Archive
28 July 2025
Vulnerabilities first published on this day (UTC), newest first.
124 results · Feed
-
High 7.3
code-projects Exam Form Submission delete_s1.php sql injection
A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s1.php. The manipulation of the argument ID leads to sql injection. The attack may b…
-
Medium 4.8
Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit Preview
The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. RTE properties (text f…
-
Medium 4.8
Stored Cross-Site Scripting in Episerver Content Management System (CMS) Media Selection Preview
The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. ContentReference prope…
-
Medium 4.8
Stored Cross-Site Scripting in Episerver Content Management System (CMS) Admin Dashboard
The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard of…
-
Medium 6.3CVE-2025-8266 Scanner template
yanyutao0402 ChanCMS collect.js getArticle deserialization
A vulnerability has been found in yanyutao0402 ChanCMS up to 3.1.2 and classified as critical. Affected by this vulnerability is the function getArticle of the file app/modules/cms/controller/collect.js. The manipulation of the argument targetUrl leads to des…
-
Medium 4.7
299Ko CMS File Management view unrestricted upload
A vulnerability classified as critical has been found in 299Ko CMS 2.0.0. This affects an unknown part of the file /admin/filemanager/view of the component File Management. The manipulation leads to unrestricted upload. It is possible to initiate the attack r…
-
Medium 4.3
yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos
A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expressio…
-
High 7.3
Vaelsys VaelsysV4 User Creation vgrid_server.php improper authorization
A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be perfor…
-
Low 3.1
Vaelsys VaelsysV4 Web interface vgrid_server.php weak hash
A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The at…
-
High 7.3
Vaelsys VaelsysV4 Web interface vgrid_server.php execute_DataObjectProc os command injection
A vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /grid/vgrid_server.php of the component Web interface. Such manipulation of the argument xajaxargs leads to os com…
-
Medium 5.3
Cool Mo Maigcal Number App com.sdmagic.number AndroidManifest.xml improper export of android application components
A vulnerability, which was classified as problematic, has been found in Cool Mo Maigcal Number App up to 1.0.3 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.sdmagic.number. The manipulati…
-
High 8.2
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invali…
-
Medium 5.3
Lobby Universe Lobby App com.maverick.lobby AndroidManifest.xml improper export of android application components
A vulnerability classified as problematic was found in Lobby Universe Lobby App up to 2.8.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.maverick.lobby. The manipulation leads to i…
-
Medium 6.3
code-projects Online Ordering System product.php unrestricted upload
A vulnerability classified as critical has been found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/product.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch th…
-
High 7.3
code-projects Exam Form Submission register.php unrestricted upload
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /register.php. The manipulation of the argument image leads to unrestricted upload. The attack may be in…
-
Medium 6.3
Campcodes Courier Management System view_parcel.php sql injection
A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view_parcel.php. The manipulation of the argument ID leads to sql injection. The attack can be initiat…
-
High 7.3
code-projects Exam Form Submission delete_s6.php sql injection
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete_s6.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the …
-
High 7.3
code-projects Exam Form Submission delete_s5.php sql injection
A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s5.php. The manipulation of the argument ID leads to sql injection. The attack may b…
-
High 7.3
code-projects Exam Form Submission delete_s4.php sql injection
A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s4.php. The manipulation of the argument ID leads to sql injection. The a…
-
High 7.3
code-projects Exam Form Submission update_s4.php sql injection
A vulnerability, which was classified as critical, was found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s4.php. The manipulation of the argument credits leads to sql injection. It is possible to launch…
-
High 7.3
code-projects Exam Form Submission update_s3.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s3.php. The manipulation of the argument credits leads to sql injection. The atta…
-
High 7.3
code-projects Online Ordering System signup.php sql injection
A vulnerability classified as critical was found in code-projects Online Ordering System 1.0. This vulnerability affects unknown code of the file /signup.php. The manipulation of the argument firstname leads to sql injection. The attack can be initiated remot…
-
Low 2.9
sequoia-openpgp vulnerable to out-of-bounds array access leading to panic
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
-
Medium 4.1
gix-transport code execution vulnerability
The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult …
-
Medium 4.5
`openssl` `X509VerifyParamRef::set_host` buffer over-read
The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.
-
Low 2.9
buffered-reader vulnerable to out-of-bounds array access leading to panic
The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.
-
Medium 5.9
`ed25519-dalek` Double Public Key Signing Function Oracle Attack
The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.
-
High 7.1
Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 all…
-
High 7.5
Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System …
-
High 7.5
Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management …
-
High 7.1
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers t…
-
High 7.5
Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 all…
-
High 7.1
Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System …
-
High 7.1
Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management S…
-
High 7.5
Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management Sys…
-
High 7.1
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 a…
-
High 7.1
Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management Sys…
-
High 7.5
Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System…
-
High 8.8
An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker…
-
Critical 9.8
An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. When a new SD card is inserted into the dashcam, the…