Latest CVE Feed
-
6.5
MEDIUMCVE-2025-2041
A vulnerability, which was classified as critical, has been found in s-a-zhd Ecommerce-Website-using-PHP 1.0. Affected by this issue is some unknown functionality of the file /shop.php. The manipulation of the argument p_cat leads to sql injection. The at... Read more
Affected Products :- Published: Mar. 06, 2025
- Modified: Mar. 06, 2025
- Vuln Type: Injection
-
9.8
CRITICALCVE-2025-25763
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php... Read more
Affected Products : crmeb- Published: Mar. 06, 2025
- Modified: Jul. 07, 2025
- Vuln Type: Injection
-
6.5
MEDIUMCVE-2024-57972
The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) through 10.0.22621.1244 allows remote attackers to cause a Denial of Service (resource consumption and device unusab... Read more
Affected Products :- Published: Mar. 06, 2025
- Modified: Mar. 07, 2025
- Vuln Type: Denial of Service
-
6.5
MEDIUMCVE-2025-2040
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulation leads to improper neutralization of special element... Read more
- Published: Mar. 06, 2025
- Modified: Jul. 07, 2025
- Vuln Type: Injection
-
7.2
HIGHCVE-2025-2039
A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /admin/delete_members.php. The manipulation of the argument member_id leads to sql injection. It is possib... Read more
- Published: Mar. 06, 2025
- Modified: May. 13, 2025
- Vuln Type: Injection
-
7.5
HIGHCVE-2025-2038
A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /upload/. The manipulation leads to exposure of information through directory listing. The a... Read more
- Published: Mar. 06, 2025
- Modified: May. 13, 2025
- Vuln Type: Information Disclosure
-
8.1
HIGHCVE-2025-25497
An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and a lack of server-side validation. This vulnerability ena... Read more
Affected Products :- Published: Mar. 06, 2025
- Modified: Mar. 07, 2025
- Vuln Type: Authentication
-
8.8
HIGHCVE-2025-2037
A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /user_dashboard/delete_requester.php. The manipulation of the argument requester_id leads to... Read more
- Published: Mar. 06, 2025
- Modified: May. 13, 2025
- Vuln Type: Injection
-
6.5
MEDIUMCVE-2025-2036
A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0. It has been classified as critical. This affects an unknown part of the file details.php. The manipulation of the argument pro_id leads to sql injection. It is possible to initiate the ... Read more
Affected Products :- Published: Mar. 06, 2025
- Modified: Mar. 06, 2025
- Vuln Type: Injection
-
6.9
MEDIUMCVE-2025-27600
FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attacker can initiate an intranet IP request, causing the system to initiate a request through the intranet and potential... Read more
Affected Products :- Published: Mar. 06, 2025
- Modified: Mar. 06, 2025
- Vuln Type: Server-Side Request Forgery
-
9.3
CRITICALCVE-2025-27509
fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time ... Read more
Affected Products : fleet- Published: Mar. 06, 2025
- Modified: Mar. 06, 2025
- Vuln Type: Authentication
-
6.1
MEDIUMCVE-2025-27506
NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-... Read more
- Published: Mar. 06, 2025
- Modified: Aug. 26, 2025
- Vuln Type: Cross-Site Scripting
-
5.0
MEDIUMCVE-2025-26699
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.... Read more
Affected Products : django- Published: Mar. 06, 2025
- Modified: Mar. 19, 2025
- Vuln Type: Denial of Service
-
7.5
HIGHCVE-2025-26167
Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files.... Read more
Affected Products :- Published: Mar. 06, 2025
- Modified: Mar. 07, 2025
- Vuln Type: Information Disclosure
-
7.5
HIGHCVE-2025-25381
Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords.... Read more
Affected Products :- Published: Mar. 06, 2025
- Modified: Mar. 12, 2025
- Vuln Type: Authorization
-
9.8
CRITICALCVE-2025-25361
An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.... Read more
Affected Products : publiccms- Published: Mar. 06, 2025
- Modified: Jul. 01, 2025
- Vuln Type: Authentication
-
5.3
MEDIUMCVE-2025-25294
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnera... Read more
Affected Products : gateway- Published: Mar. 06, 2025
- Modified: Sep. 04, 2025
- Vuln Type: Misconfiguration
-
6.9
MEDIUMCVE-2025-25191
Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100.... Read more
Affected Products : group_office- Published: Mar. 06, 2025
- Modified: Mar. 06, 2025
- Vuln Type: Cross-Site Scripting
-
6.3
MEDIUMCVE-2025-24796
Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by an administrator. Collabora Online typically hosts each document instance within a jail and is al... Read more
Affected Products : online- Published: Mar. 06, 2025
- Modified: Mar. 06, 2025
- Vuln Type: Misconfiguration
-
7.5
HIGHCVE-2024-50600
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boundary check in STOP_KEEP_ALIVE_OFFLOAD leads to out-of-bounds access. An attacker can send a malf... Read more
Affected Products : exynos_980_firmware exynos_850_firmware exynos_1080_firmware exynos_1280_firmware exynos_1380_firmware exynos_1330_firmware exynos_w920_firmware exynos_980 exynos_850 exynos_1080 +10 more products- Published: Mar. 06, 2025
- Modified: Jul. 01, 2025
- Vuln Type: Memory Corruption