Archive
7 August 2025
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
High 8.2
Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
-
High 7.0
The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when suc…
-
High 7.4
Tyler Technologies ERP Pro 9 SaaS application escape
Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed h…
-
High 8.8CVE-2025-24000 Public exploit
WordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
-
High 7.0
Incorrect results returned from Rows.Scan in database/sql
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that…
-
High 8.7
Infinite loop triggered by connection ID retirement
Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections possess a set of connection identifiers (IDs); see Section 5.1 of RFC 9000 https://datatracker.ietf.org/doc/htm…
-
High 7.5
On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from …
-
High 8.8
: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This …
-
High 8.8
Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap co…
-
High 8.8
Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit h…
-
High 8.7
: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Upload…
-
High 7.0
SMM IDT Privilege Escalation Vulnerability
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.
-
High 8.6
SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared mes…
-
High 7.1
Himmelblau's Kerberos credential cache collection is world readable
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cach…
-
High 8.8
Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the use…
-
High 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStude…
-
High 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessi…
-
High 8.8
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parame…
-
High 8.8
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress pa…
-
High 8.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter …
-
High 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClass…
-
High 7.4
LinkJoin through 882f196 mishandles token ownership in password reset.
-
High 7.4
LinkJoin through 882f196 mishandles lacks type checking in password reset.
-
High 7.8CVE-2025-50675 Public exploit
GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installat…
-
High 8.8
A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attacke…
-
High 8.1
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer whi…