Latest CVE Feed
-
8.7
HIGHCVE-2020-36895
EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.propertie... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Information Disclosure
-
9.3
CRITICALCVE-2020-36894
Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through AMF-encoded object manipulation. Attackers can send crafted serialized objects to the /messagebr... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Authentication
-
8.7
HIGHCVE-2020-36893
Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive c... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Path Traversal
-
9.3
CRITICALCVE-2020-36892
Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and ... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Authorization
-
6.9
MEDIUMCVE-2020-36888
SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existi... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Authentication
-
8.7
HIGHCVE-2020-36887
SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access the /content/files/backups/ endpoint to download sensitive backup files containing user credentia... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Information Disclosure
-
6.9
MEDIUMCVE-2020-36886
SpinetiX Fusion Digital Signage 3.4.8 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that automatically submits a... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Cross-Site Request Forgery
-
9.3
CRITICALCVE-2020-36885
Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit the vulnerability by sending a crafted POST request with oversized... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Memory Corruption
-
6.9
MEDIUMCVE-2020-36884
BrightSign Digital Signage Diagnostic Web Server 8.2.26 and less contains an unauthenticated server-side request forgery vulnerability in the 'url' GET parameter of the Download Speed Test service. Attackers can specify external domains to bypass firewall... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Server-Side Request Forgery
-
8.8
HIGHCVE-2020-36883
SpinetiX Fusion Digital Signage 3.4.8 and lower contains an authenticated path traversal vulnerability that allows attackers to manipulate file backup and deletion operations through unverified input parameters. Attackers can exploit path traversal techni... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Path Traversal
-
0.0
NACVE-2025-65602
A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request.... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Injection
-
0.0
NACVE-2025-63895
An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted Link Manager Protocol (LMP) packet.... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Denial of Service
-
7.8
HIGHCVE-2025-65199
A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitrary commands as root via the 'adapterName' parameter of the 'changeMTU' function. Fixed in Winds... Read more
Affected Products :- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Injection
-
5.4
MEDIUMCVE-2025-64888
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitatio... Read more
Affected Products : experience_manager- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2025-64887
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitatio... Read more
Affected Products : experience_manager- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2025-64881
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be e... Read more
Affected Products : experience_manager- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2025-64875
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be e... Read more
Affected Products : experience_manager- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2025-64873
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be e... Read more
Affected Products : experience_manager- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Cross-Site Scripting
-
4.8
MEDIUMCVE-2025-64872
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be ... Read more
Affected Products : experience_manager- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2025-64869
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be e... Read more
Affected Products : experience_manager- Published: Dec. 10, 2025
- Modified: Dec. 10, 2025
- Vuln Type: Cross-Site Scripting