Archive
7 August 2025
Vulnerabilities first published on this day (UTC), newest first.
91 results · Feed
-
High 8.6
SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared mes…
-
Medium 5.1
SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by …
-
Low 2.5
tmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameter
tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.
-
Low 2.3
Lego does not enforce HTTPS
Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the ht…
-
Medium 6.9
Thinbus generates insufficient entropy: 252 bits vs minimum 256 bits
Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bi…
-
High 7.1
Himmelblau's Kerberos credential cache collection is world readable
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cach…
-
Medium 6.5
Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the pa…
-
Medium 6.1
Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the se…
-
High 8.8
Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the use…
-
Critical 9.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in fu…
-
Critical 9.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in …
-
High 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStude…
-
High 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessi…
-
Critical 9.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter…
-
Critical 9.8
Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the t…
-
High 8.8
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parame…
-
High 8.8
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress pa…
-
Critical 9.8
Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the use…
-
High 8.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter …
-
High 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClass…
-
Medium 6.1
Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.ph…
-
Medium 6.5
An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal.
-
Medium 6.1
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.
-
Medium 6.5
OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing al…
-
Medium 6.4
In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userCon…
-
Medium 6.4
In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorMana…
-
Medium 5.7
ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because …
-
Medium 6.4
In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js.
-
High 7.4
LinkJoin through 882f196 mishandles token ownership in password reset.
-
High 7.4
LinkJoin through 882f196 mishandles lacks type checking in password reset.
-
Critical 9.8
FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.
-
Medium 6.5
openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.
-
High 7.8CVE-2025-50675 Public exploit
GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installat…
-
Medium 4.0CVE-2025-32094 Public exploit
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumsta…
-
Low 3.8
BMC Control-M/Server cleartext database credentials in process lists and logs
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on…
-
Critical 9.1
ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not so…
-
Medium 6.6
Ollama allows deletion of arbitrary files
An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.
-
Medium 5.3
An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access i…
-
High 8.8
A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attacke…
-
Medium 6.1
Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error …