131891 matches found
Human Resource Integrated System Childs Name Field Cross-Site Scripting Vulnerability
Human Resource Integrated System is a human resource management system. A cross-site scripting vulnerability exists in the Human Resource Integrated System, which stems from an incorrectly filtered input in the Childs Name field and can be exploited by an attacker to cause a cross-site scripting...
Code execution vulnerability in multiple Mozilla products (CNVD-2025-24638)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S.A. Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is email client software that supports the IMAP and POP mail protocols as well as the HTML mail format. A code...
BMC Control-M Authentication Bypass Vulnerability
BMC Control-M is an application from BMC Corporation. Simplifies application and data workflow orchestration locally or as a service. An authentication bypass vulnerability exists in BMC Control-M that stems from an authentication bypass when using an empty or default kdb keystore or a default...
Grocery Sales and Inventory System SQL Injection Vulnerability (CNVD-2026-38233)
Grocery Sales and Inventory System is a system for grocery sales and inventory management. The Grocery Sales and Inventory System has a SQL injection vulnerability, which stems from the lack of validation for external SQL statements in the parameter ID in the file/ajax.php?action=saveproduct...
Unspecified Vulnerability in Multiple Apple Products (CNVD-2025-22687)
Apple iOS is an operating system developed for mobile devices.Apple watchOS is a smartwatch operating system.Apple macOS is a specialized operating system developed for Mac computers. A security vulnerability exists in a number of Apple products that stems from a permissions issue that can be...
Mozilla Firefox Information Disclosure Vulnerability (CNVD-2025-24635)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
Multiple Mozilla Product Spoofing Vulnerabilities (CNVD-2025-26890)
Mozilla Firefox is an open source web browser.Mozilla Thunderbird is a set of e-mail client software separate from the Mozilla Application Suite. The software supports IMAP, POP mail protocols and HTML mail format. A spoofing vulnerability exists in several Mozilla products and is caused by an...
SQL Injection Vulnerability in Computer Sales and Inventory System (CNVD-2026-38227)
Computer Sales and Inventory System is an open-source inventory system for computer sales developed by CampCodes Corporation. The Computer Sales and Inventory System has a SQL injection vulnerability, which stems from the lack of validation for external SQL statements in the parameter Username...
Apple Xcode Path Mishandling Vulnerability
Apple Xcode is an integrated development tool that runs on the operating system Mac OS X. It is used for the development of the Mac OS X software. Apple Xcode suffers from a path mishandling vulnerability that can be exploited by an attacker to cause a process crash...
Apple Xcode Sandbox Check Insufficiency Vulnerability
Apple Xcode is an integrated development tool that runs on the operating system Mac OS X. It is used for the development of the Mac OS X software. Apple Xcode suffers from an insufficient sandbox checking vulnerability that can be exploited by an attacker to read and write files outside the sandb...
Grocery Sales and Inventory System SQL Injection Vulnerability (CNVD-2026-38235)
Grocery Sales and Inventory System is a system for grocery sales and inventory management. The Grocery Sales and Inventory System has a SQL injection vulnerability, which stems from the lack of validation for external SQL statements in the parameter ID in the file/ajax.php?action=deletecustomer...
Unspecified vulnerability in curl (CNVD-2025-21413)
curl is cURL open source a tool for transferring data from or to the server . There is a security vulnerability in curl that can be exploited by attackers that may cause malicious server-induced traffic to be mistaken for real HTTP traffic by proxy servers, thereby polluting their caches...
Grocery Sales and Inventory System SQL Injection Vulnerability (CNVD-2026-38237)
Grocery Sales and Inventory System is a software application for grocery sales and inventory management. The system has a SQL injection vulnerability, which stems from the lack of validation for external SQL statements in the parameter ID within the file/ajax.php?action=savesupplier. Attackers ca...
Wavlink WL-WN578W2 Access Control Error Vulnerability
The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. An access control error vulnerability exists in the Wavlink WL-WN578W2 version 221110, which originates from an incorrect access control in the file /liveonline.shtml, which can be exploited by an attacker to cause information...
Wavlink WL-WN578W2 sub_401C5C function command injection vulnerability
The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. Wavlink WL-WN578W2 221110 version exists a command injection vulnerability, the vulnerability stems from the parameter pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled of the function...
Beauty Parlour Management System readenq.php File SQL Injection Vulnerability
Beauty Parlour Management System is an application system. Beauty Parlour Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter delid in the file /admin/readenq.php. An attacker can exploit th...
Unspecified Vulnerability in Dreamer CMS (CNVD-2025-21438)
Dreamer CMS is a dreamer content management system. A security vulnerability exists in Dreamer CMS 4.1.3.2 and earlier versions, which stems from improper handling of the file /admin/user/updatePwd, which could lead to weak password requirements. No details of the vulnerability are provided at th...
Wavlink WL-WN578W2 sub_409184 Command Injection Vulnerability
The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. A command injection vulnerability exists in Wavlink WL-WN578W2 version 221110, which originates from the parameter selEncrypTyp of the function sub409184 in the file /wizardrep.shtml that fails to correctly filter the constructor...
Wavlink WL-WN578W2 sub_404850 function OS Command Injection Vulnerability
The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. An operating system command injection vulnerability exists in Wavlink WL-WN578W2 version 221110, which originates from the parameter deletelist in the function sub404850 in the file /cgi-bin/wireless.cgi that fails to correctly...
Wavlink WL-WN578W2 sub_401340 function command injection vulnerability
The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. A command injection vulnerability exists in Wavlink WL-WN578W2 version 221110, which originates from the parameter ipaddr in the sub401340 function of the file /cgi-bin/login.cgi that fails to correctly filter the constructor...
Flowise Access Control Error Vulnerability
Flowise is a FlowiseAI open source tool for easily building LLM applications. An Access Control Error vulnerability exists in Flowise 3.0.5 and prior versions, which stems from the forgot-password endpoint returning a password reset token without authentication, and can be exploited by an attacke...
Siemens Mobility Trainguard End-of-Train and Head-of-Train Weak Authentication Vulnerability
The Trainguard End-of-Train EOT is a new generation of end-of-train devices for connecting on-board telemetry.The Trainguard Head-of-Train HOT is a front-of-train device. These devices communicate using the S-9152 standard. A weak authentication vulnerability exists in Siemens Mobility Trainguard...
D-Link DIR-823x Command Injection Vulnerability
The D-Link DIR-823X is a wireless router from China's AUO D-Link. A command injection vulnerability exists in the D-Link DIR-823x 250416 and prior versions, which stems from the failure to properly filter constructed command special characters, commands, etc. in the parameter targetaddr in the fi...
Grocery Sales and Inventory System SQL Injection Vulnerability (CNVD-2026-38236)
Grocery Sales and Inventory System is a software application for grocery sales and inventory management. The system has a SQL injection vulnerability, which stems from the lack of validation for external SQL statements in the parameter ID within the file/ajax.php?action=savecustomer. Attackers ca...
Wavlink WL-WN578W2 Authorization Issues Vulnerability
The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. An authorization issue vulnerability exists in Wavlink WL-WN578W2 version 221110, which stems from improper privilege management of the parameter newpass/confpass in the file /sysinit.html, which can be exploited by an attacker t...
CRMEB server-side request forgery vulnerability in Xi'an Zhongbang Network Technology Co.
CRMEB is a Java mall system . CRMEB 5.6.1 and previous versions of server-side request forgery vulnerability , the vulnerability stems from the file app/services/out/OutAccountServices.php parameter pushtokenurl does not implement a sufficient authentication mechanism to confirm the source of the...
Unmark Code Issues Vulnerabilities
Unmark is an open source to-do list application for bookmarking. A code issue vulnerability exists in Unmark 1.9.3 and earlier versions, which stems from incorrect manipulation of the parameter url in the file /application/controllers/Marks.php, which could lead to server-side request forgery. An...
Gazelle Cross-Site Scripting Vulnerability
Gazelle is a web framework for private BitTorrent trackers. Gazelle suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Message in the file /sections/tools/managers/changelog.php, which can be...
RuoYi License Issue Vulnerability
RuoYi is a backend management system for individual developers in China RuoYi RuoYi. RuoYi 4.8.1 and previous versions of the authorization problem vulnerability, the vulnerability stems from the file / system / role / authUser / cancelAll in the parameter roleId and userIds there is improper...
Unspecified vulnerability in SueamCMS (CNVD-2025-21440)
SueamCMS is SueamCMS open source a content management system . A security vulnerability exists in SueamCMS version 0.1.2, which can be exploited by an attacker and may lead to the execution of arbitrary code...
Unmark searchform.php file cross-site scripting vulnerability
Unmark is an open source to-do list application for bookmarking. Unmark 1.9.3 and earlier versions suffer from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by parameter q in the file...
Unmark Marks.php file cross-site scripting vulnerability
Unmark is an open source to-do list application for bookmarking. Unmark 1.9.3 and earlier versions have a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Title in the file /application/controllers/Marks.php,...
Beauty Parlour Management System view-enquiry.php File SQL Injection Vulnerability
Beauty Parlour Management System is an application system. Beauty Parlour Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter viewid in file /admin/view-enquiry.php. An attacker can exploi...
Wavlink WL-WN578W2 sub_404DBC Function OS Command Injection Vulnerability
The Wavlink WL-WN578W2 is a wireless repeater from China's Wavlink. The Wavlink WL-WN578W2 221110 version has an operating system command injection vulnerability, which originates from the parameter macAddr in the sub404DBC function of the file /cgi-bin/wireless.cgi that fails to correctly filter...
Unspecified Vulnerability in AXIS BANK Axis Mobile App
AXIS BANK Axis Mobile App is a mobile banking application by AXIS BANK India. AXIS BANK Axis Mobile App version 9.9 has a security vulnerability that can be exploited by an attacker that may lead to the disclosure of account information, balances, transaction history and other data...
Unmark info.php file cross-site scripting vulnerability
Unmark is an open source to-do list application for bookmarking. A cross-site scripting vulnerability exists in Unmark 1.9.3 and earlier versions, which stems from the lack of effective filtering and escaping of user-supplied data in the parameter Title in the file application/views/marks/info.ph...
Online Shopping Portal Cross-Site Scripting Vulnerability
Online Shopping Portal is an online store. A cross-site scripting vulnerability exists in Online Shopping Portal, which can be exploited by an attacker to cause a cross-site scripting attack, due to a failure to clean inputs to the quantity parameter when adding items to the shopping cart...
Axios Resource Management Error Vulnerability
Axios is Axios open source a Promise asynchronous programming a solution based on the HTTP client . Axios versions prior to 1.11.0 have a resource management error vulnerability that stems from unrestricted memory allocation when handling data scheme URLs, which can be exploited by an attacker to...
WordPress WP Easy FAQs plugin cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site scripting...
Unspecified vulnerability in Xen (CNVD-2025-21331)
Xen is an open source virtual machine monitor product from Xen Open Source. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. Xen has a security vulnerability that can be exploited by...
Unspecified vulnerability in Xen (CNVD-2025-21370)
Xen is an open source virtual machine monitor product from Xen Open Source. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. Xen has a security vulnerability that can be exploited by...
Unspecified Vulnerability in Microsoft Visual Studio Code (CNVD-2025-22193)
Microsoft Visual Studio Code is an open source code editor from Microsoft USA. A security vulnerability exists in Microsoft Visual Studio Code that originates from insufficiently filtered or validated user-supplied data and can be exploited by an attacker to remotely execute arbitrary code...
Unspecified vulnerability in Xen (CNVD-2025-21353)
Xen is an open source virtual machine monitor product from Xen Open Source. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. Xen has a security vulnerability that can be exploited by...
Unspecified vulnerability in Xen (CNVD-2025-21354)
Xen is an open source virtual machine monitor product from Xen Open Source. The product enables different and incompatible operating systems to run on the same computer and supports migration at runtime to ensure uptime and avoid downtime. Xen has a security vulnerability that can be exploited by...
Delta Electronics DIALink Directory Traversal Vulnerability (CNVD-2025-22948)
Delta Electronics DIALink is an industrial automation communication gateway from Delta Electronics China. A directory traversal vulnerability exists in Delta Electronics DIALink, which can be exploited by an attacker to cause authentication bypass...
openDCIM Cross-Site Scripting Vulnerability
openDCIM is openDCIM open source a data center inventory management DCIM application . openDCIM version 23.04 cross-site scripting vulnerability , the vulnerability stems from the file /scripts/uploadifive.php parameter Filedata on the user-supplied data lack of effective filtering and escaping ,...
WordPress Mixtape plugin cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site scripting...
Delta Electronics DIALink Directory Traversal Vulnerability (CNVD-2025-22947)
Delta Electronics DIALink is an industrial automation communication gateway from Delta Electronics China. A directory traversal vulnerability exists in Delta Electronics DIALink, which can be exploited by an attacker to cause authentication bypass...
JEPaaS Access Control Error Vulnerability
JEPaaS is a low-code rapid development platform for building enterprise-class applications. A security vulnerability exists in JEPaaS 7.2.8, which stems from the doFilterInternal function of the Filter Handler component not properly enforcing access control. The vulnerability can be exploited by ...
InstantCMS Code Issues Vulnerabilities
InstantCMS is a free and open source content management system. A security vulnerability exists in InstantCMS 2.17.3 and earlier versions, which stems from the package parameter in the installer function not effectively filtering user input. The vulnerability can be exploited by an attacker to sc...