Archive
7 August 2025
Vulnerabilities first published on this day (UTC), newest first.
39 results · Clear filters · Feed
-
Medium 6.3
Wanzhou WOES Intelligent Optimization Energy Saving System Historical Data Query Module GetVariableByOneIDNew sql injection
A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This affects an unknown part of the file /CommonSolution/GetVariableByOneIDNew of the component Historical Data Query Module. The manipula…
-
Medium 6.3
Wanzhou WOES Intelligent Optimization Energy Saving System GetPageList sql injection
A vulnerability was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /OL_OprationLog/GetPageList. The manipulation of the argument optUser …
-
Medium 6.5
Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
-
Medium 6.4
Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 duri…
-
Medium 6.3
agentUniverse MCPSessionManager/MCPTool/MCPToolkit StdioServerParameters os command injection
A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPSessionManager/MCPTool/MCPToolkit. The manipulation leads to os command injection. The attack may be …
-
Medium 6.9
Incorrect Authorization of XPC Service in Fantastical.app
A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, an…
-
Medium 4.3
Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perfor…
-
Medium 4.3
Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perfor…
-
Medium 4.3
Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker wh…
-
Medium 4.3
Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to…
-
Medium 4.3
Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convin…
-
Medium 4.3
Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker wh…
-
Medium 5.1
SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by …
-
Medium 6.9
Thinbus generates insufficient entropy: 252 bits vs minimum 256 bits
Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bi…
-
Medium 6.5
Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the pa…
-
Medium 6.1
Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the se…
-
Medium 6.1
Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.ph…
-
Medium 6.5
An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.
-
Medium 6.1
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.
-
Medium 6.5
OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing al…
-
Medium 6.4
In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userCon…
-
Medium 6.4
In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorMana…
-
Medium 5.7
ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because …
-
Medium 6.4
In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js.
-
Medium 6.5
openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.
-
Medium 4.0CVE-2025-32094 Public exploit
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumsta…
-
Medium 6.6
Ollama allows deletion of arbitrary files
An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.
-
Medium 5.3
An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access i…
-
Medium 6.1
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error …
-
Medium 5.4
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows Static Code Injection. Authen…
-
Medium 5.3
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credent…
-
Medium 5.4
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated …
-
Medium 4.3
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into S…
-
Medium 6.1
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication config…
-
Medium 5.6
In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack…
-
Medium 5.6
In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while pa…
-
Medium 6.6
In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer whi…
-
Medium 5.5
In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer w…
-
Medium 6.5
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and t…