Archive
8 July 2025
Vulnerabilities first published on this day (UTC), newest first.
440 results · Feed
-
High 8.2
Data Inference in Now Platform via Conditional ACLs
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users…
-
High 7.3
code-projects Library System approve.php sql injection
A vulnerability was found in code-projects Library System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /approve.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely…
-
High 7.2CVE-2025-6771 EPSS 23%
OS command injection in Ivanti Endpoint Manager
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution
-
Medium 5.5
SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote …
-
Medium 6.6
CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows…
-
Medium 6.5
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local auth…
-
High 7.3
code-projects Library System books.php sql injection
A vulnerability was found in code-projects Library System 1.0. It has been classified as critical. This affects an unknown part of the file /user/teacher/books.php. The manipulation of the argument Search leads to sql injection. It is possible to initiate the…
-
Medium 5.8
HP Support Assistant – Potential Escalation of Privilege
A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file deletion.
-
High 7.2CVE-2025-6770 EPSS 20%
OS command injection in Ivanti Endpoint Manager
OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution
-
Medium 5.5
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy S…
-
Medium 6.9
Press has a potential 2FA bypass
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed …
-
High 7.3
Campcodes Sales and Inventory System customer_account.php sql injection
A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/customer_account.php. The manipulation of the argument Customer leads to sql injection. T…
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version …
-
Medium 4.3
IBM Sterling File Gateway information disclosure
IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 could disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system.
-
Medium 6.3
Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Iv…
-
Medium 5.4
IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitr…
-
Medium 5.4
CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages
The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered without proper escaping. Attackers can exploit this by appending ?uselang=x-xss to the URL, causing r…
-
High 7.2
SQL injection in Ivanti Endpoint Manager
SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database
-
High 7.5
node-code-sandbox-mcp has a Sandbox Escape via Command Injection
node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaScript. Prior to 1.3.0, a command injection vulnerability exists in the node-code-sandbox-mcp MCP Server. The vulnerabil…
-
Medium 6.4
IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed a…
-
High 8.4
Improper Encryption in Ivanti Endpoint Manager
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
-
High 8.4
Improper Encryption in Ivanti Endpoint Manager
Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
-
Medium 6.8
A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.…
-
Medium 4.9
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 a…
-
Low 2.6
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Forti…
-
Medium 4.3
itsourcecode Student Transcript Processing System edit.php cross site scripting
A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/modules/subject/edit.php. The manipulation of the argument pre…
-
High 7.0
EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support p…
-
High 8.2
Dell Client Platform BIOS contains an Improper Access Control Applied to Mirrored or Aliased Memory Regions vulnerabili…
-
Medium 6.3
code-projects Staff Audit System test.php unrestricted upload
A vulnerability, which was classified as critical, was found in code-projects Staff Audit System 1.0. Affected is an unknown function of the file /test.php. The manipulation of the argument uploadedfile leads to unrestricted upload. It is possible to launch t…
-
High 7.5
Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf
A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, al…
-
High 7.3
code-projects Staff Audit System login.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Staff Audit System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument User leads to sql injection. The attack may be initi…
-
High 7.3
code-projects Library System add-teacher.php sql injection
A vulnerability classified as critical was found in code-projects Library System 1.0. This vulnerability affects unknown code of the file /add-teacher.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely.…
-
High 7.8
A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC…
-
High 7.8
Out-of-bounds Write in Video
Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
-
High 7.8
Buffer Copy Without Checking Size of Input in Computer Vision
Memory corruption while processing packet data with exceedingly large packet.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while handling beacon frames with invalid IE header length.
-
High 7.8
Use After Free in DSP Service
Memory corruption during sub-system restart while processing clean-up to free up resources.
-
High 7.8
Buffer Over-read in Camera
Memory corruption during the image encoding process.
-
High 7.8
Buffer Copy Without Checking Size of Input in Core Services
Memory corruption while processing data packets in diag received from Unix clients.
-
High 7.8
Double Free in Windows WLAN Host
Memory corruption while processing command message in WLAN Host.