Archive
9 May 2025
Vulnerabilities first published on this day (UTC), newest first.
152 results · Feed
-
High 7.3
Project Worlds Car Rental Project approve.php sql injection
A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be…
-
High 7.3
Project Worlds Car Rental Project signup.php sql injection
A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotel…
-
High 7.0
Patch My PC Home Updater System.IO uncontrolled search path
A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0. It has been rated as critical. This issue affects some unknown processing in the library advapi32.dll/BCrypt.dll/comctl32.dll/crypt32.dll/dwmapi.dll/gdi32.dll/gdiplus.dll/imm32.dll/iphlpapi.…
-
Medium 6.3
D-Link DIR-619L wake_on_lan command injection
A vulnerability was found in D-Link DIR-619L 2.04B04. It has been declared as critical. This vulnerability affects the function wake_on_lan. The manipulation of the argument mac leads to command injection. The attack can be initiated remotely. The vendor was …
-
Medium 6.3
D-Link DIR-619L formSysCmd command injection
A vulnerability was found in D-Link DIR-619L 2.04B04. It has been classified as critical. This affects the function formSysCmd. The manipulation of the argument sysCmd leads to command injection. It is possible to initiate the attack remotely. The vendor was …
-
Critical 9.8
WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through th…
-
Critical 9.8
WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and ema…
-
High 8.8
D-Link DIR-619L formSetWizard2 buffer overflow
A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this issue is the function formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The vendor was cont…
-
High 8.8
D-Link DIR-619L formSetWAN_Wizard52 buffer overflow
A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this vulnerability is the function formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. T…
-
High 8.8
D-Link DIR-619L formSetEasy_Wizard buffer overflow
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04. Affected is the function formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The vendor w…
-
High 8.8
D-Link DIR-619L formEasySetupWizard3 buffer overflow
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04. This issue affects the function formEasySetupWizard3. The manipulation of the argument wan_connected leads to buffer overflow. The attack may be initiated remotely. …
-
High 8.8
D-Link DIR-619L formEasySetupWizard buffer overflow
A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The vendor was c…
-
High 8.0
H3C GR-5400AX aspForm Edit_List_SSID buffer overflow
A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical. This vulnerability affects the function Edit_List_SSID of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack needs to …
-
Medium 6.3
D-Link DIR-605L wake_on_lan command injection
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The vendor was contacted ear…
-
Medium 6.8
An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain…
-
High 8.8
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability.
-
High 8.8
Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services with…
-
Critical 9.8
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits …
-
High 8.8
Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conv…
-
Critical 9.8
SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload i…
-
Critical 9.8
SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin_phpmyadmin.php.
-
Critical 9.8
Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthe…
-
Critical 9.8
SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_delivery_update.php via the…
-
Critical 9.8
SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_order_customer_update.php v…
-
Critical 9.8
SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_payment_update.php via the …
-
Critical 9.8
Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter.
-
Critical 9.8
PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file. At…
-
Critical 9.1
Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.
-
Low 2.9
libsql-sqlite3-parser crash due to invalid UTF-8 input
dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.
-
Low 2.9
trailer mishandles allocating with a size of zero
lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.
-
Low 2.9
wgp race condition in inner::drop
inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.
-
High 7.1
Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set,…