Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allows an attacker to control the local filename.
The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings para...
HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxPsuUsage` API endpoint, related to a flat...
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non...
AFFECTED_PRODUCTS:
Red Hat Red Hat Developer Hub 1.6,
Red Hat Red Hat Developer Hub 1.7,
Red Hat Red Hat Developer Hub 1.5
Missing Authorization vulnerability in Mage people team Booking and Rental Manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking and Rental Manager: from n/a through 2.3.8.
Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Cross Site Request Forgery.This issue affects Contact Forms by Cimatti: from n/a through 1.9.8.
An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation.
An issue was discovered in Samsung Mobile Processor Exynos 1480 and 2400. The lack of a length check leads to out-of-bounds writes.
Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the processi...
AFFECTED_PRODUCTS:
Sonos Era 300 Firmware
A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.
AFFECTED_PRODUCTS:
3Ds Delmia Apriso
osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.
AFFECTED_PRODUCTS:
Osticket Osticket,
Osticket Osticket
Directory Traversal vulnerability in WebLaudos 24.2 (04) allows a remote attacker to obtain sensitive information via the id parameter.
AFFECTED_PRODUCTS:
Pixeon Weblaudos
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary code.
AFFECTED_PRODUCTS:
Philips Clinical Collaboration Platform
An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken function of default.aspx.
AFFECTED_PRODUCTS:
Philips Clinical Collaboration Platform
An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the session management component.
AFFECTED_PRODUCTS:
Philips Clinical Collaboration Platform
An issue was discovered in Samsung Mobile Processor Exynos 2200. A Use-After-Free in the mobile processor leads to privilege escalation.
In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwa...
AFFECTED_PRODUCTS:
Splunk Universal Forwarder,
Splunk Universal Forwarder,
Splunk Universal Forwarder
... (+1)
In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint that...
AFFECTED_PRODUCTS:
Splunk Splunk,
Splunk Splunk,
Splunk Splunk
... (+3)
A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
AFFECTED_PRODUCTS:
Autodesk Revit,
Autodesk Revit,
Autodesk Revit
SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential...
SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set (`signxml.XMLVerifier.verify(require_x509=False, hmac_key=...`), versions of SignXML prior to 4.0.4 are vulnerable to a potential...
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser t...
AFFECTED_PRODUCTS:
Wso2 Identity Server,
Wso2 Identity Server,
Wso2 Identity Server
... (+13)
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location on the server.
By leveraging this vulnerability, an at...
A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network...
AFFECTED_PRODUCTS:
Wso2 Identity Server,
Wso2 Identity Server,
Wso2 Identity Server
... (+21)
A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section.
To exploit this vulnerability, a malicious actor must have a valid user account with administrative a...
AFFECTED_PRODUCTS:
Wso2 Identity Server,
Wso2 Identity Server,
Wso2 Identity Server
... (+10)
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site.
By exploiti...
AFFECTED_PRODUCTS:
Wso2 Identity Server,
Wso2 Identity Server,
Wso2 Identity Server
... (+6)
MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title. The visibility state (`...
AFFECTED_PRODUCTS:
Mybb Mybb
MyBB is free and open source forum software. Prior to version 1.8.39, the upgrade component does not validate user input properly, which allows attackers to perform local file inclusion (LFI) via a specially crafted parameter value. In order to exploit the vulnerability, the installer must be unlock...
AFFECTED_PRODUCTS:
Mybb Mybb
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 9,
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support,
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
... (+1)
SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries.
AFFECTED_PRODUCTS:
Vishalmathur Cloudclassroom Php Project
A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.
AFFECTED_PRODUCTS:
Cotonti Cotonti Siena
A time-based SQL injection vulnerability exists in mydetailsstudent.php in the CloudClassroom PHP Project 1.0. The myds parameter does not properly validate user input, allowing an attacker to inject arbitrary SQL commands.
AFFECTED_PRODUCTS:
Vishalmathur Cloudclassroom Php Project
A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language cookie to inject malicious JavaScript code.
AFFECTED_PRODUCTS:
Sitecom Wlx 2006 Firmware
Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials.
AFFECTED_PRODUCTS:
Sitecom Wlx 2006 Firmware
A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate the "language" cookie to include arbitrary files from the server. This vulnerability can be exploited to disclose sensitive information.
AFFECTED_PRODUCTS:
Sitecom Wlx 2006 Firmware
Tenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.
AFFECTED_PRODUCTS:
Tenda Ac6 Firmware
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
AFFECTED_PRODUCTS:
Hpe Storeonce System
A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software.
AFFECTED_PRODUCTS:
Hpe Storeonce System
An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this vulnerability which can lead to disclosure of sensitive information. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability.
AFFECTED_PRODUCTS:
High-Logic Fontcreator
An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
AFFECTED_PRODUCTS:
Catdoc Project Catdoc
An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
AFFECTED_PRODUCTS:
Catdoc Project Catdoc
A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
AFFECTED_PRODUCTS:
Wagner Xls2csv
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter. The manipulation of the argumen...
AFFECTED_PRODUCTS:
Linksys Re6300 Firmware,
Linksys Re6500 Firmware,
Linksys Re7000 Firmware
... (+3)
A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.
AFFECTED_PRODUCTS:
Hpe Storeonce System
An authentication bypass vulnerability exists in HPE StoreOnce Software.
AFFECTED_PRODUCTS:
Hpe Storeonce System
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
AFFECTED_PRODUCTS:
Hpe Storeonce System
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
AFFECTED_PRODUCTS:
Hpe Storeonce System
A server-side request forgery vulnerability exists in HPE StoreOnce Software.
AFFECTED_PRODUCTS:
Hpe Storeonce System
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.
AFFECTED_PRODUCTS:
Hpe Storeonce System
The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), and because the Electron window can access Node.js APIs.