Archive
18 August 2025
Vulnerabilities first published on this day (UTC), newest first.
75 results · Feed
-
Medium 4.8
Liferay Portal Vulnerable to Insecure Direct Object Reference
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure …
-
Low 2.3
Liferay Portal Vulnerable to Cross-Site Scripting
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is the…
-
Medium 5.9
CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an emb…
-
High 7.1
File Station 5
An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: …
-
High 7.3
CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary …
-
High 7.5
CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP c…
-
Medium 5.9
Reflected Cross-site Scripting in DIAEnergie
DIAEnergie - Reflected Cross-site Scripting
-
Medium 5.9
Reflected Cross-site Scripting in DIAEnergie
DIAEnergie - Reflected Cross-site Scripting
-
Medium 5.9
Reflected Cross-site Scripting in DIAEnergie
DIAEnergie - Reflected Cross-site Scripting
-
High 7.0
Stored Cross-site Scripting in DIAEnergie
DIAEnergie - Stored Cross-site Scripting
-
Low 3.7
Portabilis i-Diario Password Recovery Endpoint email observable response discrepancy
A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email of the component Password Recovery Endpoint. The manipulation results in observable response discrep…
-
Medium 4.3
Portabilis i-Diario Login Page ui layer
Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the attack remotely.
-
Medium 4.3
Portabilis i-Diario search_autocomplete cross site scripting
A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from a remote l…
-
Low 3.5
Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-disciplina cross site scripting
A vulnerability was found in Portabilis i-Diario up to 1.5.0. This affects an unknown function of the file /planos-de-ensino-por-disciplina/ of the component Informações Adicionais Page. Performing manipulation of the argument Parecer/Conteúdos/Objetivos resu…
-
Low 3.5
Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-areas-de-conhecimento cross site scripting
A vulnerability has been found in Portabilis i-Diario up to 1.5.0. The impacted element is an unknown function of the file /planos-de-ensino-por-areas-de-conhecimento/ of the component Informações Adicionais Page. Such manipulation of the argument Parecer/Con…
-
Low 3.5
Portabilis i-Diario Informações Adicionais /planos-de-aulas-por-disciplina cross site scripting
A flaw has been found in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /planos-de-aulas-por-disciplina/ of the component Informações Adicionais Page. This manipulation of the argument Parecer/Objeto de Conhecimento/H…
-
Low 2.4
ZenCart CKEditor cross site scripting
A vulnerability was detected in ZenCart 2.1.0. Affected by this vulnerability is an unknown functionality of the component CKEditor. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the pub…
-
Medium 5.3
1&1 Mail & Media mail.com App com.mail.mobile.android.mail AndroidManifest.xml improper export of android application components
A security vulnerability has been detected in 1&1 Mail & Media mail.com App 8.8.0 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.mail.mobile.android.mail. The manipulation leads to improper export of android a…
-
Low 3.5
zhenfeng13 My-Blog Tag save cross site scripting
A weakness has been identified in zhenfeng13 My-Blog up to 1.0.0. This issue affects some unknown processing of the file /admin/tags/save of the component Tag Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The e…
-
Medium 5.3
zhenfeng13 My-Blog Frontend Blog Article Comment comment authentication replay
A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The manipulation leads to authentication bypass by capture-replay. The a…
-
Medium 6.3
Acrel Environmental Monitoring Cloud Platform UploadNewsImg unrestricted upload
A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNewsImg. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate …
-
Critical 9.8
In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote es…
-
Medium 6.8
In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of pr…
-
High 8.4
In engineer mode service, there is a possible command injection due to improper input validation. This could lead to lo…
-
Medium 5.3
Elseplus File Recovery App AndroidManifest.xml improper export of android application components
A vulnerability was determined in Elseplus File Recovery App 4.4.21 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml. The manipulation leads to improper export of android application components. The attack needs…
-
Medium 5.3
Euro Information CIC banque et compte en ligne App com.cic_prod.bad AndroidManifest.xml improper export of android application components
A vulnerability was found in Euro Information CIC banque et compte en ligne App 12.56.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.cic_prod.bad. The manipulation leads to imprope…
-
High 7.5
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw_ip parameter at /boafrm/for…
-
Medium 5.3
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root ac…
-
Medium 6.5
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the m…
-
Critical 9.8
TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac para…
-
Medium 6.5
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function.
-
High 7.5
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/…
-
Medium 6.5
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bu…
-
High 7.5
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url parameter at /boafrm/formF…
-
High 8.5
Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control.