Latest CVE Feed
-
7.2
HIGHCVE-2025-10496
The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthe... Read more
Affected Products : cookie_notice_\&_consent- Published: Oct. 09, 2025
- Modified: Oct. 09, 2025
- Vuln Type: Cross-Site Scripting
-
7.2
HIGHCVE-2025-37132
An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary fi... Read more
Affected Products :- Published: Oct. 14, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Path Traversal
-
7.2
HIGHCVE-2025-11939
A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/RestoreJob.php of the component Backup Restore Handler. Executing manipulation of the argument restoreFile can lead to pa... Read more
Affected Products : churchcrm- Published: Oct. 19, 2025
- Modified: Oct. 27, 2025
- Vuln Type: Path Traversal
-
7.2
HIGHCVE-2025-11331
A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The... Read more
Affected Products : ideacms- Published: Oct. 06, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-34248
D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/global/database/deleteBackup due to improper sanitization of the deleteBackupList parameter. This can allow an authenticated attacker to del... Read more
Affected Products :- Published: Oct. 09, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Path Traversal
-
7.2
HIGHCVE-2025-37146
A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary com... Read more
Affected Products :- Published: Oct. 14, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-47212
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vu... Read more
- Published: Oct. 03, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-47856
Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or c... Read more
Affected Products : fortivoice- Published: Oct. 14, 2025
- Modified: Oct. 16, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-61524
An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's per... Read more
Affected Products : casdoor- Published: Oct. 08, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Authorization
-
7.2
HIGHCVE-2025-60787
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve... Read more
Affected Products : motioneye- Published: Oct. 03, 2025
- Modified: Oct. 10, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-10239
In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes... Read more
Affected Products : flowmon- Published: Oct. 09, 2025
- Modified: Oct. 09, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-11204
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and... Read more
Affected Products : registrationmagic- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-11668
A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/update_user.php. This manipulation of the argument Password causes sql injection. The attack is possible t... Read more
- Published: Oct. 13, 2025
- Modified: Oct. 16, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-37134
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user o... Read more
Affected Products :- Published: Oct. 14, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-61927
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context i... Read more
Affected Products :- Published: Oct. 10, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-11902
A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2. Affected by this vulnerability is the function findField of the file /cms/article/findField. Performing manipulation of the argument cid results in sql injection. The attack can be initiate... Read more
Affected Products : chancms- Published: Oct. 17, 2025
- Modified: Oct. 24, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-11240
An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the user to a page of the... Read more
Affected Products : business_hub- Published: Oct. 02, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-37133
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user o... Read more
Affected Products :- Published: Oct. 14, 2025
- Modified: Oct. 14, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-11470
A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the file /manage_website.php. The manipulation of the argument website_image/back_login_image leads to... Read more
Affected Products : hotel_and_lodge_management_system- Published: Oct. 08, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-32942
SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.... Read more
Affected Products : tectia_server- Published: Oct. 02, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Cryptography