Archive
27 August 2025
Vulnerabilities first published on this day (UTC), newest first.
29 results · Clear filters · Feed
-
Critical 9.3CVE-2024-13979 Scanner template
St. Joe ERP System SingleRowQueryConverter SQL Injection
A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-sup…
-
Critical 10.0
Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload
QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthenticated attackers to upload files to arbitrary locations on the server. The /rptsvr/upload endpoint f…
-
Critical 10.0
LiveBos UploadFile.do Arbitrary File Upload
LiveBOS, an object-oriented business architecture middleware suite developed by Apex Software Co., Ltd., contains an arbitrary file upload vulnerability in its UploadFile.do;.js.jsp endpoint. This flaw affects the LiveBOS Server component and allows unauthent…
-
Critical 10.0
H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with …
-
Critical 10.0
Dongsheng Logistics Software Unauthenticated Arbitrary File Upload
Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a c…
-
Critical 10.0CVE-2018-25115 EPSS 10%
D-Link DIR-110/412/600/615/645/815 RCE via service.cgi
Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands withou…
-
Critical 10.0
Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload
A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management Platform), affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated rem…
-
Critical 10.0
Dahua EIMS capture_handle.action RCE
A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand…
-
Critical 9.3
Bian Que Feijiu Intelligent Emergency and Quality Control System SQL Injection via GetLyfsByParams
An unauthenticated SQL injection vulnerability exists in the GetLyfsByParams endpoint of Bian Que Feijiu Intelligent Emergency and Quality Control System, accessible via the /AppService/BQMedical/WebServiceForFirstaidApp.asmx interface. The backend fails to p…
-
Critical 10.0
AnyShare ServiceAgent API Unauthenticated RCE
AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/start_service accepts user-supplied input via POST and fails to sanitize command-like payloads. An a…
-
Critical 9.2
Arcserve UDP < 10.2 Pre-Authentication Heap Overflow
A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without authentication by sending specially crafted input to the target system. Improper bounds checking allows …
-
Critical 9.2
Arcserve UDP < 10.2 Pre-Authentication Heap Overflow
A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-control…
-
Critical 9.4CVE-2025-34157 Public exploit
Coolify Stored Cross-Site Scripting (XSS) in Project Name Field
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaS…
-
Critical 9.4CVE-2025-34159 Public exploit
Coolify Docker Compose Directive Injection in Application Deployment Workflow
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directive…
-
Critical 9.4CVE-2025-34161 Public exploit
Coolify Git Repository Field Command Injection in Project Deployment Workflow
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git R…
-
Critical 9.6
Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticate…
-
Critical 9.8
Tenda AC1206 GetParentControlInfo stack-based overflow
A vulnerability was detected in Tenda AC1206 15.03.06.23. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in stack-based buffer overflow. It is possible to launch the attack …
-
Critical 9.4
Excessive permissions on configuration files containing database logins and passwords
The configuration file containing database logins and passwords is readable by any local user.
-
Critical 9.4
Authenticated RCE with uhcapache privileges in ConvertToPDF
In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.
-
Critical 9.4
Calling system commands via RunCommand
The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.
-
Critical 9.0
Conditional RCE via the "system" function
The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter.
-
Critical 9.0
Missing authentication in APIs returning statistical data along with session IDs
The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs.
-
Critical 9.0
Missing authentication in API returning request logs containing session IDs
The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint.
-
Critical 9.0
Missing authentication in API returning a list of all active sessions
Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges.
-
Critical 9.4
RCE via Print.pl in uhcPrintServerPrint
In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" parameter.
-
Critical 9.8CVE-2025-50428 Public exploit
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script.…
-
Critical 9.1CVE-2025-50989 EPSS 11%
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint …
-
Critical 9.8
SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via…
-
Critical 9.8CVE-2025-52122 Public exploit
The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability
Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).