Archive
8 September 2025
Vulnerabilities first published on this day (UTC), newest first.
99 results · Feed
-
High 7.3
SourceCodester Online Polling System manage-profile.php sql injection
A weakness has been identified in SourceCodester Online Polling System 1.0. This affects an unknown function of the file /manage-profile.php. This manipulation of the argument email causes sql injection. The attack may be initiated remotely. The exploit has b…
-
Low 3.5
SourceCodester Online Polling System manage-profile.php cross site scripting
A security flaw has been discovered in SourceCodester Online Polling System 1.0. The impacted element is an unknown function of the file /manage-profile.php. The manipulation of the argument firstname results in cross site scripting. The attack can be launche…
-
Low 3.5
Portabilis i-Educar tipos cross site scripting
A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usuário/Descrição leads to cross site scripting. The attack can be initiated …
-
High 7.4
The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended d…
-
Low 3.7
dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction…
-
High 8.1CVE-2025-55998 Public exploit
A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attack…
-
High 8.4
WeiPHP v5.0 and before is vulnerable to SQL Injection via the SucaiController.class.php file and the cancelTemplatee
-
High 7.4
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entrie…
-
Critical 9.8
CodeceptJS's incomprehensive sanitation can lead to Command Injection
codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbi…
-
Critical 9.8
rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.
-
High 8.8
An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attack…
-
High 7.5
Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility M…
-
Critical 9.8
Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) v…
-
Low 3.7
Presta Shop vulnerable to email enumeration
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
-
Critical 9.8
OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead…
-
High 8.8
N8N's Chat Trigger component is vulnerable to XSS
An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.
-
Critical 9.8
A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbit…
-
High 7.3
FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Colu…
-
Critical 9.8CVE-2025-56266 Scanner template
A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplyi…