Latest CVE Feed
-
7.2
HIGHCVE-2025-1862
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user... Read more
Affected Products : api_manager identity_server identity_server_as_key_manager enterprise_integrator open_banking_iam- Published: Sep. 26, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Authentication
-
7.1
HIGHCVE-2025-41091
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details using unauthorised... Read more
- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-48107
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode allows Reflected XSS. This issue affects Uncode: from n/a through n/a.... Read more
Affected Products : uncode- Published: Sep. 26, 2025
- Modified: Sep. 26, 2025
- Vuln Type: Cross-Site Scripting
-
7.1
HIGHCVE-2025-41094
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to functional contract details using u... Read more
Affected Products : bold_workplanner- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-33040
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from a... Read more
Affected Products : qsync_central- Published: Oct. 03, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-41095
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter details using unau... Read more
Affected Products : bold_workplanner- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-41097
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic employee details using unaut... Read more
Affected Products : bold_workplanner- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-41096
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the dates of the current contract d... Read more
Affected Products : bold_workplanner- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-61604
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protect... Read more
Affected Products : wegia- Published: Oct. 02, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Cross-Site Request Forgery
-
7.1
HIGHCVE-2025-41093
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic contract details using unauth... Read more
Affected Products : bold_workplanner- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-60171
Cross-Site Request Forgery (CSRF) vulnerability in yourplugins Conditional Cart Messages for WooCommerce – YourPlugins.com allows Stored XSS. This issue affects Conditional Cart Messages for WooCommerce – YourPlugins.com: from n/a through 1.2.... Read more
Affected Products :- Published: Sep. 26, 2025
- Modified: Sep. 26, 2025
- Vuln Type: Cross-Site Request Forgery
-
7.1
HIGHCVE-2025-60169
Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM allows Stored XSS. This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through 3.0.... Read more
Affected Products :- Published: Sep. 26, 2025
- Modified: Sep. 26, 2025
- Vuln Type: Cross-Site Request Forgery
-
7.1
HIGHCVE-2025-46819
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exist... Read more
Affected Products : redis- Published: Oct. 03, 2025
- Modified: Oct. 10, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-44012
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from a... Read more
Affected Products : qsync_central- Published: Oct. 03, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-10692
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user (level ≥ 1) can inject SQL to alter the filter logi... Read more
Affected Products : opensupports- Published: Oct. 03, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Injection
-
7.1
HIGHCVE-2025-58385
In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data).... Read more
Affected Products : watchdoc- Published: Sep. 26, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Information Disclosure
-
7.1
HIGHCVE-2025-41092
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to time records details using unauthor... Read more
Affected Products : bold_workplanner- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-10696
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party... Read more
Affected Products : opensupports- Published: Oct. 03, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-33039
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from a... Read more
Affected Products : qsync_central- Published: Oct. 03, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-34226
OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malform... Read more
Affected Products :- Published: Oct. 03, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Misconfiguration