Tenda G3 formAddVpnUsers function buffer overflow vulnerability

Tenda G3 is a Qos Vpn router from Tenda China. A buffer overflow vulnerability exists in Tenda G3 v3.0brV15.11.0.17, which is caused by the vpnUsers parameter in the formAddVpnUsers function failing to correctly validate the length of the input data, and can be exploited by an attacker to execute...

Microsoft Excel Code Execution Vulnerability (CNVD-2025-21395)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...

Fortinet FortiDDoS-F Operating System Command Injection Vulnerability

Fortinet FortiDDoS-F is a distributed denial-of-service protection system from the U.S. company Fiat Fortinet. Fortinet FortiDDoS-F suffers from an operating system command injection vulnerability that stems from improper neutralization of special elements, which can be exploited by an attacker t...

SAP NetWeaver Application Server Java Access Control Error Vulnerability (CNVD-2025-21204)

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used to develop and run Java EE applications. An Access Control Error vulnerability exists in SAP NetWeaver Application Server Java, which stems...

Adobe Substance3D Viewer Out-of-Bounds Write Vulnerability (CNVD-2025-21422)

Adobe Substance3D Viewer is a stand-alone desktop application for viewing and editing 3D files from Audobee Adobe USA. Adobe Substance3D Viewer suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to execute arbitrary code in the current user's environment...

UTT 1200GW Buffer Overflow Vulnerability

The UTT 1200GW is an enterprise-grade wireless router from Atech Technology UTT designed to meet the networking needs of small to medium-sized businesses or large space office environments. The UTT 1200GW suffers from a buffer overflow vulnerability that stems from insufficient boundary validatio...

Siemens SINAMICS G220, SINAMICS S210 and SINAMICS S200 Elevation of Privilege Vulnerability

SINAMICS G220 is a high-performance, single-axis variable-frequency drive from Siemens.SINAMICS S210 is a high-performance, single-axis servo drive from Siemens.SINAMICS S200 is a high-performance, cost-effective, single-axis AC servo drive from Siemens for standard automation applications...

Online Event Judging System /review_search.php File SQL Injection Vulnerability

Online Event Judging System is an online event judging system. Online Event Judging System suffers from a SQL injection vulnerability, which originates from the /reviewsearch.php file not securely filtering the txtsearch parameter. An attacker can exploit this vulnerability to remotely execute...

Online Event Judging System index.php File SQL Injection Vulnerability

Online Event Judging System is an online event judging system. The Online Event Judging System suffers from a SQL injection vulnerability that originates from the /index.php file not securely filtering the Username parameter. An attacker can exploit this vulnerability by constructing a malicious...

Command Injection Vulnerability in RAISECOM DR5374 at RISECOM Technology Development Co.

The RAISECOM DR5374 is a router for home scenarios. A command injection vulnerability exists in the RAISECOM DR5374, which can be exploited by an attacker to execute arbitrary commands as root...

IBM Concert Software Buffer Overflow Vulnerability

IBM Concert Software is IBM's generative AI-driven automated application management and monitoring tool based on the WatsonX platform, focused on optimizing the operational efficiency and reliability of applications. IBM Concert Software suffers from a buffer overflow vulnerability that originate...

Dell PowerScale OneFS Privilege Permission and Access Control Issues Vulnerability

Dell PowerScale OneFS is an enterprise-class distributed file system from Dell. A privilege mismanagement vulnerability exists in Dell PowerScale OneFS versions prior to 9.12.0.0, which stems from the system failing to properly implement a privilege control mechanism. An attacker could exploit th...

Small CRM /get-quote.php File SQL Injection Vulnerability

Small CRM is a customer relationship management system. Small CRM suffers from a SQL injection vulnerability, which originates from the /get-quote.php file, which does not perform security filtering on the Contact parameter. An attacker can exploit this vulnerability to illegally manipulate the...

Google Android Information Disclosure Vulnerability (CNVD-2025-21366)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

WordPress Aitasi Coming Soon plugin deserialization vulnerability

WordPress Aitasi Coming Soon plugin is a plugin for creating professional coming soon pages Coming Soon or maintenance mode pages that can be built quickly without coding or design skills. The WordPress Aitasi Coming Soon plugin suffers from a deserialization vulnerability that arises from unsafe...

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CNVD-2025-23051)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. A security feature bypass vulnerability exists in Microsoft Edge Chromium-based, which can be exploited by an attacker to cause a security feature bypass...

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

Cisco Integrated Management Controller IMC is a set of software used by Cisco to manage UCS Unified Computing System, which supports HTTP, SSH access, etc., and allows operations such as powering up, shutting down and restarting the server. A cross-site scripting vulnerability exists in Cisco...

Huawei HarmonyOS audio module competitive conditions loophole

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A competitive condition vulnerability exists in the Huawei HarmonyOS audio module, which can be exploited by attackers to cause functional stability to be...

POS Point of Sale System /2512.php File Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the scripts parameter of the...

Google Android heap buffer overflow vulnerability (CNVD-2025-21351)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to gain elevated privileges on the system...

Cisco Integrated Management Controller Input Validation Error Vulnerability

Cisco Integrated Management Controller IMC is a set of software used by Cisco to manage UCS Unified Computing System, which supports HTTP, SSH access, etc., and allows operations such as powering up, shutting down and restarting the server. An input validation error vulnerability exists in Cisco...

POS Point of Sale System /dom_data_th.php File Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter scripts in the file...

Cisco NX-OS Software Operating System Command Injection Vulnerability

Cisco NX-OS Software is a set of data center-grade operating system software for switches from the U.S. company Cisco Cisco. Cisco NX-OS Software suffers from an operating system command injection vulnerability that stems from insufficient user input validation, which can be exploited by an...

Online Course Registration semester parameter SQL injection vulnerability

Online Course Registration is an online course registration system. A SQL injection vulnerability exists in Online Course Registration due to a lack of validation of externally entered SQL statements by the parameter semester. An attacker can exploit this vulnerability to execute illegal SQL...

POS Point of Sale System /complex_header_2.php file cross-site scripting vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the scripts parameter of the...

Grocery Sales and Inventory System Cross-site Scripting Vulnerability (CNVD-2026-38240)

Grocery Sales and Inventory System is a software application for grocery sales and inventory management. The system has a cross-site scripting vulnerability, which stems from the lack of effective filtering and escaping of data provided by users due to the parameter “page”. No detailed informatio...

Grocery Sales and Inventory System SQL Injection Vulnerability (CNVD-2026-38238)

Grocery Sales and Inventory System is a system for grocery sales and inventory management. The Grocery Sales and Inventory System has a SQL injection vulnerability, which stems from the lack of validation for external input SQL statements in the /ajax.php?action=deletesales file’s parameters...

D-Link DIR-825 ping6_ipaddr parameter buffer overflow vulnerability

D-Link DIR-825 is a dual-band wireless router for SMB and SOHO environments from AUO D-Link, supporting 2.4GHz and 5GHz bands at the same time to meet the demand for multi-device HD video transmission. The D-Link DIR-825 suffers from a buffer overflow vulnerability that originates from the...

POS Point of Sale System 6776.php File Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the scripts parameter of the...

POS Point of Sale System /empty_table.php File Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter scripts in the file...

Huawei HarmonyOS runtime interpreter module out-of-bounds read vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An out-of-bounds read vulnerability exists in the Huawei HarmonyOS runtime interpreter module, which can be exploited by an attacker to cause an availability...

Google Android Classic Buffer Overflow Vulnerability

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a classic buffer overflow vulnerability that can be exploited by an attacker to cause local information disclosure...

POS Point of Sale System dom_data_two_headers.php File Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability, which originates from the lack of effective filtering and escaping of user-supplied data in the parameter scripts in the file...

POS Point of Sale System /dymanic_table.php File Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the parameter scripts in the file...

Huawei HarmonyOS device standby module competitive conditions loophole

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A competitive condition vulnerability exists in the Huawei HarmonyOS device standby module, which can be exploited by an attacker to cause the system device...

Huawei HarmonyOS Ark eTS Module Denial of Service Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A denial of service vulnerability exists in the Huawei HarmonyOS Ark eTS module, which can be exploited by attackers to cause availability to be compromised...

Google Android Information Disclosure Vulnerability (CNVD-2025-21348)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that is caused by a lack of permission checking in the audio service. An attacker can exploit the vulnerability to obtain the MAC address of a nearby...

Google Android elevation of privilege vulnerability (CNVD-2025-21350)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to an obfuscated agent in the system's user interface. An attacker can exploit the vulnerability to gain elevated privileges on the system...

Google Android Out-of-Bounds Write Vulnerability (CNVD-2025-21352)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to cause local information disclosure...

Google Android Information Disclosure Vulnerability (CNVD-2025-21349)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

WordPress Admin Menu Editor plugin cross-site scripting vulnerability

WordPress Admin Menu Editor plugin is a plugin for customizing and managing backend menus, supporting reordering, hiding/showing menu items, modifying permissions and more. WordPress Admin Menu Editor plugin suffers from a cross-site scripting vulnerability that stems from insufficient input...

WordPress Plugin AdForest Has Unspecified Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in WordPress plugin AdForest 6.0.9 and prior versions, which stems from...

POS Point of Sale System /-complex_header.php file cross-site scripting vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the scripts parameter of the...

POS Point of Sale System /deferred_table.php Cross-Site Scripting Vulnerability

POS Point of Sale System is a pos point of sale system. POS Point of Sale System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the parameter scripts in the file...

Grocery Sales and Inventory System SQL Injection Vulnerability (CNVD-2026-38239)

Grocery Sales and Inventory System is a system for grocery sales and inventory management. The Grocery Sales and Inventory System has a SQL injection vulnerability, which stems from the lack of validation for external input SQL statements in the /ajax.php?action=savereceiving file’s parameters...

WordPress plugin Add to Feedly cross-site request forgery vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress plugin Add to Feedly, no detailed...

Huawei HarmonyOS home screen module privilege checksum vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege checksum vulnerability exists in the Huawei HarmonyOS home screen module, which can be exploited by an attacker to compromise usability...

Google Pixel elevation of privilege vulnerability (CNVD-2025-25480)

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that can be exploited by an attacker that may lead to physical elevation of privileges...

Google Android elevation of privilege vulnerability (CNVD-2025-28659)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to cause a local elevation of privilege...

Google Android Code Execution Vulnerability (CNVD-2025-23036)

Google Android is a Linux-based open source operating system from Google. Google Android has a code execution vulnerability that can be exploited by an attacker to execute arbitrary code on the system...