Archive
September 2025
Vulnerabilities first published in this month (UTC), newest first.
2,069 results · Clear filters · Feed
-
Medium 4.0
Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to sen…
-
Medium 5.5
Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reus…
-
Medium 5.1
Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attack…
-
Medium 4.0
Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to in…
-
Medium 5.1
Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded f…
-
Medium 6.3
Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary fi…
-
Medium 6.4
Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protect…
-
Medium 6.1
Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 1…
-
Medium 5.4
Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote atta…
-
Medium 5.3
Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 al…
-
Medium 6.0
Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to ac…
-
Medium 6.8
Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker…
-
Medium 6.8
Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker…
-
Medium 4.0
Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrar…
-
Medium 4.0
Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device…
-
Medium 4.0
Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device…
-
Medium 5.9
Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files wit…
-
Medium 4.6
Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling…
-
Medium 5.3
PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local at…
-
Medium 6.8
Outline's Local File Storage Feature can Cause CSP Bypass
Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass …
-
Medium 6.3
ScriptAndTools Real Estate Management System register.php unrestricted upload
A weakness has been identified in ScriptAndTools Real Estate Management System 1.0. Impacted is an unknown function of the file register.php. This manipulation of the argument uimage causes unrestricted upload. Remote exploitation of the attack is possible. T…
-
Medium 6.9
Local Deep Research's API keys are stored in plain text
Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented out…
-
Medium 5.3
Das Parking Management System 停车场管理系统 FindAll information disclosure
A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes information disclosure. It is possible to initiate the attack remotely. The exploit has been publishe…
-
Medium 5.3
Das Parking Management System 停车场管理系统 Search information disclosure
A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. The manipulation results in information disclosure. The attack may be performed from remote. The exploit is now public …
-
Medium 6.1
Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a …
-
Medium 6.5
phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid paramet…
-
Medium 4.3
Memos Vulnerable to Path Traversal via the CreateResource Endpoint
When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.
-
Medium 5.3
SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. fil…
-
Medium 5.3
LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, descrip…
-
Medium 4.6
One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)…
-
Medium 4.2CVE-2025-56608 Public exploit
The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHt…
-
Medium 5.4
Memos Vulnerable to Stored Cross-Site Scripting
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to ele…
-
Medium 5.3
An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management inter…
-
Medium 6.3
code-projects Mobile Shop Management System AddNewProduct.php unrestricted upload
A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php. The manipulation of the argument ProductImage leads to unrestricted upload. The attack is possible t…
-
Medium 6.5
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This …
-
Medium 6.3
itsourcecode Sports Management System gametype.php sql injection
A weakness has been identified in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/gametype.php. Executing manipulation of the argument code can lead to sql injection. The attack can be executed remotel…
-
Medium 5.5
In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limit…
-
Medium 5.5
In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing per…
-
Medium 5.5
In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak throu…
-
Medium 5.5
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused…