Archive
5 April 2025
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
Medium 4.3
1902756969/code-projects IKUN_Library Borrow MvcConfig.java addInterceptors access control
A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the function addInterceptors of the file MvcConfig.java of the component Borrow Handler. The manipulation leads to improper a…
-
Medium 6.3
code-projects Patient Record Management System dental_not.php sql injection
A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /dental_not.php. The manipulation of the argument itr_no leads to sql injection. It is possible to ini…
-
Medium 6.3
code-projects Patient Record Management System birthing_record.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Affected by this issue is some unknown functionality of the file /birthing_record.php. The manipulation of the argument itr_no leads to sq…
-
Medium 6.5
Net::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions
Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Xero uses the Data::Random library which specifically states that it is "Usef…
-
Medium 5.5
WebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions
WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically WebService::Xero uses the Data::Random library which specifically states tha…
-
Medium 5.5
Amon2::Auth::Site::LINE versions through 0.04 for Perl uses insecure rand() function for cryptographic functions
Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. String::Random defaults to Perl's built-in predictable random number generator, the rand() function, which is not cryptographically secure
-
Medium 5.5
Net::Dropbox::API 1.9 and earlier for Perl uses insecure rand() function for cryptographic functions
Net::Dropbox::API 1.9 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Net::Dropbox::API uses the Data::Random library which specifically states th…
-
Medium 5.5
Web::API 2.8 and earlier for Perl uses insecure rand() function for cryptographic functions
Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically Web::API uses the Data::Random library which specifically states that it is "Useful m…
-
Medium 6.7CVE-2025-30401 EPSS 21%
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type b…
-
Medium 4.3
SourceCodester Online Eyewear Shop Registration Master.php access control
A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registration Handler. The m…
-
Medium 6.3
SourceCodester Online Eyewear Shop Users.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=delete_customer. The manipulation of the argument ID leads to sql injectio…
-
Medium 5.3
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion
The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_table_rate_shipping_ro…
-
Medium 6.4
ZoomSounds <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentic…
-
Medium 4.3
Lafka Plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update
The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-…
-
Medium 6.4
AI Content Pipelines <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The AI Content Pipelines plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta…
-
Medium 5.5
IBM Maximo Application Suite file upload
IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.
-
Medium 4.8
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=…
-
Medium 4.2
In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared artic…
-
Medium 4.3
In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to …
-
Medium 4.8
A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass a…
-
Medium 4.8
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor …
-
Medium 4.0
In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are trigge…
-
Medium 4.0
Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function i…
-
Medium 4.0
A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash wh…