Archive
9 September 2025
Vulnerabilities first published on this day (UTC), newest first.
141 results · Clear filters · Feed
-
Medium 4.7
Maccms10 Database.php rep sql injection
A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulation of the argument where results in sql injection. The attack can be initiated remotely. The exploit…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform
Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed du…
-
Medium 6.5
Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation
SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the …
-
Medium 5.3
Missing Authentication check in SAP NetWeaver Application Server Java
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additio…
-
Medium 4.3
Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)
Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identif…
-
Medium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups)
Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server. This has low impact on integrity and no impact on confidentiality and availabil…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management
Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim clicks on the link, the injected input is pr…
-
Medium 4.3
Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing)
SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability
-
Medium 6.5
Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application)
SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and av…
-
Medium 5.4
Missing Authorization Check in Fiori app (Manage Payment Blocks)
Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities that should be restricted to specific user groups.This issue could impact both the confidentiality an…
-
Medium 6.5
Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)
SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This issue has a significant impact on the application's integrity, while confidentiality and availabi…
-
Medium 5.0
Missing Authorization check in SAP NetWeaver (Service Data Download)
SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on th…
-
Medium 6.3
uverif kami_list addbatch sql injection
A flaw has been found in uverif up to 3.2. This affects the function addbatch of the file /admin/kami_list. This manipulation of the argument note causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be …
-
Medium 4.8
Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and …
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter conf…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Vi…
-
Medium 6.4
Element Plus Link component (el-link) implements insufficient input validation for the href attribute
Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to unde…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of …
-
Medium 6.1
Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. …
-
Medium 6.1
Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.
-
Medium 6.1
YesWiki Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field