Archive
22 June 2025
Vulnerabilities first published on this day (UTC), newest first.
10 results · Clear filters · Feed
-
Medium 5.3
CodeMirror Markdown Mode markdown.js redos
A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate th…
-
Medium 5.3
MarkText index.js getRecommendTitleFromMarkdownString redos
A vulnerability has been found in MarkText up to 0.17.1 and classified as problematic. Affected by this vulnerability is the function getRecommendTitleFromMarkdownString of the file marktext/src/main/utils/index.js. The manipulation leads to inefficient regul…
-
Medium 6.3
TOTOLINK A3002R formWlSiteSurvey os command injection
A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It i…
-
Medium 4.7
code-projects Online Shopping Store action.php sql injection
A vulnerability was found in code-projects Online Shopping Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument cat_id/brand_id/keyword/proId/pid leads to sql inje…
-
Medium 4.3
CodeAstro Expense Management System cross-site request forgery
A vulnerability was found in CodeAstro Expense Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely.
-
Medium 4.3
SourceCodester Gym Management System cross-site request forgery
A vulnerability was found in SourceCodester Gym Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has …
-
Medium 4.3
code-projects School Fees Payment System fees.php cross site scripting
A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /fees.php. The manipulation of the argument transcation_remark leads to cross site scripting. It is possi…
-
Medium 6.3
ageerle ruoyi-ai SseServiceImpl.java upload unrestricted upload
A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. …
-
Medium 6.3
diyhi bbs API ForumManageAction.java add path traversal
A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path travers…
-
Medium 4.3
Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command.