Archive
21 October 2025
Vulnerabilities first published on this day (UTC), newest first.
156 results · Feed
-
Medium 6.9
Stored XSS through system messages
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master.
-
Medium 6.9
Multiple critical security issues in Springboard
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension…
-
Medium 6.9
Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser too…
-
High 8.1
A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series f…
-
High 7.2
A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, U…
-
High 8.7
Unauthorized root access via debug functionality
An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.
-
Critical 9.3
Authenticated OS command execution
A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.
-
Critical 9.3
OS command injection in multiple parameters
An arbitrary OS command may be executed on the product by a remote unauthenticated attacker.
-
High 8.6
OS command injection using information obtained from the web management interface
An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.
-
Medium 5.0
Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.
-
Medium 5.3
Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.
-
Medium 6.1
code16 Sharp vulnerable to Cross Site Scripting (XSS)
code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.
-
Medium 6.1
Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search p…
-
High 7.5
The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as othe…
-
Medium 6.5
daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature.
-
Medium 6.5
daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.
-
Medium 6.1
Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Pe…
-
Medium 6.1
Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Per…
-
Medium 6.5
ProcessWire CMS vulnerable to resource-exhaustion Denial of Service
ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.
-
High 7.2CVE-2025-60500 Public exploit
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypas…
-
Critical 9.8
Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthe…
-
Medium 5.4
Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An…
-
High 8.6CVE-2025-60344 EPSS 11%
A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attacke…
-
Medium 6.5
LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can…
-
High 7.5CVE-2025-60751 Public exploit
GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
-
Medium 4.3
Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerabilit…
-
Medium 6.1
Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Perfo…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code…
-
High 8.9
Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher rol…
-
Medium 6.1
Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during applicatio…
-
High 8.8
The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to U…
-
Medium 5.1CVE-2025-56801 Public exploit
The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB…
-
Medium 6.5CVE-2025-56799 Public exploit
Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanis…
-
Medium 5.1CVE-2025-56800 Public exploit
Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application imp…
-
Medium 5.1CVE-2025-56802 Public exploit
The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration file…
-
Medium 6.5
Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter…