Archive
7 July 2025
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
Critical 9.1
Unauthorized Inspection of Protected Variables in AbuseFilter
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
-
Critical 9.1
Unauthorized Disclosure of IP Reputation in AbuseFilter
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.
-
Critical 9.8
WeGIA allows SQL Injection in html/funcionario/profile_funcionario.php (id_funcionario parameter)
WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter is not properly sanitized or validated before being used in a SQL query, …
-
Critical 9.8
Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability
Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interaction wit…
-
Critical 9.8
Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability
Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interaction with this libra…
-
Critical 9.8
Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability
Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. Authentication is not required to…
-
Critical 9.8
Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability
Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit …
-
Critical 9.4
Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability
Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations…
-
Critical 9.8
Unsanitized Input in langgenius/dify
langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseI…
-
Critical 9.1
Stored Cross-site Scripting (XSS) in lunary-ai/lunary
lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into the `v1/runs/ingest` endpoint by adding an empty `citations` field, triggering a code path where `d…
-
Critical 9.1
OS Command Injection via Config Upload in WebUI
A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') while uploading a config file via webUI.
-
Critical 10.0
WAGO: Vulnerability in WAGO Device Sphere
A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices.
-
Critical 9.8
An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, a…
-
Critical 9.1
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler …
-
Critical 9.8
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_str…
-
Critical 9.8
Insufficient security mechanisms for created containers in educoder challenges v1.0 allow attackers to execute arbitrar…
-
Critical 9.8
employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the l…
-
Critical 9.8
flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not con…
-
Critical 9.8
fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and …
-
Critical 9.8
Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a …
-
Critical 9.8
JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured …
-
Critical 9.1
In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1…