131446 matches found
Kentico Xperience Authentication Bypass Vulnerability (CNVD-2026-05134)
Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from an authentication bypass vulnerability that can be exploited by an attacker to cause control of managed objects...
Yonyou UFIDA ERP-NC /login.jsp file cross-site scripting vulnerability
Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...
Yonyou UFIDA ERP-NC /help/systop.jsp file cross-site scripting vulnerability
Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability, whi...
Google Chrome Sandbox Escape Vulnerability
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a sandbox escape vulnerability that stems from mishandling of a Mojo component resulting in a sandbox escape. An attacker can exploit this vulnerability to bypass the sandboxing system and execute arbitrar...
D-Link DIR-823X Command Injection Vulnerability
The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability that stems from the application failing to properly filter constructed command special characters, commands, and so on. No details of the vulnerability are provided...
Siemens Teamcenter Visualization and Siemens Tecnomatix Plant Simulation Buffer Overflow Vulnerability
Siemens Teamcenter Visualization is software that provides teamwork capabilities for designing 2D and 3D scenarios. The software simplifies the engineering and manufacturing process by creating virtual prototypes from a variety of mechanical computer-aided design MCAD formats.Siemens Tecnomatix...
Bank Locker Management System search-report-details.php File SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally-entered SQL statements in the searchinput parameter of the search-report-details.php file. An attacker ca...
Bank Locker Management System changeidproof.php File SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the editid parameter of the changeidproof.php file. An attacker can exploit thi...
AC8 Buffer Overflow Vulnerability (CNVD-2025-07592) in Shenzhen Jixiang Tengda Technology Co.
Shenzhen Jixiang Tengda Technology Co., Ltd AC8 is a wireless router. Shenzhen Jixiang Tengda Technology Co., Ltd AC8 has a buffer overflow vulnerability, the vulnerability stems from the SetRouteStatic function fails to correctly validate the length and size of the input data, an attacker can us...
Tenda AC7 Buffer Overflow Vulnerability
Tenda AC7 is a wireless router from Tenda, a Chinese company. The Tenda AC7 suffers from a buffer overflow vulnerability that originates from the formWifiBasicSet function failing to correctly validate the length and size of the input data, which can be exploited by an attacker to execute arbitra...
Yonyou UFIDA ERP-NC /help/top.jsp file cross-site scripting vulnerability
Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...
Zoom Workplace Denial of Service Vulnerability
Zoom Workplace is an AI-first collaboration platform from Zoom that integrates core features such as team communication, meetings, document collaboration, and a built-in AI Companion smart assistant to boost productivity. Zoom Workplace suffers from a denial-of-service vulnerability that stems fr...
Bank Locker Management System profile.php file SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the profile.php file's parameter mobilenumber. An attacker can exploit this...
Yonyou UFIDA ERP-NC /menu.jsp file cross-site scripting vulnerability
Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...
Siemens Teamcenter Visualization and Siemens Tecnomatix Plant Simulation Resource Management Error Vulnerability
Siemens Teamcenter Visualization is software that provides teamwork capabilities for designing 2D and 3D scenarios. The software simplifies the engineering and manufacturing process by creating virtual prototypes from a variety of mechanical computer-aided design MCAD formats.Siemens Tecnomatix...
Kentico Xperience has an unspecified vulnerability
Kentico Xperience is a digital experience platform from Kentico. A security vulnerability exists in Kentico Xperience that can be exploited by an attacker to cause path traversal and arbitrary file uploads, including content that can be executed server-side, leading to remote code execution...
Kentico Xperience Authentication Bypass Vulnerability
Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from an authentication bypass vulnerability that can be exploited by an attacker to cause control of managed objects...
Mattermost Mobile Apps Denial of Service Vulnerability
Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A denial of service vulnerability exists in Mattermost Mobile Apps version 2.25.0, which stems from an improperly validated GIF image, and can be exploited by an attacker to crash an Android application via a message...
PDF-XChange Editor Out-of-Bounds Read Vulnerability (CNVD-2025-22249)
PDF-XChange Editor is a PDF file viewing software from PDF-XChange running on Microsoft Windows systems. PDF-XChange Editor suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute code in the context of the current process...
Bank Locker Management System changeimage1.php File SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter editid of the changeimage1.php file. An attacker can exploit...
TOTOLINK A3000RU Access Control Error Vulnerability
The TOTOLINK A3000RU is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3000RU suffers from an Access Control Error vulnerability that originates from improper access control in the Syslog profile handling component in the file /cgi-bin/ExportSyslog.sh. No details of the...
SAP CRM and SAP S/4HANA server-side request forgery vulnerability (CNVD-2025-07595)
SAP CRM and SAP S/4HANA are both products of SAP, a customer relationship management system, and SAP S/4HANA, an enterprise resource management software based on the SAP HANA in-memory database system. SAP CRM and SAP S/4HANA suffer from a server-side request forgery vulnerability, which stems fr...
Siemens SCALANCE LPE9403 Operating System Command Injection Vulnerability (CNVD-2025-09962)
Siemens SCALANCE LPE9403 is a local processing engine for industrial field data processing from Siemens. It is used to capture, collect and pre-process industrial field data. The Siemens SCALANCE LPE9403 6GK5998-3GS00-2AC2 suffers from an operating system command injection vulnerability that...
Microsoft Edge (Chromium-based) Update elevation of privilege vulnerability (CNVD-2025-23062)
Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. An elevation of privilege vulnerability exists in Microsoft Edge Chromium-based Update, which is caused by improper link resolution before file access. An attacker could exploit the...
Remote code execution vulnerability in Ingress NGINX Controller (CNVD-2025-05884)
Ingress NGINX Controller is an open source portal controller that uses NGINX as a reverse proxy and load balancer. Ingress NGINX Controller suffers from a remote code execution vulnerability that can be exploited by an attacker to gain access to sensitive data such as credentials and keys across...
Tenda AC8 Stack Buffer Overflow Vulnerability (CNVD-2025-07606)
Tenda AC8 is a wireless router from Tenda, a Chinese company. The Tenda AC8 suffers from a stack buffer overflow vulnerability, which stems from the deviceid parameter in the getparentControllistInfo function failing to properly validate the length of the input data, which can be exploited by an...
D-Link DIR-605L/DIR-618 formAdvNetwork Function Access Control Error Vulnerability
The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An Access Control Error vulnerability exists in the D-Link DIR-605L version 3.02 and the D-Link DIR-618 version 2.02, which stems from improper access control in the file /goform/formAdvNetwork, and can...
LibreChat groupid parameter access control error vulnerability
LibreChat is an enhanced ChatGPT clone. An Access Control Error vulnerability exists in versions of LibreChat prior to 0.7.6, which stems from the groupid parameter not verifying that the prompt ID provided belongs to the current user, and can be exploited by an attacker to cause the deletion of...
Unspecified Vulnerability in LibreChat
LibreChat is an enhanced ChatGPT clone. LibreChat has a security vulnerability that stems from an unhandled exception that can be exploited by an attacker to cause a server crash...
D-Link DSL-3788 Buffer Overflow Vulnerability
The D-Link DSL-3788 is a modem from China-based AUO D-Link. The D-Link DSL-3788 suffers from a buffer overflow vulnerability that stems from the webproc cgi's COMMMAKECustomMsg function failing to correctly validate the length of the input data, which can be exploited by an attacker to cause a...
lunary cross-site scripting vulnerability (CNVD-2025-08307)
lunary is lunary open source a production toolkit for LLM . lunary cross-site scripting vulnerability , the vulnerability stems from the SAML IdP XML metadata on user-supplied data lack of effective filtering and escaping , an attacker can use the vulnerability to obtain and modify sensitive...
GPT Academic Code Issue Vulnerability
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a code issue vulnerability that arises from unsafe deserialization of serialized data received from users by the Latex English Error Correction Plugin feature...
Mattermost Authorization Issues Vulnerability
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from improper authorization of the Viewer role, which can be exploited by an attacker to still view team and site statistics...
Unspecified vulnerability in Lunary (CNVD-2025-06937)
Lunary is Lunary open source a production toolkit for LLM . Lunary has a security vulnerability that stems from improper privilege management, which can be exploited by an attacker to cause an administrator to bypass role controls to access billing information...
Unspecified vulnerability in Lunary (CNVD-2025-06936)
Lunary is Lunary open source a production toolkit for LLM . Lunary afc5df4 version of a security vulnerability , the vulnerability stems from a flaw in the permission checking mechanism , an attacker can use this vulnerability to cause unauthorized access to sensitive endpoints...
SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2025-07541)
SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. SAP Business Objects Business Intelligence Platform suffers from a cross-site scripting vulnerability that stems from the application's lack of effective...
Tenda AC7 Buffer Overflow Vulnerability (CNVD-2025-07593)
Tenda AC7 is a wireless router from Tenda, a Chinese company. The Tenda AC7 suffers from a buffer overflow vulnerability that originates from the timeZone parameter of the formfastsettingwifiset function failing to properly validate the length of the input data, which can be exploited by an...
ChuanhuChatGPT Resource Management Error Vulnerability
ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. A resource management error vulnerability exists in ChuanhuChatGPT version 20240914, which stems from improper handling of large file names i...
lunary authorization issue vulnerability (CNVD-2025-07598)
lunary is lunary open source a production toolkit for LLM . An authorization issue vulnerability exists in lunary that stems from /bigquery API routing without proper access control, no detailed vulnerability details are provided at this time...
GPT Academic Command Injection Vulnerability (CNVD-2025-22740)
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a command injection vulnerability that stems from improper handling of user-supplied prompts in the manim plugin, which can be exploited by an attacker to cau...
D-Link DAP-1620 mod_graph_auth_uri_handler function stack buffer overflow vulnerability
The D-Link DAP-1620 is a wireless repeater extender from D-Link. A stack buffer overflow vulnerability exists in the D-Link DAP-1620 modgraphauthurihandler function, which can be exploited by an attacker to execute arbitrary code on the system or cause a denial of service...
Tenda AX12 Buffer Overflow Vulnerability (CNVD-2025-07607)
Tenda AX12 is a dual-band Gigabit Wifi 6 wireless router from Tenda China. The Tenda AX12 suffers from a buffer overflow vulnerability that originates from the sub42F69C function in /goform/setMacFilterCfg that fails to correctly validate the length of the input data, which can be exploited by an...
Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-06306)
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...
Doctor Appointment Management System check-appointment.php File SQL Injection Vulnerability
Doctor Appointment Management System is a doctor appointment management system. Doctor Appointment Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter searchdata of /check-appointment.php. A...
ChuanhuChatGPT File Containment Vulnerability
ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. A file inclusion vulnerability exists in ChuanhuChatGPT version d4ec6a3, which stems from the gr.JSON component not effectively filtering cal...
Vehicle Record Management System index.php File SQL Injection Vulnerability
Vehicle Record Management System is a vehicle record management system. Vehicle Record Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the searchinputdata parameter of index.php. An attacker can exploit this...
CicadasCMS Code Injection Vulnerability (CNVD-2025-06474)
CicadasCMS is a content management system. CicadasCMS code injection vulnerability can be exploited by attackers to conduct cross-site scripting attacks...
GPT Academic Remote Code Execution Vulnerability
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a remote code execution vulnerability that stems from not properly validating a user-supplied RAR file, which can be exploited by an attacker to cause remote...
D-Link DIR-605L/DIR-618 formTcpipSetup Function Access Control Error Vulnerability
The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An access control error vulnerability exists in the D-Link DIR-618 version 2.02 and DIR-605L version 3.02, which stems from improper access control in the file /goform/formTcpipSetup, and can be exploit...
Apache Commons VFS Information Disclosure Vulnerability
Apache Commons VFS is a public virtual file system from the Apache USA Foundation. Apache Commons VFS prior to version 2.10.0 suffers from an information disclosure vulnerability that stems from the FtpFileObject class that may disclose the original URI containing the password if the file is not...