Latest CVE Feed
-
7.2
HIGHCVE-2025-10871
An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding th... Read more
Affected Products : gitlab- Published: Sep. 26, 2025
- Modified: Sep. 29, 2025
- Vuln Type: Authorization
-
7.2
HIGHCVE-2025-1862
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user... Read more
Affected Products : api_manager identity_server identity_server_as_key_manager enterprise_integrator open_banking_iam- Published: Sep. 26, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Authentication
-
7.2
HIGHCVE-2025-11103
A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted u... Read more
Affected Products : online_tours_and_travels- Published: Sep. 28, 2025
- Modified: Oct. 03, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-47212
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vu... Read more
- Published: Oct. 03, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-11331
A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The... Read more
Affected Products : ideacms- Published: Oct. 06, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-11240
An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNIME Business Hub installation which, when opened by the user, redirects the user to a page of the... Read more
Affected Products : business_hub- Published: Oct. 02, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Misconfiguration
-
7.1
HIGHCVE-2025-44012
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from a... Read more
Affected Products : qsync_central- Published: Oct. 03, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-41092
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to time records details using unauthor... Read more
Affected Products : bold_workplanner- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-4957
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid allows Reflected XSS. This issue affects ProfileGrid : from n/a through 5.9.5.7.... Read more
Affected Products : profilegrid- Published: Sep. 26, 2025
- Modified: Sep. 26, 2025
- Vuln Type: Cross-Site Scripting
-
7.1
HIGHCVE-2025-33039
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from a... Read more
Affected Products : qsync_central- Published: Oct. 03, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-59012
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler allows Reflected XSS. This issue affects Traveler: from n/a through n/a.... Read more
Affected Products :- Published: Sep. 26, 2025
- Modified: Sep. 26, 2025
- Vuln Type: Cross-Site Scripting
-
7.1
HIGHCVE-2025-60164
Cross-Site Request Forgery (CSRF) vulnerability in NewsMAN NewsmanApp allows Stored XSS. This issue affects NewsmanApp: from n/a through 2.7.7.... Read more
Affected Products :- Published: Sep. 26, 2025
- Modified: Sep. 26, 2025
- Vuln Type: Cross-Site Request Forgery
-
7.1
HIGHCVE-2025-34226
OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malform... Read more
Affected Products :- Published: Oct. 03, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Misconfiguration
-
7.1
HIGHCVE-2025-41091
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details using unauthorised... Read more
- Published: Sep. 30, 2025
- Modified: Oct. 08, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-46819
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exist... Read more
Affected Products : redis- Published: Oct. 03, 2025
- Modified: Oct. 10, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-11550
A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of the component HTTP Request Handler. The manipulation of the argument wifiScheduledSet results in null pointer derefe... Read more
- Published: Oct. 09, 2025
- Modified: Oct. 20, 2025
- Vuln Type: Denial of Service
-
7.1
HIGHCVE-2025-61604
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protect... Read more
Affected Products : wegia- Published: Oct. 02, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Cross-Site Request Forgery
-
7.1
HIGHCVE-2025-10696
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party... Read more
Affected Products : opensupports- Published: Oct. 03, 2025
- Modified: Oct. 06, 2025
- Vuln Type: Authorization
-
7.1
HIGHCVE-2025-60170
Cross-Site Request Forgery (CSRF) vulnerability in Taraprasad Swain HTACCESS IP Blocker allows Stored XSS. This issue affects HTACCESS IP Blocker: from n/a through 1.0.... Read more
Affected Products :- Published: Sep. 26, 2025
- Modified: Sep. 26, 2025
- Vuln Type: Cross-Site Request Forgery
-
7.1
HIGHCVE-2025-33040
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from a... Read more
Affected Products : qsync_central- Published: Oct. 03, 2025
- Modified: Oct. 07, 2025
- Vuln Type: Denial of Service