Archive
1 September 2025
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
High 7.3
RemoteClinic edit-my-profile.php unrestricted upload
A vulnerability was found in RemoteClinic up to 2.0. Impacted is an unknown function of the file /staff/edit-my-profile.php. The manipulation of the argument image results in unrestricted upload. The attack may be launched remotely. The exploit has been made …
-
Medium 4.3
RemoteClinic edit-patient.php information disclosure
A vulnerability has been found in RemoteClinic up to 2.0. This issue affects some unknown processing of the file /patients/edit-patient.php. The manipulation of the argument Email leads to information disclosure. The attack may be initiated remotely. The expl…
-
Medium 4.3
RemoteClinic edit.php cross site scripting
A flaw has been found in RemoteClinic up to 2.0. This vulnerability affects unknown code of the file /staff/edit.php. Executing manipulation of the argument Last Name can lead to cross site scripting. The attack can be launched remotely. The exploit has been …
-
High 7.3
RemoteClinic edit.php unrestricted upload
A vulnerability was detected in RemoteClinic up to 2.0. This affects an unknown part of the file /staff/edit.php. Performing manipulation of the argument image results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and…
-
High 7.3
SourceCodester Eye Clinic Management System search_index_Diagnosis.php sql injection
A security vulnerability has been detected in SourceCodester Eye Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file /main/search_index_Diagnosis.php. Such manipulation of the argument Search leads to sql injection. …
-
High 7.3
Campcodes Hospital Management System Admin Dashboard Login admin sql injection
A weakness has been identified in Campcodes Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ of the component Admin Dashboard Login. This manipulation of the argument Password causes sql injection.…
-
Medium 4.1CVE-2025-9769 EPSS 33%
D-Link DI-7400G+ mng_platform.asp sub_478D28 command injection
A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub_478D28 of the file /mng_platform.asp. The manipulation of the argument addr with the input `echo 12345 > poc.txt` results in command injection. An attack on the p…
-
Medium 6.3
itsourcecode Sports Management System mode.php sql injection
A vulnerability was identified in itsourcecode Sports Management System 1.0. This impacts an unknown function of the file /Admin/mode.php. The manipulation of the argument code leads to sql injection. The attack is possible to be carried out remotely.
-
Critical 9.8
In BootRom, there's a possible missing payload size check. This could lead to memory buffer overflow without requiring …
-
High 7.8
In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additi…
-
High 7.8CVE-2022-38694 Public exploit
In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no addit…
-
Critical 9.8
In FDL1, there is a possible missing payload size check. This could lead to memory buffer overflow without requiring ad…
-
Critical 9.8
In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buff…
-
High 7.8CVE-2022-38691 Public exploit
In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privi…
-
Medium 5.8
DIAView - Authentication Bypass Vulnerability
Delta Electronics DIAView has an authentication bypass vulnerability.
-
High 7.3
itsourcecode Sports Management System sporttype.php sql injection
A vulnerability was determined in itsourcecode Sports Management System 1.0. This affects an unknown function of the file /Admin/sporttype.php. Executing manipulation of the argument code can lead to sql injection. The attack can be executed remotely. The exp…
-
High 7.3
itsourcecode Sports Management System facilitator.php sql injection
A vulnerability was found in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/facilitator.php. Performing manipulation of the argument code results in sql injection. Remote exploitation of the attack is…
-
High 7.3
itsourcecode Sports Management System tournament_details.php sql injection
A vulnerability has been found in itsourcecode Sports Management System 1.0. The affected element is an unknown function of the file /Admin/tournament_details.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotel…
-
High 7.3
itsourcecode Sports Management System resultdetails.php sql injection
A flaw has been found in itsourcecode Sports Management System 1.0. Impacted is an unknown function of the file /Admin/resultdetails.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been pub…
-
Critical 9.8
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BA…
-
Medium 6.7
In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privi…
-
High 7.8
In mbrain, there is a possible memory corruption due to use after free. This could lead to local escalation of privileg…
-
High 7.8
In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of pr…
-
High 8.0
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
Medium 6.5
In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of …
-
High 8.8
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalatio…
-
Critical 9.8CVE-2025-6507 EPSS 17%
Deserialization of Untrusted Data in h2oai/h2o-3
A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. This issue affects the latest master branch version 3.47.0.99999. The vul…
-
High 7.3
Campcodes Online Learning Management System student_signup.php sql injection
A vulnerability was detected in Campcodes Online Learning Management System 1.0. This issue affects some unknown processing of the file /student_signup.php. The manipulation of the argument Username results in sql injection. The attack can be launched remotel…
-
High 7.3
Campcodes Online Feeds Product Inventory System Login index.php sql injection
A security vulnerability has been detected in Campcodes Online Feeds Product Inventory System 1.0. This vulnerability affects unknown code of the file /feeds/index.php of the component Login. The manipulation of the argument Username leads to sql injection. T…
-
Medium 6.3
Portabilis i-Educar Matricula API matricula improper authorization
A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API. Executing manipulation can lead to improper authorization. It is possible to launch the attack rem…
-
High 7.5
Information Disclosure Vulnerability in MELSEC iQ-F Series CPU module
Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or w…
-
High 7.3
Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU module
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, sinc…
-
High 7.3
Campcodes/SourceCodester Courier Management System ajax.php signup sql injection
A security flaw has been discovered in Campcodes/SourceCodester Courier Management System 1.0. Affected by this issue is the function Signup of the file /ajax.php. Performing manipulation of the argument lastname results in sql injection. It is possible to in…
-
Medium 6.3
deepakmisal24 Chemical Inventory Management System inventory_form.php sql injection
A vulnerability was identified in deepakmisal24 Chemical Inventory Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /inventory_form.php. Such manipulation of the argument chem_name leads to sql injection. The…
-
Medium 4.9
Sunnet｜eHRD CTMS - Arbitrary File Reading through Path Traversal
The eHRD CTMS developed by Sunnet has an Arbitrary File Reading vulnerability, allowing remote attackers with administrator privileges to exploit Relative Path Traversal to download arbitrary system files.
-
Medium 6.1
Sunnet｜eHRD CTMS - Reflected Cross-site Scripting
The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
-
Medium 6.1
Sunnet｜eHRD CTMS - Reflected Cross-site Scripting
The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
-
Medium 6.1
Sunnet｜eHRD CTMS - Reflected Cross-site Scripting
The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
-
High 7.3
Campcodes/SourceCodester Courier Management System ajax.php login sql injection
A vulnerability was determined in Campcodes/SourceCodester Courier Management System 1.0. Affected is the function Login of the file /ajax.php. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. Th…
-
Medium 6.3
PHPGurukul User Management System change-emailid.php sql injection
A vulnerability was found in PHPGurukul User Management System 1.0. This impacts an unknown function of the file /admin/change-emailid.php. The manipulation of the argument uid results in sql injection. The attack can be executed remotely. The exploit has bee…