131891 matches found
Information Leakage Vulnerability in Network Intrusion Protection System of Beijing Shenzhou Green Alliance Technology Co.
Beijing Shenzhou Green Alliance Technology Co., Ltd. is an enterprise mainly engaged in science and technology promotion and application services. There is an information leakage vulnerability in the network intrusion prevention system of Beijing Shenzhou Green Alliance Technology Co. Ltd, which...
Tenda W6_S Buffer Overflow Vulnerability (CNVD-2025-08906)
Tenda W6S is a wireless router. The Tenda W6S suffers from a buffer overflow vulnerability that originates when the setlocaltime function does not validate the length of the time parameter when processing the time parameter passed via a POST request, resulting in a buffer overflow that can be...
Dell Unity OS Command Injection Vulnerability (CNVD-2025-06622)
Dell Unity is a set of virtual Unity storage environments from Dell USA. An OS command injection vulnerability exists in Dell Unity 5.4 and earlier versions, which can be exploited by an attacker to execute arbitrary operating system commands on the system...
Apple macOS Sonoma Out-of-Bounds Read Vulnerability
Apple macOS Sonoma is a version of the Mac operating system released by Apple on June 5, 2023, featuring upgrades in personalized settings, video conferencing, the Safari browser, and the gaming experience. Apple macOS Sonoma suffers from an out-of-bounds read vulnerability that stems from...
Shenzhen Qixin Haozitong Cloud Computing Co., Ltd. Haozitong-Cloud Conference has file upload vulnerability
GoodView-Cloud Conference is a network video conference product based on cloud computing technology. Shenzhen Qixin Haozitong Cloud Computing Co., Ltd Haozitong-Cloud Conference has a file upload vulnerability that can be exploited by an attacker to gain control of the server...
WordPress Blue Captcha plugin cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Blue Captcha plugin has a cross-site scripting vulnerability, the vulnerability stems from the lack...
Apple macOS Sonoma Permission Issues Vulnerability
Apple macOS Sonoma is a version of the Mac operating system released by Apple on June 5, 2023, featuring upgrades in personalized settings, video conferencing, the Safari browser, and the gaming experience. Apple macOS Sonoma suffers from a privilege issue vulnerability that stems from gaining ro...
Dell Unity OS Command Execution Vulnerability (CNVD-2025-08303)
Dell Unity is a mid-range storage array software from Dell EMC for data storage and management. Dell Unity suffers from an OS command execution vulnerability that can be exploited by an attacker to submit a special request to execute arbitrary commands...
Apache Kylin Code Injection Vulnerability
Apache Kylin is an open source distributed analytics engine designed to provide SQL interfaces as well as multidimensional analytics support for Hadoop and Alluxio for very large datasets. A code injection vulnerability exists in Apache Kylin versions 4.0.0 through 5.0.1, which can be exploited b...
Dell Unity OS Command Injection Vulnerability (CNVD-2025-08302)
Dell Unity is a mid-range storage array software from Dell EMC for data storage and management. Dell Unity suffers from an OS command injection vulnerability that can be exploited by an attacker to submit a special request to delete arbitrary files...
Dell Unity URL Redirection Vulnerability
Dell Unity is a mid-range storage array software from Dell EMC for data storage and management. Dell Unity suffers from a URL redirection vulnerability that stems from a URL redirection to an untrusted site, which could lead to a phishing attack. No details of the vulnerability are provided at th...
WordPress Shuffle plugin SQL injection vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress Shuffle plugin suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements. An attacker can exploit this...
Netgear DC112A deviceName Command Injection Vulnerability
The Netgear DC112A is a wireless router. The Netgear DC112A suffers from a command injection vulnerability that originates in the usbadv.cgi handling of the deviceName parameter, which can be exploited by an attacker to submit a special request and execute arbitrary commands...
Google gVisor elevation of privilege vulnerability (CNVD-2025-07534)
Google gVisor is a container sandboxing technology developed by Google to provide greater isolation and security for containers. An elevation of privilege vulnerability exists in Google gVisor, which can be exploited by an attacker to access restricted files...
Bank Locker Management System edit-locker.php?ltid=6 File SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the lockersize parameter of the edit-locker.php?ltid=6 file. An attacker c...
D-Link DIR-823X Command Injection Vulnerability
The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a command injection vulnerability that stems from the application failing to properly filter constructed command special characters, commands, and so on. No details of the vulnerability are provided...
Kentico Xperience Cross-Site Scripting Vulnerability
Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute arbitrary web...
Yonyou UFIDA ERP-NC /login.jsp file cross-site scripting vulnerability
Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...
Google Chrome Sandbox Escape Vulnerability
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a sandbox escape vulnerability that stems from mishandling of a Mojo component resulting in a sandbox escape. An attacker can exploit this vulnerability to bypass the sandboxing system and execute arbitrar...
Arbitrary File Read Vulnerability in NCC Data Source Configuration Center of New Way Technology Co.
Xindao Technology Co., Ltd. is a company primarily engaged in the software and information technology service industry. An arbitrary file read vulnerability exists in the NCC Data Source Configuration Center of New Way Technology Co. Ltd. that can be exploited by attackers to obtain sensitive...
Yonyou UFIDA ERP-NC /help/systop.jsp file cross-site scripting vulnerability
Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability, whi...
Kentico Xperience Authentication Bypass Vulnerability (CNVD-2026-05134)
Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from an authentication bypass vulnerability that can be exploited by an attacker to cause control of managed objects...
Siemens Teamcenter Visualization and Siemens Tecnomatix Plant Simulation Buffer Overflow Vulnerability
Siemens Teamcenter Visualization is software that provides teamwork capabilities for designing 2D and 3D scenarios. The software simplifies the engineering and manufacturing process by creating virtual prototypes from a variety of mechanical computer-aided design MCAD formats.Siemens Tecnomatix...
Yonyou UFIDA ERP-NC /help/top.jsp file cross-site scripting vulnerability
Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...
Tenda AC7 Buffer Overflow Vulnerability
Tenda AC7 is a wireless router from Tenda, a Chinese company. The Tenda AC7 suffers from a buffer overflow vulnerability that originates from the formWifiBasicSet function failing to correctly validate the length and size of the input data, which can be exploited by an attacker to execute arbitra...
Yonyou UFIDA ERP-NC /menu.jsp file cross-site scripting vulnerability
Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...
Bank Locker Management System profile.php file SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the profile.php file's parameter mobilenumber. An attacker can exploit this...
Bank Locker Management System changeidproof.php File SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the editid parameter of the changeidproof.php file. An attacker can exploit thi...
AC8 Buffer Overflow Vulnerability (CNVD-2025-07592) in Shenzhen Jixiang Tengda Technology Co.
Shenzhen Jixiang Tengda Technology Co., Ltd AC8 is a wireless router. Shenzhen Jixiang Tengda Technology Co., Ltd AC8 has a buffer overflow vulnerability, the vulnerability stems from the SetRouteStatic function fails to correctly validate the length and size of the input data, an attacker can us...
Zoom Workplace Denial of Service Vulnerability
Zoom Workplace is an AI-first collaboration platform from Zoom that integrates core features such as team communication, meetings, document collaboration, and a built-in AI Companion smart assistant to boost productivity. Zoom Workplace suffers from a denial-of-service vulnerability that stems fr...
Bank Locker Management System search-report-details.php File SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally-entered SQL statements in the searchinput parameter of the search-report-details.php file. An attacker ca...
Kentico Xperience has an unspecified vulnerability
Kentico Xperience is a digital experience platform from Kentico. A security vulnerability exists in Kentico Xperience that can be exploited by an attacker to cause path traversal and arbitrary file uploads, including content that can be executed server-side, leading to remote code execution...
Bank Locker Management System changeimage1.php File SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter editid of the changeimage1.php file. An attacker can exploit...
TOTOLINK A3000RU Access Control Error Vulnerability
The TOTOLINK A3000RU is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3000RU suffers from an Access Control Error vulnerability that originates from improper access control in the Syslog profile handling component in the file /cgi-bin/ExportSyslog.sh. No details of the...
Siemens Teamcenter Visualization and Siemens Tecnomatix Plant Simulation Resource Management Error Vulnerability
Siemens Teamcenter Visualization is software that provides teamwork capabilities for designing 2D and 3D scenarios. The software simplifies the engineering and manufacturing process by creating virtual prototypes from a variety of mechanical computer-aided design MCAD formats.Siemens Tecnomatix...
Kentico Xperience Authentication Bypass Vulnerability
Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from an authentication bypass vulnerability that can be exploited by an attacker to cause control of managed objects...
PDF-XChange Editor Out-of-Bounds Read Vulnerability (CNVD-2025-22249)
PDF-XChange Editor is a PDF file viewing software from PDF-XChange running on Microsoft Windows systems. PDF-XChange Editor suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute code in the context of the current process...
Mattermost Mobile Apps Denial of Service Vulnerability
Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A denial of service vulnerability exists in Mattermost Mobile Apps version 2.25.0, which stems from an improperly validated GIF image, and can be exploited by an attacker to crash an Android application via a message...
LibreChat groupid parameter access control error vulnerability
LibreChat is an enhanced ChatGPT clone. An Access Control Error vulnerability exists in versions of LibreChat prior to 0.7.6, which stems from the groupid parameter not verifying that the prompt ID provided belongs to the current user, and can be exploited by an attacker to cause the deletion of...
SAP CRM and SAP S/4HANA server-side request forgery vulnerability (CNVD-2025-07595)
SAP CRM and SAP S/4HANA are both products of SAP, a customer relationship management system, and SAP S/4HANA, an enterprise resource management software based on the SAP HANA in-memory database system. SAP CRM and SAP S/4HANA suffer from a server-side request forgery vulnerability, which stems fr...
Apache Commons VFS Information Disclosure Vulnerability
Apache Commons VFS is a public virtual file system from the Apache USA Foundation. Apache Commons VFS prior to version 2.10.0 suffers from an information disclosure vulnerability that stems from the FtpFileObject class that may disclose the original URI containing the password if the file is not...
Apple macOS Sequoia Information Disclosure Vulnerability
Apple macOS Sequoia is an operating system announced by Apple at the WWDC24 developer conference on June 10, 2024, with the official version launched in the fall of the same year, primarily for Mac devices, emphasizing cross-device collaboration and integration of AI functionality to significantl...
CicadasCMS Code Injection Vulnerability (CNVD-2025-06474)
CicadasCMS is a content management system. CicadasCMS code injection vulnerability can be exploited by attackers to conduct cross-site scripting attacks...
Bank Locker Management System search-locker-details.php File SQL Injection Vulnerability
Bank Locker Management System is a bank locker management system. Bank Locker Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally-entered SQL statements in the searchinput parameter of /search-locker-details.php. An attacker can exploi...
ChuanhuChatGPT Security Bypass Vulnerability
ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a security bypass vulnerability that originates when a username is provided via a client-side HTTP request, which...
D-Link DIR-605L/DIR-618 formAdvNetwork Function Access Control Error Vulnerability
The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An Access Control Error vulnerability exists in the D-Link DIR-605L version 3.02 and the D-Link DIR-618 version 2.02, which stems from improper access control in the file /goform/formAdvNetwork, and can...
lunary cross-site scripting vulnerability (CNVD-2025-08307)
lunary is lunary open source a production toolkit for LLM . lunary cross-site scripting vulnerability , the vulnerability stems from the SAML IdP XML metadata on user-supplied data lack of effective filtering and escaping , an attacker can use the vulnerability to obtain and modify sensitive...
Tenda AC8 Stack Buffer Overflow Vulnerability (CNVD-2025-07606)
Tenda AC8 is a wireless router from Tenda, a Chinese company. The Tenda AC8 suffers from a stack buffer overflow vulnerability, which stems from the deviceid parameter in the getparentControllistInfo function failing to properly validate the length of the input data, which can be exploited by an...
SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2025-07541)
SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. SAP Business Objects Business Intelligence Platform suffers from a cross-site scripting vulnerability that stems from the application's lack of effective...
Unspecified vulnerability in Lunary (CNVD-2025-06936)
Lunary is Lunary open source a production toolkit for LLM . Lunary afc5df4 version of a security vulnerability , the vulnerability stems from a flaw in the permission checking mechanism , an attacker can use this vulnerability to cause unauthorized access to sensitive endpoints...