IBM Cognos Controller Weak Password Vulnerability

IBM Cognos Controller is a corporate performance management CPM software for financial consolidation, reporting and analysis. A weak password vulnerability exists in IBM Cognos Controller versions 11.0.0 through 11.1.0, which stems from the fact that the system does not require users to set stron...

Tenda AC7 Stack Overflow Vulnerability (CNVD-2025-05237)

The Tenda AC7 is a wireless router manufactured by Tenda. A stack overflow vulnerability exists in the formSetFirewallCfg function of the /goform/SetFirewallCfg file in Tenda AC7 15.03.06.44 and earlier versions when handling the firewallEn parameter, which stems from the program failing to check...

Student Record System password-recovery.php File SQL Injection Vulnerability

Student Record System is a software application. Student Record System suffers from an SQL injection vulnerability that originates from an incorrect manipulation of the parameter emailid in the password-recovery.php file, which can lead to SQL injection. An attacker can use this vulnerability to...

Unauthorized Access Vulnerability in Cultural AI Management System of Sichuan Cultural Big Data Co.

Sichuan Cultural Big Data Limited Liability Company is mainly engaged in big data services, data processing and storage support services, Internet data services, cloud computing equipment technology services, artificial intelligence basic resources and technology platforms, artificial intelligenc...

Weak Password Vulnerability in Kingh5stream of Beijing Asian Control Technology Development Co.

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of industrial automation and informatization software platform, focusing on independent research and development, marketing and service of domestic industrial software. A weak password vulnerability exists in Beijing...

Cisco OpenH264 Competitive Conditions Vulnerability

Cisco OpenH264 is an open source H.264 codec from Cisco USA. Cisco OpenH264 suffers from a competitive condition vulnerability that can lead to a heap overflow and remote code execution. No details of the vulnerability are provided at this time...

Linux kernel suffers from a memory leak vulnerability (CNVD-2025-05995)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory leak vulnerability that stems from apple-aic not handling node reference counting correctly during initialization, which can be exploited by ...

Logic Flaw Vulnerability in Dongsheng Booking Platform of Qingdao Dongsheng Weiye Software Co.

Qingdao Dongsheng Weiye Software Co., Ltd. is a company whose main business includes computer software development, network engineering design, web page design, integrated wiring, software technology services, installation and maintenance of electronic equipment and technical services, logistics...

Linux kernel get_initial_state memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that stems from the use of a skb in getinitialstate after it has been released, which can be exploited by an...

Linux kernel macsec memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that stems from a macsec device not obtaining a reference to realdev, which can be exploited by an attacker to cau...

Linux kernel panfrost module memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that originates from the panfrost module's job structure referencing panfrostpriv to obtain the MMU environment,...

Linux kernel pm runtime resume memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that originates from the use of freed memory during pm runtime resume. An attacker could exploit this vulnerabilit...

Linux kernel scsi: libfc memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that originates from a mix-up in the instructions responsible for freeing memory in scsi: libfc. An attacker could...

Linux kernel sysfs trigger memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that stems from a confusion in the instructions responsible for freeing memory when the sysfs trigger is removed. ...

Linux kernel tcmu_try_get_data_page memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that stems from tcmutrygetdatapage not properly obtaining a reference count, which can be exploited by an attacker...

Linux kernel vesafb driver memory misreference vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory misreference vulnerability that originates from a confusion in the instruction responsible for freeing memory in the vesafb driver. An attack...

Linux kernel memory misreference vulnerability (CNVD-2025-04672)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a driver uninstallation without logging off the platform device, which can be exploited by an attacker to...

SQL Injection Vulnerability in NetDrive Unified Communication Platform of Beijing NetDrive Network Technology Co.

Ltd. is a leading global provider of cloud video solutions and services. A SQL injection vulnerability exists in the NetDrive Unified Communications Platform of Beijing NetDrive Network Technology Co., Ltd, which can be exploited by attackers to obtain sensitive information from the database...

emlog file upload vulnerability (CNVD-2025-04611)

emlog is a PHP and MySQL based CMS builder. A file upload vulnerability exists in emlog version v2.5.3, which stems from a lack of validation of uploaded files by the adminplugin.php component. An attacker can exploit this vulnerability to upload malicious files and remotely execute arbitrary cod...

IBM EntireX Path Traversal Vulnerability

IBM EntireX is a cross-platform application integration middleware developed by IBM to support data communication and transaction processing between heterogeneous systems. A path traversal vulnerability exists in IBM EntireX, which can be exploited by an attacker to view arbitrary files on a syst...

IBM EntireX Denial of Service Vulnerability

IBM EntireX is a cross-platform middleware developed by IBM for high-performance data communication and transaction processing between heterogeneous systems. A denial of service vulnerability exists in IBM EntireX regular expressions, which is caused by a complexity flaw in the regular expression...

SQL Injection Vulnerability in Founder Unlimited Media News Editorial System of Beijing Beifang Founder Electronics Co.

Beijing Beifang Founder Electronics Co., Ltd. is a leading technology and service provider in the fields of printing, media, publishing, and font libraries. A SQL injection vulnerability exists in Beijing Founder Electronics Co., Ltd.'s Founder Unlimited All-Media News Gathering and Editing Syste...

Geovision GV-ASWeb Code Injection Vulnerability

Geovision GV-ASWeb is a Web-based software from Geovision China for remote access and configuration of GV-ASManager's database. A code injection vulnerability exists in Geovision GV-ASWeb, which can be exploited by an attacker to execute arbitrary commands on the system...

OneBlog Template Injection Vulnerability

OneBlog is a Java blog. OneBlog suffers from a template injection vulnerability, no details of the vulnerability are provided at this time...

Command Injection Vulnerability in Cisco Application Policy Infrastructure Controller CLI

Cisco Application Policy Infrastructure Controller is a software for Cisco ACI switching matrix automation and management from Cisco. A command injection vulnerability exists in the Cisco Application Policy Infrastructure Controller CLI, which can be exploited by an attacker to submit a special...

Cisco Application Policy Infrastructure Controller Cross-Site Scripting Vulnerability

Cisco Application Policy Infrastructure Controller is a software for Cisco ACI switching matrix automation and management from Cisco. The Cisco Application Policy Infrastructure Controller suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject malicious...

SQL Injection Vulnerability in KDDI Smart Cloud Platform of KDDI (Beijing) Co.

Ltd. is a company mainly engaged in technology development, technology promotion, technology transfer, technology consulting and technical services. Ltd. SQL injection vulnerability exists in KDDI Smart Cloud Platform, which can be exploited by attackers to obtain sensitive information from the...

Ollama Unauthorized Access Vulnerability

Ollama is an open source Large Language Model LLM runtime environment and toolset designed to help developers easily deploy, manage, and use models e.g., DeepSeek, etc.. Ollama suffers from an unauthorized access vulnerability, which is due to the fact that Ollama is not set up with authenticatio...

CMSimple Cross-Site Scripting Vulnerability (CNVD-2026-00534)

CMSimple is a free content management system. CMSimple suffers from a cross-site scripting vulnerability that arises from insufficient filtering or escaping of user-supplied input. An attacker could use this vulnerability to execute arbitrary web script or HTML code to steal a user's session...

Google Android Elevation of Privilege Vulnerability

Google Android is a free and open source mobile operating system developed by Google Inc. based on the Linux kernel. Google Android suffers from an elevation of privilege vulnerability that stems from the presence of debugging certificates that are whitelisted, no details of the vulnerability are...

Google Android Out-of-Bounds Read Vulnerability

Google Android is a free and open source mobile operating system developed by Google Inc. based on the Linux kernel. Google Android suffers from an out-of-bounds read vulnerability that originates from a missing boundary check in the tmugettemplut module of the tmu.c file, which can be exploited ...

Mattermost SQL Injection Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a SQL injection vulnerability that stems from the use of uncompiled statements, which can be exploited by an attacker to retrieve database data via a specially designed sorting...

Online Shopping Portal /search-result.php File SQL Injection Vulnerability

Online Shopping Portal is an online store system. Online Shopping Portal suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter Product of the file /search-result.php. An attacker can exploit this vulnerability to...

Nipah Virus Testing Management System /search-report-result.php File SQL Injection Vulnerability

Nipah Virus Testing Management System is an online virus diagnostic platform. The Nipah Virus Testing Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the /search-report-result.php file. An attacker can...

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CNVD-2025-23063)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A security feature bypass vulnerability exists in Microsoft Edge Chromium-based, which can be exploited by attackers to bypass certain features...

GLPI Input Validation Error Vulnerability

GLPI is an open source IT and asset management software from GLPI Open Source. The software provides a full-featured IT resource management interface , you can use it to create a database to fully manage IT computers , monitors , servers , printers , network devices , telephones , and even toner...

Command Execution Vulnerability in Operation and Maintenance Management Audit System of Shanghai Shangxun Information Technology Co.

hereinafter referred to as "SinoCom-ArtM" is one of the leading providers of data, intelligent security operation and maintenance, mobile security, security services and other fields in China. A command execution vulnerability exists in the Operations and Maintenance Management and Audit System o...

Moodle SQL Injection Vulnerability

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from an SQL injection vulnerability that stems from not adequately filtering user input. No detailed...

Moodle Cross-Site Scripting Vulnerability (CNVD-2025-11089)

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle. The vulnerability stems from a cross-site scripting risk where...

Dell Secure Connect Gateway SQL Injection Vulnerability

The Dell Secure Connect Gateway Dell SCG is a secure connectivity gateway from Dell, USA. The Dell Secure Connect Gateway suffers from an SQL injection vulnerability that originates from improper neutralization of special elements in SQL commands, which can be exploited by an attacker to execute...

D-Link DSL-3782 Buffer Overflow Vulnerability

The D-Link DSL-3782 is a wireless router from China-based AUO D-Link. The D-Link DSL-3782 suffers from a buffer overflow vulnerability that originates in the destination, netmask and gateway parameters, which can be exploited by an attacker to cause a denial of service...

ESRI ArcGIS AllSource Untrusted Search Path Vulnerability

ESRI ArcGIS AllSource is a Intelligence Analyzer software developed by ESRI. An untrustworthy search path vulnerability exists in ESRI ArcGIS AllSource, which can be exploited by an attacker to execute malicious commands...

ESRI ArcGIS Pro Untrustworthy Search Path Vulnerability

ESRI ArcGIS Pro is a powerful desktop GIS software from ESRI. An untrusted search path vulnerability exists in ESRI ArcGIS Pro, which can be exploited by an attacker to execute malicious commands...

Tenda AC8 get_parentControl_list_Info function buffer overflow vulnerability

Tenda AC8 is a wireless router from Tenda, a Chinese company. The Tenda AC8 suffers from a buffer overflow vulnerability that originates from a boundary error in the getparentControllistInfo function when handling untrusted input. No detailed vulnerability details are provided at this time...

Tenda AC6 Code Execution Vulnerability

The Tenda AC6 is a wireless router from the Chinese company Tenda. A code execution vulnerability exists in the Tenda AC6 that stems from the cmdinput parameter of the formexeCommand function failing to properly filter special elements of the constructed snippet. No details of the vulnerability a...

Tenda AC6 sub_452A4 function buffer overflow vulnerability

The Tenda AC6 is a wireless router from the Chinese company Tenda. The Tenda AC6 suffers from a buffer overflow vulnerability that originates from a boundary error in the sub452A4 function when handling untrusted input. No detailed vulnerability details are provided at this time...

ChurchCRM Input Validation Error Vulnerability

ChurchCRM is ChurchCRM open source an open source CRM system for churches. ChurchCRM suffers from an input validation error vulnerability that stems from not properly validating input. An attacker can exploit this vulnerability to hijack a user session...

Tale Blog Cross-Site Scripting Vulnerability

Tale Blog is a Java blog. A cross-site scripting vulnerability exists in Tale Blog version 2.0.5 and earlier versions, which stems from the lack of effective filtering and escaping of user-supplied data in the logourl parameter of the OptionsService function of...

FFmpeg Buffer Overflow Vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A buffer overflow vulnerability exists in FFmpeg version 7.1 and earlier versions, which originates from the ffaacsearchfortns function in the libavcodec/aacenctns.c file of the AAC Encoder...

Dreamer CMS Cross-Site Scripting Vulnerability (CNVD-2025-04175)

Dreamer CMS is a dreamer content management system. Dreamer CMS version 4.1.3 suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the editorValue, answer and content parameters in the /admin/archives/edit...