Latest CVE Feed
-
7.5
HIGH- Published: Sep. 04, 2025
- Modified: Sep. 05, 2025
- Vuln Type: Information Disclosure
-
7.5
HIGHCVE-2025-10785
A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown part of the file /manage_user.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The ex... Read more
Affected Products : grocery_sales_and_inventory_system- Published: Sep. 22, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-10090
A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. Th... Read more
Affected Products : jinher_oa- Published: Sep. 08, 2025
- Modified: Sep. 08, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-10810
A vulnerability was detected in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/edit_user.php. Performing manipulation of the argument firstname results in sql injection. The attack is possib... Read more
Affected Products : online_learning_management_system- Published: Sep. 22, 2025
- Modified: Sep. 22, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-58144
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where ... Read more
Affected Products : xen- Published: Sep. 11, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
7.5
HIGHCVE-2025-48869
Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, all... Read more
Affected Products : horilla- Published: Sep. 24, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Information Disclosure
-
7.5
HIGHCVE-2025-58145
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where ... Read more
Affected Products : xen- Published: Sep. 11, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Memory Corruption
-
7.5
HIGHCVE-2025-53694
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): ... Read more
- Published: Sep. 03, 2025
- Modified: Sep. 08, 2025
- Vuln Type: Information Disclosure
-
7.5
HIGHCVE-2025-30199
ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection between robot and base station.... Read more
Affected Products : deebot_x1s_pro_firmware deebot_x1s_pro deebot_x1_pro_omni_firmware deebot_x1_pro_omni deebot_x1_omni_firmware deebot_x1_omni deebot_x1_turbo_firmware deebot_x1_turbo deebot_t10_firmware deebot_t10 +16 more products- Published: Sep. 05, 2025
- Modified: Sep. 23, 2025
- Vuln Type: Misconfiguration
-
7.5
HIGHCVE-2025-36003
IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.... Read more
Affected Products : security_verify_governance- Published: Aug. 28, 2025
- Modified: Sep. 16, 2025
- Vuln Type: Information Disclosure
-
7.5
HIGHCVE-2025-57064
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the modifyDhcpRule function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.... Read more
- Published: Sep. 09, 2025
- Modified: Sep. 15, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2025-57147
A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple parameters including fullname, email, and contactno in user/registration.php.... Read more
Affected Products : complaint_management_system- Published: Sep. 03, 2025
- Modified: Sep. 08, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-57063
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex parameter in the formDelPortMapping function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.... Read more
- Published: Sep. 09, 2025
- Modified: Sep. 15, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2025-57061
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac, v6 and remark parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted requ... Read more
- Published: Sep. 09, 2025
- Modified: Sep. 15, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2025-57059
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter in the addDhcpRule function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.... Read more
- Published: Sep. 09, 2025
- Modified: Sep. 15, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2025-57058
Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formSetDebugCfg function via the pEnable, pLevel, and pModule parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.... Read more
- Published: Sep. 09, 2025
- Modified: Sep. 15, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2025-6984
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() witho... Read more
Affected Products : langchain- Published: Sep. 04, 2025
- Modified: Sep. 04, 2025
- Vuln Type: XML External Entity
-
7.5
HIGHCVE-2025-10817
A weakness has been identified in Campcodes Online Learning Management System 1.0. This vulnerability affects unknown code of the file /admin/admin_user.php. Executing manipulation of the argument firstname can lead to sql injection. The attack may be lau... Read more
Affected Products : online_learning_management_system- Published: Sep. 22, 2025
- Modified: Sep. 24, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-9529
A weakness has been identified in Campcodes Payroll Management System 1.0. The affected element is the function include of the file /index.php. This manipulation of the argument page causes file inclusion. The attack is possible to be carried out remotely... Read more
Affected Products : payroll_management_system- Published: Aug. 27, 2025
- Modified: Sep. 03, 2025
- Vuln Type: Path Traversal
-
7.5
HIGHCVE-2014-125127
The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP re... Read more
Affected Products :- Published: Sep. 03, 2025
- Modified: Sep. 04, 2025
- Vuln Type: Denial of Service