2025

MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrator

KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the

AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to poten

A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege.

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative pr

xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system

APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access se

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate databa

Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authenticatio

CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authent

minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending

SPA-CART CMS 1.9.0.3 contains a stored cross-site scripting vulnerability in the product description parameter that allo

FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject

FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrar

Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queri

Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attac

Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticate

PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows att

CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allow

ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload ma

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with va

Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to exec

XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to

Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject ma

Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers

Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject mal

Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service

reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that all

dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through

In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnerability can be exploited by an attacker t

In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerability can be exploited by an attacker to

In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized pointer vulnerability can be exploited by a

In AzeoTech DAQFactory release 20.7 (Build 2555), an access of resource using incompatible type vulnerability can be exp

In AzeoTech DAQFactory release 20.7 (Build 2555), a use after free vulnerability can be exploited to cause memory corrup

An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allow

quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory al

HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

A security vulnerability has been detected in yangshare warehouseManager 仓库管理系统 1.1.0. This affects the function addCust

A weakness has been identified in code-projects Class and Exam Timetable Management 1.0. Affected by this issue is some

The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0

A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege.

Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus t

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 1

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 1

In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead t

In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect b

In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow. Thi