Archive
6 October 2025
Vulnerabilities first published on this day (UTC), newest first.
49 results · Clear filters · Feed
-
Medium 4.8
Liferay Profile Widget does not prevent vCard extension spoofing
The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content…
-
Medium 5.1
Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload
KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially craf…
-
Medium 6.3
ILIAS Base64 Decoding unserialize deserialization
A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation of the argument f_settings leads to deserialization. It is possible to launch the attack remotely. …
-
Medium 5.5
ILIAS Test Import unserialize deserialization
A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes deserialization. It is possible to initiate the attack remotely. Upgrading to version 8.24, 9.14 and…
-
Medium 6.3
ILIAS Certificate Import code injection
A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Handler. The manipulation results in Remote Code Execution. The attack may be performed from remote. Upg…
-
Medium 4.7
code-projects Online Course Registration edit-course.php sql injection
A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the file /admin/edit-course.php. Executing manipulation of the argument coursecode can lead to sql injection. The attack can be executed remote…
-
Medium 6.6
In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Fir…
-
Medium 6.5
Bucket vulnerable to infinite recursion when querying a bucket using the != operator
Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This will result in PHP's call stack limit exceeding, and/or increase…
-
Medium 6.4CVE-2025-61765 Public exploit
python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments
python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserializatio…
-
Medium 5.3
Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. This affects an unknown part of the file /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do. Performing manipulation of the argument fileName …
-
Medium 5.3
Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal
A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functionality of the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do. Such manip…
-
Medium 4.7
D-Link DI-7100G C1 jhttpd msp_info.htm sub_46409C command injection
A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_46409C of the file /msp_info.htm?flag=qos of the component jhttpd. This manipulation of the argument iface causes command injection. The at…
-
Medium 4.7CVE-2025-11331 EPSS 17%
IdeaCMS Website Name Config.php command injection
A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The att…
-
Medium 6.3
PHPGurukul Beauty Parlour Management System sales-reports-detail.php sql injection
A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/sales-reports-detail.php. Such manipulation of the argument fromdate/todate leads to sql injection. The attack ca…
-
Medium 4.7
XSS in Logo Software's Logo Cloud
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Logo Software Inc. Logo Cloud allows Cross-Site Scripting (XSS). This issue affects Logo Cloud: before 1.18.
-
Medium 5.5
Open Redirect in Logo Software's Logo Cloud
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing. This issue affects Logo Cloud: before 2025.R6.
-
Medium 4.3
HTML Injection in Logo Software's Logo Cloud
Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing. This issue affects Logo Cloud: before 2.57.
-
Medium 6.0
IDOR in Logo Software's Logo Cloud
Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure. This issue affects Logo Cloud: before 0.67.
-
Medium 6.9
Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when using it to calculate the output data. We read rle_raw_size from the input file at [0], we decompress and decode into the…
-
Medium 5.7
Heap-buffer-overflow write in FFmpeg SANM decoding due to lack of bounds-checking in old_codec48
When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify their resolution (width x height). A buffer of appropriate size is allocated depending on the re…
-
Medium 5.7
Heap-buffer-overflow read in FFmpeg DHAV get_duration
When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the duration from before the start of the allocated buffer. If we load a DHAV file that is larger than MAX_DURATION_BUFFER_SIZE bytes (0x100000) …
-
Medium 5.3
Username Disclosure Through Missing Authentication
Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.
-
Medium 6.5
Path Traversal
A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.
-
Medium 6.5
Path traversal
It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.
-
Medium 6.5
Improper Restriction of Excessive Authentication Attempts
The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials.
-
Medium 5.3
User Enumeration by excessive error output
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
-
Medium 5.3
Sensitive Information Disclosure Through Missing Authentication
Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.
-
Medium 5.3
Plain Text Transmission of Username and Password in the URL
In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive dat…
-
Medium 5.3
User Enumeration
The application provides access to a login protected H2 database for caching purposes. The username is prefilled.
-
Medium 5.3
Uncontrolled Resource Consumption via log file
If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.
-
Medium 4.3
Information Disclosure Through Stacktrace-/MQTT/Config/changeAll
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the ap…
-
Medium 6.5
Injection via log file
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.
-
Medium 4.3
The credentials of the users stored in the system's local database can be used for the log in, making it possible for a…
-
Medium 4.5
Cross Site Scripting: Session Hijacking
JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
-
Medium 6.3
Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments
The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.
-
Medium 4.3
Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.
-
Medium 4.3
zhuimengshaonian wisdom-education WrongBookController.java authorization
A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subject…
-
Medium 6.3
zhuimengshaonian wisdom-education UploadController.java uploadFile unrestricted upload
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/education/core/controller/UploadController.java. Such manipulation of the argument File leads to unr…
-
Medium 6.3
nahiduddinahammed Hospital-Management-System-Website delete.php sql injection
A weakness has been identified in nahiduddinahammed Hospital-Management-System-Website up to e6562429e14b2f88bd2139cae16e87b965024097. This issue affects some unknown processing of the file /delete.php. This manipulation of the argument ai causes sql injectio…
-
Medium 5.4
Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking.