Archive
July 2025
Vulnerabilities first published in this month (UTC), newest first.
50 results · Clear filters · Feed
-
Medium 5.3CVE-2014-125122 Public exploit
Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset
A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TM_Block_URL parameter to the endpoint…
-
Medium 6.3
copyparty Reflected XSS via Filter Parameter
Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value direc…
-
Medium 6.3CVE-2024-34328 Public exploit
An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL.
-
Medium 6.5CVE-2024-34327 Public exploit
Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the passwo…
-
Medium 6.1CVE-2025-50866 Public exploit
CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of …
-
Medium 6.5CVE-2025-50867 Public exploit
A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where t…
-
Medium 5.4CVE-2025-29557 Public exploit
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where use…
-
Medium 6.5CVE-2025-45619 Public exploit
An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction…
-
Medium 6.4CVE-2024-43018 Public exploit
Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters a…
-
Medium 6.1CVE-2025-45960 Public exploit
Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via …
-
Medium 6.5CVE-2025-44608 Public exploit
CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.
-
Medium 6.1CVE-2025-51411 Public exploit
A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email paramet…
-
Medium 5.9CVE-2025-7404 Public exploit
Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind C
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.
-
Medium 4.8CVE-2025-50481 Public exploit
Mezzanine CMS vulnerable to Cross-site Scripting
A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post.
-
Medium 5.4CVE-2025-46171 Public exploit
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authentica…
-
Medium 6.3CVE-2025-8018 Public exploit
code-projects Food Ordering Review System reservation_page.php sql injection
A vulnerability was found in code-projects Food Ordering Review System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user/reservation_page.php. The manipulation of the argument reg_Id leads to s…
-
Medium 5.3CVE-2025-6082 Public exploit
Birth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure
The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing t…
-
Medium 6.1CVE-2025-51860 Public exploit
Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container com…
-
Medium 6.5CVE-2025-51864 Public exploit
A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, al…
-
Medium 6.5CVE-2025-51458 Public exploit
SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary …
-
Medium 6.5CVE-2025-51867 Public exploit
Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing at…
-
Medium 6.5CVE-2025-51859 Public exploit
Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component. An attacker c…
-
Medium 6.9
Ollama vulnerable to Cross-Domain Token Exposure
Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.
-
Medium 6.1CVE-2025-51862 Public exploit
Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component. A…
-
Medium 6.1CVE-2025-51858 Public exploit
Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbi…
-
Medium 6.1CVE-2025-51863 Public exploit
Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to exe…
-
Medium 4.4CVE-2025-2301 Public exploit
IDOR in Akbim Software's Online Exam Registration
Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This issue affects Online Exam Registration: before 14.03.2025.
-
Medium 6.1CVE-2024-55040 Public exploit
Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker…
-
Medium 5.4CVE-2025-51396 Public exploit
A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web s…
-
Medium 5.4CVE-2025-51398 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows at…
-
Medium 5.4CVE-2025-51397 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attacker…
-
Medium 5.4CVE-2025-51401 Public exploit
A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attack…
-
Medium 5.4CVE-2025-51400 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows atta…
-
Medium 6.5CVE-2025-51403 Public exploit
A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4…
-
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.3CVE-2025-7892 Public exploit
IDnow App de.idnow AndroidManifest.xml improper export of android application components
A vulnerability classified as problematic has been found in IDnow App up to 9.6.0 on Android. This affects an unknown part of the file AndroidManifest.xml of the component de.idnow. The manipulation leads to improper export of android application components. …
-
Medium 4.4CVE-2025-7431 Public exploit
Knowledge Base <= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug
The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a…
-
Medium 5.3
Directus's exact version number is exposed by the OpenAPI Spec
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by …
-
Medium 5.3CVE-2025-53640 Public exploit
Indico vulnerable to user enumeration via API endpoint
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be …
-
Medium 6.3CVE-2025-7558 Public exploit
code-projects Voting System positions_add.php sql injection
A vulnerability was found in code-projects Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/positions_add.php. The manipulation of the argument description leads to sql injection. The attack…