Latest CVE Feed
-
7.5
HIGHCVE-2025-20647
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interacti... Read more
Affected Products :- Published: Mar. 03, 2025
- Modified: Mar. 03, 2025
- Vuln Type: Denial of Service
-
9.8
CRITICALCVE-2025-20646
In wlan AP FW, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR0038... Read more
- Published: Mar. 03, 2025
- Modified: Apr. 22, 2025
- Vuln Type: Memory Corruption
-
7.8
HIGHCVE-2025-20645
In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch I... Read more
- Published: Mar. 03, 2025
- Modified: Apr. 22, 2025
- Vuln Type: Memory Corruption
-
7.5
HIGHCVE-2025-20644
In Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User in... Read more
- Published: Mar. 03, 2025
- Modified: Apr. 22, 2025
- Vuln Type: Memory Corruption
-
8.8
HIGHCVE-2025-1847
A vulnerability was found in zj1983 zz up to 2024-8. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the p... Read more
Affected Products : zz- Published: Mar. 03, 2025
- Modified: May. 26, 2025
- Vuln Type: Authorization
-
6.5
MEDIUMCVE-2025-1846
A vulnerability was found in zj1983 zz up to 2024-8. It has been declared as problematic. This vulnerability affects the function deleteLocalFile of the file src/main/java/com/futvan/z/system/zfile/ZfileAction.java of the component File Handler. The manip... Read more
Affected Products : zz- Published: Mar. 03, 2025
- Modified: May. 28, 2025
- Vuln Type: Denial of Service
-
9.8
CRITICALCVE-2025-1845
A vulnerability has been found in ESAFENET DSM 3.1.2 and classified as critical. Affected by this vulnerability is the function examExportPDF of the file /admin/plan/examExportPDF. The manipulation of the argument s leads to command injection. The attack ... Read more
Affected Products : dsm- Published: Mar. 03, 2025
- Modified: May. 28, 2025
- Vuln Type: Injection
-
9.8
CRITICALCVE-2025-1844
A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. Affected is an unknown function of the file /CDGServer3/logManagement/backupLogDetail.jsp. The manipulation of the argument logTaskId leads to sql injecti... Read more
Affected Products : cdg- Published: Mar. 03, 2025
- Modified: May. 28, 2025
- Vuln Type: Injection
-
5.4
MEDIUMCVE-2025-27585
A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Print Name paramet... Read more
Affected Products : academia_student_information_system- Published: Mar. 03, 2025
- Modified: Jun. 27, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2025-27584
A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name paramet... Read more
Affected Products : academia_student_information_system- Published: Mar. 03, 2025
- Modified: Jun. 27, 2025
- Vuln Type: Cross-Site Scripting
-
9.1
CRITICALCVE-2025-27583
Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.... Read more
Affected Products : academia_student_information_system- Published: Mar. 03, 2025
- Modified: Jun. 27, 2025
- Vuln Type: Authorization
-
6.5
MEDIUMCVE-2025-25953
Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnerability allows authenticated attackers to escalate privileges and access sensitive information.... Read more
Affected Products : academia_student_information_system- Published: Mar. 03, 2025
- Modified: Jun. 27, 2025
- Vuln Type: Information Disclosure
-
6.5
MEDIUMCVE-2025-25952
An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information via a crafted... Read more
Affected Products : academia_student_information_system- Published: Mar. 03, 2025
- Modified: Jun. 27, 2025
- Vuln Type: Authorization
-
7.5
HIGHCVE-2025-25951
An information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information.... Read more
Affected Products : academia_student_information_system- Published: Mar. 03, 2025
- Modified: Jun. 27, 2025
- Vuln Type: Information Disclosure
-
8.1
HIGHCVE-2025-25950
Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.... Read more
Affected Products : academia_student_information_system- Published: Mar. 03, 2025
- Modified: Jun. 27, 2025
- Vuln Type: Authorization
-
5.4
MEDIUMCVE-2025-25949
A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the User ID parameter ... Read more
Affected Products :- Published: Mar. 03, 2025
- Modified: Apr. 18, 2025
- Vuln Type: Cross-Site Scripting
-
9.1
CRITICALCVE-2025-25948
Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.... Read more
Affected Products :- Published: Mar. 03, 2025
- Modified: Apr. 18, 2025
- Vuln Type: Authorization
-
9.8
CRITICALCVE-2025-1843
A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall/dao/ProductMapper.java. The manipulation of the argument orderBy leads to sql injection. The at... Read more
Affected Products : tmall_demo- Published: Mar. 03, 2025
- Modified: Sep. 02, 2025
- Vuln Type: Injection
-
5.3
MEDIUMCVE-2025-1842
A vulnerability classified as problematic was found in FITSTATS Technologies AthleteMonitoring up to 20250302. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument username leads to cross site scripting. The att... Read more
Affected Products :- Published: Mar. 03, 2025
- Modified: Mar. 03, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2025-27579
In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner, or change the frequency and voltage settings.... Read more
Affected Products :- Published: Mar. 03, 2025
- Modified: Mar. 04, 2025