Archive
3 March 2025
Vulnerabilities first published on this day (UTC), newest first.
105 results · Clear filters · Feed
-
Medium 6.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 6.5
In Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of se…
-
Medium 6.3
ESAFENET DSM examExportPDF command injection
A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admin/plan/examExportPDF. The manipulation of the argument s leads to command injection. The attack can …
-
Medium 6.3
ESAFENET CDG backupLogDetail.jsp sql injection
A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. Affected is an unknown function of the file /CDGServer3/logManagement/backupLogDetail.jsp. The manipulation of the argument logTaskId leads to sql injection. …
-
Medium 6.3
Mini-Tmall ProductMapper.java select sql injection
A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall/dao/ProductMapper.java. The manipulation of the argument orderBy leads to sql injection. The attack…
-
Medium 4.3
FITSTATS Technologies AthleteMonitoring login.php cross site scripting
A vulnerability classified as problematic was found in FITSTATS Technologies AthleteMonitoring up to 20250302. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument username leads to cross site scripting. The attack …
-
Medium 5.1CVE-2023-49031 Public exploit
Directory Traversal (Local File Inclusion) vulnerability in Tikit (now Advanced) eMarketing platform 6.8.3.0 allows a r…
-
Medium 5.4
/api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018) fixed in V5.0R14.5P4…
-
Medium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope <= 8.6.4 allow remote attackers to inject a…
-
Medium 4.9
PrismJS DOM Clobbering vulnerability
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
-
Medium 5.1
tsup DOM Clobbering vulnerability
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components
-
Medium 4.9
Stage.js DOM Clobbering vulnerabilty
Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
-
Medium 5.4
A Cross-Site Scripting (XSS) vulnerability in the Rendering Engine component in Apryse WebViewer v11.1 and earlier allo…
-
Medium 5.4
seajs Cross-site Scripting vulnerability
Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package
-
Medium 6.9
In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication m…
-
Medium 4.0
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement
In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SI…
-
Medium 5.8
CGI has Denial of Service (DoS) potential in Cookie.parse
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead …
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SI…
-
Medium 6.9
OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt …
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SI…
-
Medium 6.1
Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey p…
-
Medium 6.8CVE-2025-25967 Public exploit
Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authe…
-
Medium 6.5
An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutio…
-
Medium 6.5
Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure…