Archive
3 September 2025
Vulnerabilities first published on this day (UTC), newest first.
121 results · Clear filters · Feed
-
Medium 4.1
Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across mul…
-
Medium 5.0
Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exporte…
-
Medium 4.6
Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allow…
-
Medium 4.0
Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbit…
-
Medium 4.0
Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive i…
-
Medium 5.9
Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode u…
-
Medium 6.8
Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs.
-
Medium 4.3
Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese A…
-
Medium 4.0
Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to sen…
-
Medium 5.5
Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reus…
-
Medium 5.1
Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attack…
-
Medium 4.0
Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to in…
-
Medium 5.1
Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded f…
-
Medium 6.3
Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary fi…
-
Medium 6.4
Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protect…
-
Medium 6.1
Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 1…
-
Medium 5.4
Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote atta…
-
Medium 5.3
Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 al…
-
Medium 6.0
Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to ac…
-
Medium 6.8
Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker…
-
Medium 6.8
Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker…
-
Medium 4.0
Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrar…
-
Medium 4.0
Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device…
-
Medium 4.0
Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device…
-
Medium 5.9
Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files wit…
-
Medium 4.6
Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling…
-
Medium 5.3
PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local at…
-
Medium 6.8
Outline's Local File Storage Feature can Cause CSP Bypass
Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass …
-
Medium 6.3
ScriptAndTools Real Estate Management System register.php unrestricted upload
A weakness has been identified in ScriptAndTools Real Estate Management System 1.0. Impacted is an unknown function of the file register.php. This manipulation of the argument uimage causes unrestricted upload. Remote exploitation of the attack is possible. T…
-
Medium 6.9
Local Deep Research's API keys are stored in plain text
Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented out…
-
Medium 5.3
Das Parking Management System 停车场管理系统 FindAll information disclosure
A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes information disclosure. It is possible to initiate the attack remotely. The exploit has been publishe…
-
Medium 5.3
Das Parking Management System 停车场管理系统 Search information disclosure
A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. The manipulation results in information disclosure. The attack may be performed from remote. The exploit is now public …
-
Medium 6.1
Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a …
-
Medium 6.5
phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid paramet…
-
Medium 4.3
Memos Vulnerable to Path Traversal via the CreateResource Endpoint
When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.
-
Medium 5.3
SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. fil…
-
Medium 5.3
LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, descrip…
-
Medium 4.6
One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)…
-
Medium 4.2CVE-2025-56608 Public exploit
The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHt…
-
Medium 5.4
Memos Vulnerable to Stored Cross-Site Scripting
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to ele…