Latest CVE Feed
-
8.9
HIGHCVE-2025-59431
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters... Read more
Affected Products : mapserver- Published: Sep. 19, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-10483
A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/save_user.php. This manipulation of the argument firstname causes sql injection. The attack is... Read more
Affected Products : online_student_file_management_system- Published: Sep. 15, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-29893
An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the followin... Read more
Affected Products : qsync_central- Published: Aug. 29, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-43329
A permissions issue was addressed with additional restrictions. This issue is fixed in watchOS 26, tvOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. An app may be able to break out of its sandbox.... Read more
- Published: Sep. 15, 2025
- Modified: Sep. 17, 2025
- Vuln Type: Authorization
-
8.8
HIGHCVE-2025-10016
The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it ... Read more
Affected Products :- Published: Sep. 16, 2025
- Modified: Sep. 16, 2025
- Vuln Type: Authentication
-
8.8
HIGHCVE-2025-55422
In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.... Read more
Affected Products : foxcms- Published: Aug. 27, 2025
- Modified: Sep. 09, 2025
- Vuln Type: Cross-Site Scripting
-
8.8
HIGHCVE-2025-10057
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code to a file. This m... Read more
Affected Products :- Published: Sep. 17, 2025
- Modified: Sep. 17, 2025
- Vuln Type: Information Disclosure
-
8.8
HIGHCVE-2025-55141
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authen... Read more
Affected Products : connect_secure policy_secure zero_trust_access_gateway neurons_for_secure_access- Published: Sep. 09, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Authorization
-
8.8
HIGHCVE-2025-9531
A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing manipulation of the argument cod_agenda results in sql injection. It is possible t... Read more
Affected Products : i-educar- Published: Aug. 27, 2025
- Modified: Sep. 04, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2023-49564
The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of... Read more
Affected Products :- Published: Sep. 18, 2025
- Modified: Sep. 18, 2025
- Vuln Type: Authentication
-
8.8
HIGHCVE-2023-49367
An issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain sensitive information via inspecting sent packages by user.... Read more
Affected Products :- Published: Sep. 18, 2025
- Modified: Sep. 19, 2025
- Vuln Type: Information Disclosure
-
8.8
HIGHCVE-2025-9841
A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php. The manipulation of the argument ProductImage leads to unrestricted upload. The attack is possib... Read more
Affected Products : mobile_shop_management_system- Published: Sep. 03, 2025
- Modified: Sep. 08, 2025
- Vuln Type: Misconfiguration
-
8.8
HIGHCVE-2025-10200
Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)... Read more
- Published: Sep. 10, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-10201
Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High)... Read more
- Published: Sep. 10, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Misconfiguration
-
8.8
HIGHCVE-2025-10602
A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s1.php. Performing manipulation of the argument ID results in sql injection. The attack can b... Read more
- Published: Sep. 17, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-52544
E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file sys... Read more
Affected Products :- Published: Sep. 02, 2025
- Modified: Sep. 02, 2025
- Vuln Type: Path Traversal
-
8.8
HIGHCVE-2025-6454
An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecti... Read more
Affected Products : gitlab- Published: Sep. 12, 2025
- Modified: Sep. 20, 2025
- Vuln Type: Server-Side Request Forgery
-
8.8
HIGHCVE-2025-10481
A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of the file /remove_file.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the a... Read more
Affected Products : online_student_file_management_system- Published: Sep. 15, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-10429
A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_product.php. The manipulation of the argument drop_services results in sql injection. T... Read more
- Published: Sep. 15, 2025
- Modified: Sep. 18, 2025
- Vuln Type: Injection
-
8.8
HIGHCVE-2025-8302
Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must ... Read more
- Published: Sep. 02, 2025
- Modified: Sep. 10, 2025
- Vuln Type: Memory Corruption