Archive
July 2025
Vulnerabilities first published in this month (UTC), newest first.
1,516 results · Clear filters · Feed
-
High 7.3
code-projects Exam Form Submission delete_s5.php sql injection
A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s5.php. The manipulation of the argument ID leads to sql injection. The attack may b…
-
High 7.3
code-projects Exam Form Submission delete_s4.php sql injection
A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s4.php. The manipulation of the argument ID leads to sql injection. The a…
-
High 7.3
code-projects Exam Form Submission update_s4.php sql injection
A vulnerability, which was classified as critical, was found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s4.php. The manipulation of the argument credits leads to sql injection. It is possible to launch…
-
High 7.3
code-projects Exam Form Submission update_s3.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s3.php. The manipulation of the argument credits leads to sql injection. The atta…
-
High 7.3
code-projects Online Ordering System signup.php sql injection
A vulnerability classified as critical was found in code-projects Online Ordering System 1.0. This vulnerability affects unknown code of the file /signup.php. The manipulation of the argument firstname leads to sql injection. The attack can be initiated remot…
-
High 7.1
Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 all…
-
High 7.5
Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System …
-
High 7.5
Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management …
-
High 7.1
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers t…
-
High 7.5
Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 all…
-
High 7.1
Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System …
-
High 7.1
Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management S…
-
High 7.5
Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management Sys…
-
High 7.1
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 a…
-
High 7.1
Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management Sys…
-
High 7.5
Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System…
-
High 8.8
An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker…
-
High 8.8
TOTOLINK X15 HTTP POST Request formRoute buffer overflow
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formRoute of the component HTTP POST Request Handler. The manipulation of the argument subm…
-
High 8.8
TOTOLINK X15 HTTP POST Request formMultiAPVLAN buffer overflow
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAPVLAN of the component HTTP POST Request Handler. The manipulation of th…
-
High 8.8
TOTOLINK X15 HTTP POST Request formMapDelDevice buffer overflow
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads …
-
High 8.8
TOTOLINK X15 HTTP POST Request formMapDel buffer overflow
A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This issue affects some unknown processing of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads …
-
High 8.8
TOTOLINK X15 HTTP POST Request formFilter buffer overflow
A vulnerability has been found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr/url/vpn…
-
High 7.3
1000 Projects ABC Courier Management System report.php sql injection
A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. This affects an unknown part of the file /report.php. The manipulation of the argument From leads to sql injection. It is possible to initiate the…
-
High 7.3
code-projects Exam Form Submission dashboard.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /user/dashboard.php. The manipulation of the argument phone leads to sql injection. T…
-
High 7.3
code-projects Exam Form Submission admin sql injection
A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument email leads to sql injection. The attack can be launch…
-
High 7.3
code-projects Exam Form Submission update_s2.php sql injection
A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s2.php. The manipulation of the argument credits leads to sql injection. It is possible to launch the at…
-
High 7.3
code-projects Exam Form Submission update_s1.php sql injection
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/update_s1.php. The manipulation of the argument credits leads to sql injection. The attack may be…
-
High 7.3
code-projects Online Ordering System edit_product.php sql injection
A vulnerability was found in code-projects Online Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit_product.php. The manipulation of the argument Name leads to sql injection. The attack can …
-
High 7.3
code-projects Online Ordering System product.php sql injection
A vulnerability was found in code-projects Online Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/product.php. The manipulation of the argument Name leads to sql injection. It is possible to initiate th…
-
High 7.3
code-projects Online Ordering System delete_member.php sql injection
A vulnerability was found in code-projects Online Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_member.php. The manipulation of the argument ID leads to sql injection. The attack…
-
High 7.3
code-projects Online Ordering System user.php sql injection
A vulnerability has been found in code-projects Online Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/user.php. The manipulation of the argument un leads to sql injection. The atta…
-
High 7.3
code-projects Online Ordering System delete_user.php sql injection
A vulnerability, which was classified as critical, was found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/delete_user.php. The manipulation of the argument ID leads to sql injection. It is possible to launch …
-
High 7.6CVE-2025-5120 EPSS 31%
Sandbox Escape Vulnerability in huggingface/smolagents
A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_python_executor.py module…
-
High 7.3CVE-2025-8220 Public exploit
Engeman Web Password Recovery RecoveryPass sql injection
A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql…
-
High 7.2CVE-2025-54597 Scanner template
LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.
-
High 7.3
1000 Projects ABC Courier Management System getbyid.php sql injection
A vulnerability was found in 1000 Projects ABC Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /getbyid.php. The manipulation of the argument ID leads to sql injection. It is possible to launch th…
-
High 8.8CVE-2025-8184 EPSS 15%
D-Link DIR-513 HTTP POST Request formSetWanL2TPtriggers formSetWanL2TPcallback stack-based overflow
A vulnerability was found in D-Link DIR-513 up to 1.10 and classified as critical. This issue affects the function formSetWanL2TPcallback of the file /goform/formSetWanL2TPtriggers of the component HTTP POST Request Handler. The manipulation leads to stack-ba…
-
High 7.5
Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion
The kallyas theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.21.0 via the 'TH_LatestPosts4` widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and ex…
-
High 8.1
Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion
The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versions up to, and including, 4.21.0. This makes it possible for authenticated attackers, with Contributo…
-
High 7.2
TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violation
A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initia…