Archive
27 April 2025
Vulnerabilities first published on this day (UTC), newest first.
34 results · Clear filters · Feed
-
Medium 5.8
Quick Agent V3 and Quick Agent V2 contain an issue with improper restriction of communication channel to intended endpo…
-
Medium 6.5
Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('P…
-
Medium 6.3CVE-2025-3987 EPSS 11%
TOTOLINK N150RT formWsc command injection
A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initia…
-
Medium 4.3
Apereo CAS CasConfigurationMetadataServerController.java redos
A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfiguratio…
-
Medium 5.0
Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection
A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimple…
-
Medium 4.7CVE-2025-3983 EPSS 18%
AMTT Hotel Broadband Operation System nlog_down.php command injection
A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manager/system/nlog_down.php. The manipulation of the argument ProtocolType leads t…
-
Medium 4.3
nortikin Sverchok Set Property Mk2 Node getsetprop_mk2.py SvSetPropNodeMK2 prototype pollution
A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/nodes/object_nodes/getsetprop_mk2.py of the component Set Property Mk2 Node. The manipulation leads to i…
-
Medium 4.3
wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System details improper authorization
A vulnerability, which was classified as problematic, has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This issue affects some unknown processing of the file /v1/prescription/details/. The manipulation leads to improper authoriz…
-
Medium 4.3
wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System list improper authorization
A vulnerability classified as problematic was found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This vulnerability affects unknown code of the file /v1/prescription/list. The manipulation leads to improper authorization. The attack can be…
-
Medium 4.3
dazhouda lecms Password Change index.php cross-site request forgery
A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-password-ajax-1 of the component Password Change Handler. The manipulation leads to cross-site request forgery. It is poss…
-
Medium 4.3
dazhouda lecms user_set.htm information disclosure
A vulnerability was found in dazhouda lecms 3.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/view/default/user_set.htm. The manipulation leads to information disclosure. The attack may be launched…
-
Medium 4.3
iteachyou Dreamer CMS Attachment download improper authorization
A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/attachment/download of the component Attachment Handler. The manipulation of the…
-
Medium 5.3
ScriptAndTools eCommerce-website-in-PHP subscriber-csv.php information disclosure
A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file /admin/subscriber-csv.php. The manipulation leads to information disclosure. The attack may be initi…
-
Medium 6.3CVE-2025-3969 Public exploit
codeprojects News Publishing Site Dashboard Edit Category Page edit-category.php unrestricted upload
A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-category.php of the component Edit Category Page. The manipulation of the argument catego…
-
Medium 6.3
codeprojects News Publishing Site Dashboard api.php sql injection
A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /api.php. The manipulation of the argument cat_id leads to sql injection. The attack can be ini…
-
Medium 5.7
CatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race Condition
An issue in CatoNetworks CatoClient before v.5.8.0 allows attackers to escalate privileges and achieve a race condition (TOCTOU) via the PrivilegedHelperTool component.
-
Medium 5.4
itwanger paicoding Article post improper authorization
A vulnerability was found in itwanger paicoding 1.0.3. It has been classified as critical. This affects an unknown part of the file /article/api/post of the component Article Handler. The manipulation of the argument articleId leads to improper authorization.…
-
Medium 4.3
itwanger paicoding Browsing History home information disclosure
A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/home?userId=1&homeSelectType=read of the component Browsing History Handler. The manipulation leads to …
-
Medium 4.3
withstars Books-Management-System Article del cross-site request forgery
A vulnerability, which was classified as problematic, was found in withstars Books-Management-System 1.0. Affected is an unknown function of the file /api/article/del of the component Article Handler. The manipulation leads to cross-site request forgery. It i…
-
Medium 5.4
Stored-XSS
For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties.
-
Medium 4.3
withstars Books-Management-System reader_delete.html cross-site request forgery
A vulnerability was found in withstars Books-Management-System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /reader_delete.html. The manipulation leads to cross-site request forgery. The atta…
-
Medium 6.3
opplus springboot-admin SysLogDao.xml sql injection
A vulnerability was found in opplus springboot-admin 1.0 and classified as critical. This issue affects some unknown processing of the file \src\main\resources\mapper\sys\SysLogDao.xml. The manipulation of the argument order leads to sql injection. The attack…
-
Medium 6.3
201206030 novel-cloud BookInfoMapper.xml RestResp sql injection
A vulnerability has been found in 201206030 novel-cloud 1.4.0 and classified as critical. This vulnerability affects the function RestResp of the file novel-cloud-master/novel-book/novel-book-service/src/main/resources/mapper/BookInfoMapper.xml. The manipulat…
-
Medium 6.5
ZTE GoldenDB Database product has SQL injection vulnerabilities in multiple interfaces
There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to inject commands and extract sensitive database information.
-
Medium 6.5
ZTE GoldenDB Database product has an SQL injection vulnerability
There is a SQL injection vulnerability in the GoldenDB database product. Attackers can inject commands to extract database information.
-
Medium 5.4
ZTE GoldenDB Database product has a privilege escalation vulnerability
There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypass privilege restrictions and delete content.
-
Medium 4.9
ZTE GoldenDB Database product has an information disclosure vulnerability
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
-
Medium 4.1
ZTE GoldenDB Database product has an input validation vulnerability
There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the system's sensitive information.
-
Medium 6.3
codeprojects Patient Record Management System edit_rpatient.php.php sql injection
A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. This affects an unknown part of the file /edit_rpatient.php.php. The manipulation of the argument id/lastname leads to sql injection. It is poss…
-
Medium 4.9CVE-2025-46673 Public exploit
NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a …
-
Medium 5.6
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffe…
-
Medium 5.6
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overf…
-
Medium 5.4
Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI.
-
Medium 5.0
Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats …