Archive
18 May 2025
Vulnerabilities first published on this day (UTC), newest first.
18 results · Clear filters · Feed
-
Medium 4.3CVE-2025-4901 EPSS 79%
D-Link DI-7003GV2 HTTP Endpoint state_view.data sub_41E304 information disclosure
A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this vulnerability is the function sub_41E304 of the file /H5/state_view.data of the component HTTP Endpoint. The manipulation leads to information discl…
-
Medium 5.4
SourceCodester Student Result Management System Logo File update_system.php unlink path traversal
A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects the function unlink of the file update_system.php of the component Logo File Handler. The manipulation of the argume…
-
Medium 6.3
jammy928 CoinExchange_CryptoExchange_Java File Upload Endpoint UploadFileUtil.java uploadLocalImage path traversal
A vulnerability classified as critical has been found in jammy928 CoinExchange_CryptoExchange_Java up to 8adf508b996020d3efbeeb2473d7235bd01436fa. This affects the function uploadLocalImage of the file /CoinExchange_CryptoExchange_Java-master/00_framework/cor…
-
Medium 5.3
code-projects Police Station Management System Delete Record source.cpp remove stack-based overflow
A vulnerability was found in code-projects Police Station Management System 1.0. It has been declared as critical. Affected by this vulnerability is the function criminal::remove of the file source.cpp of the component Delete Record. The manipulation of the a…
-
Medium 5.3
code-projects Police Station Management System Display Record source.cpp display buffer overflow
A vulnerability was found in code-projects Police Station Management System 1.0. It has been classified as critical. Affected is the function criminal::display of the file source.cpp of the component Display Record. The manipulation of the argument N leads to…
-
Medium 5.3
code-projects Tourism Management System Login User LoginUser stack-based overflow
A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. This issue affects the function LoginUser of the component Login User. The manipulation of the argument username/password leads to stack-based buffer overflow…
-
Medium 5.3
code-projects Tourism Management System User Registration AddUser buffer overflow
A vulnerability has been found in code-projects Tourism Management System 1.0 and classified as critical. This vulnerability affects the function AddUser of the component User Registration. The manipulation of the argument username/password leads to buffer ov…
-
Medium 5.3
code-projects Pharmacy Management System Add Order Details take_order buffer overflow
A vulnerability, which was classified as critical, was found in code-projects Pharmacy Management System 1.0. This affects the function medicineType::take_order of the component Add Order Details. The manipulation leads to buffer overflow. An attack has to be…
-
Medium 4.3
SourceCodester Online Student Clearance System cross-site request forgery
A vulnerability, which was classified as problematic, has been found in SourceCodester Online Student Clearance System 1.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched …
-
Medium 6.3
merikbest ecommerce-spring-reactjs File Upload Endpoint admin path traversal
A vulnerability was found in merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v1/admin/ of the component File Upload Endpoin…
-
Medium 6.5
Tenda A15 ArpNerworkSet formArpNerworkSet denial of service
A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as problematic. Affected by this vulnerability is the function formArpNerworkSet of the file /goform/ArpNerworkSet. The manipulation leads to denial of service. The attack can be launche…
-
Medium 6.3CVE-2025-4866 Public exploit
weibocom rill-flow Management Console code injection
A vulnerability was found in weibocom rill-flow 0.1.18. It has been classified as critical. Affected is an unknown function of the component Management Console. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploi…
-
Medium 6.3
Advaya Softech GEMS ERP Portal studentLogin.action sql injection
A vulnerability, which was classified as critical, was found in Advaya Softech GEMS ERP Portal 2.1. This affects an unknown part of the file /studentLogin/studentLogin.action. The manipulation of the argument userId leads to sql injection. It is possible to i…
-
Medium 4.3
PHPGurukul Directory Management System searchdata.php cross site scripting
A vulnerability, which was classified as problematic, has been found in PHPGurukul Directory Management System 2.0. Affected by this issue is some unknown functionality of the file /searchdata.php. The manipulation of the argument searchdata leads to cross si…
-
Medium 6.4
Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…
-
Medium 6.3
TOTOLINK N300RH cstecgi.cgi setUploadUserData command injection
A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The atta…
-
Medium 6.3
TOTOLINK N300RH cstecgi.cgi setUnloadUserData command injection
A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name leads to command injection. It is possible…
-
Medium 6.3
TOTOLINK N300RH cstecgi.cgi CloudACMunualUpdateUserdata command injection
A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to command injecti…