2025

In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firm

python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerab

Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in

Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitra

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In version 2.17.0, rate limits can be completely

A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub_4C0990 of the fi

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in ver

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to ver

IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused

A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Opt

An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - Sy

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. This affects an unknown

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected

A weakness has been identified in D-Link DI-7100G C1 up to 20250928. Affected by this vulnerability is the function sub_

A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. Affected is an unknown

A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. This

A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php

A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic

A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown fu

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Logo Softwa

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forc

Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing. This issue affe

A flaw has been found in code-projects Online Course Registration 1.0. Impacted is an unknown function of the file /admi

A vulnerability was detected in Tenda AC18 15.03.05.19(6318). This issue affects some unknown processing of the file /go

Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing

It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2.

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels

When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and wid

When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is

When decoding a frame for a SANM file (ANIM v0 variant), the decoded data can be larger than the buffer allocated for it

When parsing the header for a DHAV file, there's an integer underflow in offset calculation that leads to reading the du

When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte p

A security vulnerability has been detected in Tenda AC18 15.03.05.19(6318). This vulnerability affects unknown code of t

A weakness has been identified in Tenda AC18 15.03.05.19(6318). This affects an unknown part of the file /goform/WifiMac

The credentials of the users stored in the system's local database can be used for the log in, making it possible for an

JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerab

A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, mak

It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.

When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method

The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short

For failed login attempts, the application returns different error messages depending on whether the login failed due to

Multiple endpoints with sensitive information do not require authentication, making the application susceptible to infor

In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be s

The application provides access to a login protected H2 database for caching purposes. The username is prefil

If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is

When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and metho

An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making t

A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST r