Latest CVE Feed
-
7.2
HIGHCVE-2025-47212
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vu... Read more
- Published: Oct. 03, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-32942
SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.... Read more
Affected Products : tectia_server- Published: Oct. 02, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Cryptography
-
7.2
HIGHCVE-2025-11470
A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the file /manage_website.php. The manipulation of the argument website_image/back_login_image leads to... Read more
Affected Products : hotel_and_lodge_management_system- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-10871
An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding th... Read more
Affected Products : gitlab- Published: Sep. 26, 2025
- Modified: Sep. 29, 2025
- Vuln Type: Authorization
-
7.2
HIGHCVE-2025-11331
A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The... Read more
Affected Products : ideacms- Published: Oct. 06, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-60787
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve... Read more
Affected Products : motioneye- Published: Oct. 03, 2025
- Modified: Oct. 10, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-11240
An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the user to a page of the... Read more
Affected Products : business_hub- Published: Oct. 02, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-11103
A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted u... Read more
Affected Products : online_tours_and_travels- Published: Sep. 28, 2025
- Modified: Oct. 03, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-37146
A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary com... Read more
Affected Products :- Published: Oct. 14, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-11071
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. T... Read more
Affected Products : seacms- Published: Sep. 27, 2025
- Modified: Oct. 10, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-61524
An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's per... Read more
Affected Products : casdoor- Published: Oct. 08, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Authorization
-
7.2
HIGHCVE-2025-34248
D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to del... Read more
Affected Products :- Published: Oct. 09, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Path Traversal
-
7.2
HIGHCVE-2025-11204
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and... Read more
Affected Products : registrationmagic- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2023-6215
A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in certain HP PC products, which might allow security bypass, arbitrary code execution, loss of integrity or confidentiality, or denial of s... Read more
Affected Products :- Published: Oct. 07, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-10747
The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Ad... Read more
Affected Products : wp-downloadmanager- Published: Sep. 26, 2025
- Modified: Sep. 26, 2025
- Vuln Type: Authentication
-
7.2
HIGHCVE-2025-11902
A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2. Affected by this vulnerability is the function findField of the file /cms/article/findField. Performing manipulation of the argument cid results in sql injection. The attack can be initiate... Read more
Affected Products : chancms- Published: Oct. 17, 2025
- Modified: Oct. 24, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-10496
The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthe... Read more
Affected Products : cookie_notice_\&_consent- Published: Oct. 09, 2025
- Modified: Oct. 09, 2025
- Vuln Type: Cross-Site Scripting
-
7.2
HIGHCVE-2025-10239
In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes... Read more
Affected Products : flowmon- Published: Oct. 09, 2025
- Modified: Oct. 09, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-1862
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user... Read more
Affected Products : api_manager identity_server identity_server_as_key_manager enterprise_integrator open_banking_iam- Published: Sep. 26, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Authentication
-
7.1
HIGHCVE-2025-44006
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from a... Read more
Affected Products : qsync_central- Published: Oct. 03, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Denial of Service