAM Device Management Partial Cross-Site Scripting Vulnerability
phpIPAM is phpIPAM open source set of open source PHP and MySQL based IP address management application IPAM. A cross-site scripting vulnerability exists in phpIPAM version 1.5.2, which stems from the lack of effective filtering and escaping of user-supplied data in the Device Management section,...
D-Link DIR-605L/DIR-618 formSetDDNS Function Access Control Error Vulnerability
The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An Access Control Error vulnerability exists in the D-Link DIR-618 version 2.02 and DIR-605L version 3.02, which stems from improper access control of the file /goform/formSetDDNS, and can be exploited ...
Pytorch-Lightning Code Issue Vulnerability
Pytorch-Lightning is an open source lightweight PyTorch wrapper from Lightning AI open source in the US. Used for high performance Ai research. Pytorch-Lightning suffers from a code issue vulnerability that stems from the application's lack of effective validation of uploaded files. An attacker c...
lunary authorization issue vulnerability (CNVD-2025-07603)
lunary is lunary open source a production toolkit for LLM . An authorization issue vulnerability exists in lunary that stems from the checklists.post endpoint not being properly privilege-validated and can be exploited by an attacker to cause unauthorized creation or modification of checklists...
Access control error vulnerability exists in Vite (CNVD-2025-05817)
Vite is Vite open source a new front-end building tools . Vite has an access control error vulnerability that can be exploited by an attacker to bypass the development server's protection mechanism and illegally access sensitive files outside the project root directory...
Remote code execution vulnerability in Ingress NGINX Controller (CNVD-2025-05884)
Ingress NGINX Controller is an open source portal controller that uses NGINX as a reverse proxy and load balancer. Ingress NGINX Controller suffers from a remote code execution vulnerability that can be exploited by an attacker to gain access to sensitive data such as credentials and keys across...
GPT Academic Access Control Error Vulnerability
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from an Access Control Error vulnerability that could be exploited by an attacker to cause unauthorized operations...
lunary access control error vulnerability (CNVD-2025-08306)
lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary, which stems from the PATCH /v1/runs/:id/score endpoint not implementing the access control mechanism correctly, and directly referencing data transmitted from the client as an objec...
GPT Academic crazy_utils.get_files_from_everything function server-side request forgery vulnerability
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. A server-side request forgery vulnerability exists in the GPT Academic crazyutils.getfilesfromeverything function, which can be exploited by an attacker to cause unauthorized access to...
Lunary /api/v1/data-warehouse/bigquery endpoint access control error vulnerability
Lunary is Lunary open source a production toolkit for LLM . Lunary suffers from an Access Control Error vulnerability that originates from the POST /api/v1/data-warehouse/bigquery endpoint without proper access control, which can be exploited by an attacker to obtain sensitive information...
ChuanhuChatGPT Security Bypass Vulnerability
ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a security bypass vulnerability that originates when a username is provided via a client-side HTTP request, which...
Unspecified vulnerability in Lunary (CNVD-2025-06938)
Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in lunary that stems from a user-created endpoint that does not restrict administrators from inviting users with billing roles, which can be exploited by an attacker to cause unauthorized access...
GPT Academic Denial of Service Vulnerability (CNVD-2025-22732)
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. A denial of service vulnerability exists in GPT Academic, which stems from a security issue in the file upload feature that can be exploited by an attacker to cause a denial of service...
ChuanhuChatGPT Authorization Issue Vulnerability
ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. An authorization issue vulnerability exists in the ChuanhuChatGPT c91dbfc version, which stems from the reboot server feature not being check...
ChuanhuChatGPT Denial of Service Vulnerability (CNVD-2025-06188)
ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a denial of service vulnerability that stems from the use of an insecure regular expression. An attacker can...
Fortinet FortiSOAR Code Injection Vulnerability (CNVD-2025-12797)
Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet. A code injection vulnerability exists in Fortinet FortiSOAR that stems from improper code generation controls and can be exploited by an attacker to cause arbitrary code to be executed...
Tenda AX12 Buffer Overflow Vulnerability (CNVD-2025-07607)
Tenda AX12 is a dual-band Gigabit Wifi 6 wireless router from Tenda China. The Tenda AX12 suffers from a buffer overflow vulnerability that originates from the sub42F69C function in /goform/setMacFilterCfg that fails to correctly validate the length of the input data, which can be exploited by an...
Fortinet FortiClientMAC Code Execution Vulnerability
Fortinet FortiClientMAC is a U.S. fly tower Fortinet company based on macOS platform security tools. A code execution vulnerability exists in Fortinet FortiClientMAC that originates from an external control of a file name or path, which can be exploited by a local attacker to execute arbitrary co...
lunary /v1/evaluators/endpoint access control error vulnerability
lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary, which stems from insufficient access control in /v1/evaluators/endpoints, and can be exploited by an attacker to obtain sensitive information...
Siemens SCALANCE LPE9403 Operating System Command Injection Vulnerability (CNVD-2025-09962)
Siemens SCALANCE LPE9403 is a local processing engine for industrial field data processing from Siemens. It is used to capture, collect and pre-process industrial field data. The Siemens SCALANCE LPE9403 6GK5998-3GS00-2AC2 suffers from an operating system command injection vulnerability that...
Art Gallery Management System edit-art-type-detail.php File SQL Injection Vulnerability
Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements for the parameter arttype in /admin/edit-art-type-detail.php?editid=1. An...
Apache Commons VFS Path Traversal Vulnerability
Apache Commons VFS is a public virtual file system from the Apache USA Foundation. A path traversal vulnerability exists in Apache Commons VFS versions prior to 2.10.0, which stems from a program's failure to properly filter for special elements in a resource or file path. An attacker could explo...
Art Gallery Management System add-art-product.php File SQL Injection Vulnerability
Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of the parameter arttype in /admin/add-art-product.php against externally entered SQL statements. An attacker can...
Logic Flaw Vulnerability in H3C Magic R3010 Gigabit Dual Band Wi-Fi 6 Router from Xinhua San Technology Co.
Xinhua San Technology Co., Ltd. is a global leader in digital solutions. A logic flaw vulnerability exists in the H3C Magic R3010 Gigabit Dual Band Wi-Fi 6 Router from Xinhua San Technologies Limited, which can be exploited by an attacker to gain control of the server...
Unspecified Vulnerability in Lunary
Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary versions prior to 1.5.9, which stems from a security issue in /v1/evaluators/endpoints, and can be exploited by an attacker to delete evaluator data, resulting in permanent data loss and potentia...
Siemens Teamcenter Visualization and Siemens Tecnomatix Plant Simulation Buffer Overflow Vulnerability (CNVD-2025-09959)
Siemens Teamcenter Visualization is software that provides teamwork capabilities for designing 2D and 3D scenarios. The software simplifies the engineering and manufacturing process by creating virtual prototypes from a variety of mechanical computer-aided design MCAD formats.Siemens Tecnomatix...
Remote Code Execution Vulnerability in Ingress NGINX Controller (CNVD-2025-05886)
Ingress NGINX Controller is an open source portal controller that uses NGINX as a reverse proxy and load balancer. Ingress NGINX Controller suffers from a remote code execution vulnerability that stems from auth-tls-match-cn Ingress annotations can be used to inject configurations, which could le...
Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-06305)
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...
Tenda AC6 Buffer Overflow Vulnerability (CNVD-2025-07605)
The Tenda AC6 is a wireless router from the Chinese company Tenda. The Tenda AC6 suffers from a buffer overflow vulnerability that originates from the timeZone parameter in the /goform/fastsettingwifiset file that fails to properly validate the length of the input data, which can be exploited by ...
D-Link DAP-1620 mod_graph_auth_uri_handler function stack buffer overflow vulnerability
The D-Link DAP-1620 is a wireless repeater extender from D-Link. A stack buffer overflow vulnerability exists in the D-Link DAP-1620 modgraphauthurihandler function, which can be exploited by an attacker to execute arbitrary code on the system or cause a denial of service...