Archive
8 December 2025
Vulnerabilities first published on this day (UTC), newest first.
246 results · Feed
-
High 7.8
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the devi…
-
Medium 6.7
In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions …
-
Medium 6.7
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input vali…
-
High 7.8
In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This …
-
High 7.3
itsourcecode Student Management System newcurriculm.php sql injection
A vulnerability was detected in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /newcurriculm.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit …
-
High 7.3
code-projects Online Ordering System Admin Login admin sql injection
A security vulnerability has been detected in code-projects Online Ordering System 1.0. This affects an unknown function of the file /admin/ of the component Admin Login. Such manipulation of the argument Username leads to sql injection. It is possible to lau…
-
High 7.3
code-projects Online Ordering System user_contact.php sql injection
A weakness has been identified in code-projects Online Ordering System 1.0. The impacted element is an unknown function of the file /user_contact.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely.…
-
High 7.3
code-projects Online Ordering System user_school.php sql injection
A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /user_school.php. The manipulation of the argument product_id results in sql injection. The attack may be performed from r…
-
High 7.3
code-projects Simple Shopping Cart adminlogin.php sql injection
A vulnerability was identified in code-projects Simple Shopping Cart 1.0. Impacted is an unknown function of the file /adminlogin.php. The manipulation of the argument admin_username leads to sql injection. The attack is possible to be carried out remotely. T…
-
Medium 6.3
code-projects Simple Shopping Cart additems.php sql injection
A vulnerability was determined in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Admin/additems.php. Executing manipulation of the argument item_name can lead to sql injection. The attack can be executed remote…
-
Medium 6.3
code-projects Simple Shopping Cart settings.php sql injection
A vulnerability was found in code-projects Simple Shopping Cart 1.0. This vulnerability affects unknown code of the file /Customers/settings.php. Performing manipulation of the argument user_id results in sql injection. Remote exploitation of the attack is po…
-
High 7.3
IdeaCMS Coupon.php whereRaw sql injection
A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such manipulation of the argument params leads to sql injection. The attack may be launched remotely. The exploit has been d…
-
High 8.3
CSRF vulnerability in CIRCL Vulnerability-Lookup
In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting (XSS). On the backend, the related_vulnerabilities field of bundles accepted arbitrary strings…
-
High 7.0
CSRF vulnerability in CIRCL Vulnerability-Lookup
Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or other privileged actions) may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the…
-
Low 2.4
GreenCMS Menu Management CustomController.class.php cross site scripting
A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting…
-
High 8.1
Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup
In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary numb…
-
Medium 6.3
code-projects Daily Time Recording System add_payroll.php sql injection
A vulnerability was detected in code-projects Daily Time Recording System 4.5.0. The impacted element is an unknown function of the file /admin/add_payroll.php. Performing manipulation of the argument detail_Id results in sql injection. The attack can be init…
-
Medium 4.7
SourceCodester Inventory Management System SVC Report Export csv injection
A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotel…
-
Low 3.5
Yealink SIP-T21P E2 Local Directory cross site scripting
A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made a…
-
Medium 6.3
Philipinho Simple-PHP-Blog edit.php sql injection
A security flaw has been discovered in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. This issue affects some unknown processing of the file /edit.php. The manipulation results in sql injection. The attack may be performed from rem…
-
Medium 5.3
Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the cat…
-
High 7.3
itsourcecode Student Management System edit_user.php sql injection
A vulnerability was identified in itsourcecode Student Management System 1.0. This vulnerability affects unknown code of the file /edit_user.php. The manipulation of the argument fname leads to sql injection. The attack is possible to be carried out remotely.…
-
Medium 6.7
FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A…
-
Critical 9.8
Improper configuration of SSH service in Infinera MTC-9
Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.
-
Critical 9.8
Remote shell service (RSH) in Infinera MTC-9
Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
-
Medium 6.3
D-Link DCS-930L alphapd setSystemAdmin command injection
A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. Th…
-
Medium 6.5
Improper input validation in Netconf service in Infinera MTC-9
Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
-
High 7.5
Improper input validation in XML Management service in Infinera MTC-9
Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a reboot of the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R…
-
High 8.6
Server Side Request Forgery (SSRF) in the web server of Infinera MTC-9
Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge.
-
High 8.7
Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
-
Medium 4.9
App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerab…
-
Medium 4.0
Permission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability…
-
Medium 4.3
Yottamaster DM2/DM3/DM200 File Upload path traversal
A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possibl…
-
Medium 6.2
Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerabilit…
-
Medium 4.4
Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may…
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
Low 3.3
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may …
-
High 8.4
Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vul…