Archive
23 June 2025
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
Medium 4.3
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a speci…
-
High 7.3
code-projects Inventory Management System fetchSelectedCategories.php sql injection
A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php_action/fetchSelectedCategories.php. The manipulation of the argument categoriesId leads to sql i…
-
High 7.3
code-projects Inventory Management System changePassword.php sql injection
A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php_action/changePassword.php. The manipulation of the argument user_id leads to sql injection. Th…
-
High 7.3
code-projects Inventory Management System createCategories.php sql injection
A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_action/createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection.…
-
High 7.3
code-projects Inventory Management System editCategories.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /php_action/editCategories.php. The manipulation of the argument editCategorie…
-
Low 3.3
vstakhov libucl ucl_parser.c ucl_parse_multiline_string heap-based overflow
A vulnerability classified as problematic was found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_parse_multiline_string of the file src/ucl_parser.c. The manipulation leads to heap-based buffer overflow. The attack needs …
-
Low 3.3
HTACG tidy-html5 alloc.c defaultAlloc memory leak
A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has be…
-
Low 3.3
HTACG tidy-html5 parser.c prvTidyParseNamespace assertion
A vulnerability was found in HTACG tidy-html5 5.8.0. It has been rated as problematic. This issue affects the function prvTidyParseNamespace of the file src/parser.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The explo…
-
Low 3.3
HTACG tidy-html5 parser.c InsertNodeAsParent null pointer dereference
A vulnerability was found in HTACG tidy-html5 5.8.0. It has been declared as problematic. This vulnerability affects the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to appr…
-
High 8.4
An issue was discovered in Sensopart VISOR Vision Sensors before 2.10.0.2 allows local users to perform unspecified act…
-
Critical 9.8
An issue in NCR ITM Web terminal v.4.4.0 and v.4.4.4 allows a remote attacker to execute arbitrary code via a crafted s…
-
Critical 9.8
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive inform…
-
Medium 4.3
An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpo…
-
Critical 9.8
A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecti…
-
Critical 9.8
Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted…
-
Critical 9.8
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to …
-
Critical 9.8
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive inform…
-
Critical 9.8
A settings manipulation vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands, in…
-
High 8.1
An issue in NCR Terminal Handler v1.5.1 allows low-level privileged authenticated attackers to arbitrarily deactivate, …
-
Medium 5.7
In WhiteBeam 0.2.0 through 0.2.1 before 0.2.2, a user with local access to a server can bypass the allow-list functiona…
-
High 7.5
PHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to Directory Traversal in update-teacher-pic.php.
-
High 7.5
PHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to Directory Traversal in update-class-pic.php.
-
High 7.5
A vulnerability in the WebApl component of Mitel OpenScape Xpressions through V7R1 FR5 HF43 P913 could allow an unauthe…
-
Medium 6.1CVE-2025-48700 Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vu…
KEV Apr 20, 2026 -
Critical 9.8
SQL Injection vulnerability in Beakon Software Beakon Learning Management System Sharable Content Object Reference Mode…
-
High 7.5
An issue in Texas Instruments LP-CC2652RB SimpleLink CC13XX CC26XX SDK 7.41.00.17 allows attackers to cause a Denial of…
-
High 7.2
Mitel OpenScape Accounting Management through V5 R1.1.0 could allow an authenticated attacker with administrative privi…
-
High 8.4
Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.
-
Medium 6.4
Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyo…
-
Medium 5.8
MLFlow SSRF via gateway_proxy_handler
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
-
Critical 9.9
In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to ach…
-
Low 2.7
spytrap-adb Omission of Security-relevant Information
In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.
-
Low 2.7
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (F…
-
High 7.4
Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access …