Dell Update Package Framework Local Elevation of Privilege Vulnerability

Dell Update Package Framework is a framework for updating system components from Dell USA. The product focuses on providing installers for drivers, applications, BIOS, and firmware. The Dell Update Package Framework suffers from a local elevation of privilege vulnerability that originates from a...

YesWiki cross-site scripting vulnerability (CNVD-2025-03330)

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative way. A cross-site scripting vulnerability exists in YesWiki 4.4.5 and earlier versions, which stems from improper input validation when the attach component...

Mattermost Information Disclosure Vulnerability (CNVD-2025-03329)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an information disclosure vulnerability that stems from not filtering private chat DM messages from deleted channel endpoints, which could disclose metadata such as user IDs. An...

Library Card System SQL Injection Vulnerability (CNVD-2025-03328)

Library Card System is a library management system. A SQL injection vulnerability exists in Library Card System version 1.0, which originates from a lack of validation of the id parameter of the card.php file against externally entered SQL statements. An attacker can use this vulnerability to...

ASUS RT-N12E Cross-Site Scripting Vulnerability

The ASUS RT-N12E is a wireless router from the Chinese company ASUS. A cross-site scripting vulnerability exists in ASUS RT-N12E version 2.0.0.19, which stems from the lack of effective filtering and escaping of user-supplied data in the SSID parameter of the sysinfo.asp file, which can be...

Linux Ratfor Buffer Overflow Vulnerability

Linux Ratfor is a programming language implemented as a preprocessor for Fortran 66. A buffer overflow vulnerability exists in Linux Ratfor 1.06 and earlier versions, which stems from an application boundary error when handling untrusted input. An attacker could exploit the vulnerability to execu...

Linksys E5600 PRF_Table_content Component Cross-Site Scripting Vulnerability

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A cross-site scripting vulnerability exists in Linksys E5600 Ver.1.1.0.26. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an...

D-Link DSL-3782 Buffer Overflow Vulnerability

The D-Link DSL-3782 is a wireless router from China-based AUO D-Link. A buffer overflow vulnerability exists in the D-Link DSL-3782 v1.01, which stems from the failure of /NewGUI/ParentalControl.asp to correctly validate the length and size of the input data, and can be exploited by a remote...

SAP Supplier Relationship Management Path Traversal Vulnerability

SAP Supplier Relationship Management is a leading procurement supply chain management software designed to help companies optimize supplier relationships and improve procurement efficiency and quality. SAP Supplier Relationship Management suffers from a path traversal vulnerability that can be...

SAP Approuter Authentication Bypass Vulnerability

SAP Approuter is a key SAP component that is primarily used to handle entry requests for all applications. An authentication bypass vulnerability exists in SAP Approuter, which can be exploited by a remote attacker to submit a special request that can bypass authentication, inject code and execut...

SAP NetWeaver Application Server Java Information Disclosure Vulnerability (CNVD-2025-03268)

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used to develop and run Java EE applications. An information disclosure vulnerability exists in SAP NetWeaver Application Server Java, which can b...

FeMiner wms iquel_inout_item.php file SQL injection vulnerability

FeMiner wms is a warehouse management system for Chinese front-end miners FeMiner individual developers. A SQL injection vulnerability exists in FeMiner wms version 1.0, which stems from the lack of validation of externally entered SQL statements in iquelinoutitem.php. An attacker can exploit thi...

FeMiner wms id parameter SQL injection vulnerability

FeMiner wms is a warehouse management system for Chinese front-end miners FeMiner individual developers. A SQL injection vulnerability exists in FeMiner wms version 1.0, which stems from the lack of validation of the date1, date2, id parameters against externally entered SQL statements. An attack...

Google Android elevation of privilege vulnerability (CNVD-2025-03647)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that is caused by a logic error in multiple locations. An attacker can exploit the vulnerability to cause a local privilege escalation...

Google Android elevation of privilege vulnerability (CNVD-2025-03644)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to a logic error in the code that can be exploited by an attacker to cause a local privilege escalation...

Google Android Code Execution Vulnerability (CNVD-2025-03643)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code execution vulnerability that is caused by a flaw in a system component. An attacker can exploit the vulnerability to execute arbitrary code on the system...

Cisco BroadWorks Denial of Service Vulnerability

Cisco BroadWorks is a carrier-grade unified communications software platform from Cisco. It is used to deploy cloud calls from public network platforms on any type of wired or wireless network architecture. A denial of service vulnerability exists in Cisco BroadWorks that stems from improper memo...

Apache Linkis Input Validation Error Vulnerability

Apache Linkis is a middleware product of the U.S. Apache Apache Foundation, which can establish an effective connection between upper-tier applications and the underlying data engine. An input validation error vulnerability exists in Apache Linkis versions prior to 1.7.0, which stems from the lac...

TOTOLINK X18 Command Injection Vulnerability

TOTOLINK X18 is a Gigabit router from China's Gion Electronics TOTOLINK. TOTOLINK X18 version 9.1.0cu.2024B20220329 suffers from a command injection vulnerability that stems from the parameter enable in file /cgi-bin/cstecgi.cgi failing to correctly filter constructed command special characters,...

IBM QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2025-04167)

IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...

IBM Power Hardware Management Console Path Traversal Vulnerability

The IBM Power Hardware Management Console HMC is a suite of graphical interface software from International Business Machines IBM for configuring and managing the Power System family of servers. The software is primarily used to manage hardware such as servers. A path traversal vulnerability exis...

OpenCart File Upload Vulnerability

OpenCart is a set of open source e-commerce system from China OpenCart team. The system provides product reviews, product ratings, product additions and other modules. A file upload vulnerability exists in OpenCart version 1.0, which stems from the lack of effective validation of uploaded files b...

SAP NetWeaver Application Server Java Cross-Site Scripting Vulnerability

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used to develop and run Java EE applications. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server Java, which can be...

TOTOLINK X18 Buffer Overflow Vulnerability

TOTOLINK X18 is a Gigabit router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK X18 version 9.1.0cu.2024B20220329, which originates from the parameter String in the file /cgi-bin/cstecgi.cgi that fails to correctly validate the length size of the input...

Google Chrome Type Obfuscation Vulnerability (CNVD-2025-12381)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a type-obfuscation vulnerability that can be exploited by an attacker to execute arbitrary code inside a sandbox via specially crafted HTML pages...

Online Birth Certificate System /user/certificate-form.php file cross-site scripting vulnerability

Online Birth Certificate System is an online birth certificate system. Online Birth Certificate System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in /user/certificate-form.php, which can be exploited by...

Unspecified Vulnerability in CMSimple (CNVD-2026-00537)

CMSimple is a free content management system. An unspecified vulnerability exists in CMSimple, which can be exploited by an attacker to edit the log.php file via the print page...

Dell SupportAssist OS Recovery Symbolic Link Attack Vulnerability

Dell SupportAssist OS Recovery is a built-in recovery tool for Dell computers, which is mainly used to solve system problems or hardware failures. Dell SupportAssist OS Recovery suffers from a symbolic link attack vulnerability that can be exploited by attackers to cause arbitrary file deletion a...

Unspecified Vulnerability in Open5GS (CNVD-2025-18580)

Open5GS is Open5GS open source an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS has a security vulnerability that can be exploited by attackers to cause a denial of service...

Open5GS has an unspecified vulnerability (CNVD-2025-18579)

Open5GS is Open5GS open source an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS has a security vulnerability that can be exploited by attackers to cause a denial of service...

Open5GS Denial of Service Vulnerability (CNVD-2025-18578)

Open5GS is Open5GS open source an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS suffers from a denial-of-service vulnerability that stems from the gmmstateexception function mishandling a specific response error, which can be exploited by an...

CMSimple Insecure Privilege Vulnerability

CMSimple is a PHP and HTML based content management system that helps users to quickly create simple and easy to use websites. CMSimple suffers from an insecure privilege vulnerability that can be exploited by an attacker to obtain sensitive information via a carefully crafted script to download...

Huawei HarmonyOS UI Framework Module Log Message Improper Control Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An improperly controlled log message vulnerability exists in the Huawei HarmonyOS UI framework module, which can be exploited by an attacker to compromise...

Huawei HarmonyOS and EMUI emcom module out-of-bounds write vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. An out-of-bounds write vulnerability exists in the...

Apache James Resource Management Error Vulnerability

Apache James is the United States Apache Apache Foundation of a completely written in Java open source Smtp and Pop3 mail transfer agent and Nntp news server . Apache James suffers from a Resource Management Error vulnerability that stems from uncontrolled resource consumption by the application,...

Apache Doris Path Traversal Vulnerability

Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris suffers from a path traversal vulnerability that stems from the program's failure to properly filter special elements in...

Apache Hive Authorization Issues Vulnerability

Apache Hive is a set of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. An...

Huawei HarmonyOS media library module privilege checksum vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege checking vulnerability exists in the Huawei HarmonyOS media library module, which can be exploited by an attacker to compromise confidentiality...

Huawei HarmonyOS interpreter string module out-of-bounds read vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An out-of-bounds read vulnerability exists in the Huawei HarmonyOS interpreter string module, which can be exploited by an attacker to cause availability to ...

Huawei HarmonyOS ParamWatcher Module Identity Verification Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An identity verification vulnerability exists in the Huawei HarmonyOS ParamWatcher module, which can be exploited by an attacker to compromise confidentialit...

Huawei HarmonyOS Gallery Module Arbitrary Write Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An arbitrary write vulnerability exists in the Huawei HarmonyOS Gallery module, which can be exploited by an attacker to compromise confidentiality...

Huawei HarmonyOS Denial of Service Vulnerability (CNVD-2025-06198)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A denial of service vulnerability exists in Huawei HarmonyOS version 5.0.0, which stems from the presence of incomplete authentication information for the VP...

Huawei HarmonyOS and EMUI ffrt module out-of-bounds read vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. An out-of-bounds read vulnerability exists in the Huaw...

Unspecified vulnerability in Tencent QQMail (CNVD-2025-06479)

Tencent QQMail is a mailbox software of China Tencent Tencent. An unspecified vulnerability exists in Tencent QQMail, which can be exploited by attackers to access sensitive user information...

F5 BIG-IP Remote Command Injection Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. F5 BIG-IP suffers from a remote command injection vulnerability that stems from the application failing to properly filter...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2025-07327)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. F5 BIG-IP suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and...

F5 BIG-IP Uncontrolled Resource Consumption Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An uncontrolled resource consumption vulnerability exists in F5 BIG-IP, which can be exploited by an attacker to cause a denia...

F5 BIG-IP Denial of Service Vulnerability (CNVD-2025-07325)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in the F5 BIG-IP that originates when SNMP v1 or v2c is disabled and can be exploited by an...

Unspecified Vulnerability in F5 BIG-IP PEM

F5 BIG-IP PEM is a policy enforcer used in BIG-IP from F5 USA. A security vulnerability exists in the F5 BIG-IP PEM due to a Diameter Endpoint profile that can be exploited by an attacker to cause the virtual server to stop processing new client connections and cause an increase in memory resourc...

F5 BIG-IP Next Central Manager Input Validation Error Vulnerability

F5 BIG-IP Next Central Manager is a centralized console from F5 USA. An input validation error vulnerability exists in F5 BIG-IP Next Central Manager, which stems from mishandling of API requests, and can be exploited by an attacker to cause termination of the Kubernetes service via an undisclose...