Export limit exceeded: 37252 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (37252 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-0392 | 2 Guangzhou Huayi Intelligent Technology, Huayi-tec | 2 Jeewms, Jeewms | 2025-09-11 | 6.3 Medium |
| A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component. | ||||
| CVE-2025-7787 | 1 Xuxueli | 1 Xxl-job | 2025-09-11 | 6.3 Medium |
| A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-7729 | 1 Scada-lts | 1 Scada-lts | 2025-09-11 | 3.5 Low |
| A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file usersProfiles.shtm. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this issue and confirmed that it will be fixed in the upcoming release 2.8.0. | ||||
| CVE-2025-7728 | 1 Scada-lts | 1 Scada-lts | 2025-09-11 | 3.5 Low |
| A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. Affected is an unknown function of the file users.shtm. The manipulation of the argument Username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this issue and confirmed that it will be fixed in the upcoming release 2.8.0. | ||||
| CVE-2025-57790 | 1 Commvault | 2 Commcell, Commvault | 2025-09-11 | 8.8 High |
| A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution. | ||||
| CVE-2025-57788 | 1 Commvault | 2 Commcell, Commvault | 2025-09-11 | 6.5 Medium |
| A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk. | ||||
| CVE-2025-58276 | 1 Huawei | 2 Emui, Harmonyos | 2025-09-11 | 6.8 Medium |
| Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-58281 | 1 Huawei | 1 Harmonyos | 2025-09-11 | 8.4 High |
| Out-of-bounds read vulnerability in the runtime interpreter module. Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2025-58296 | 1 Huawei | 1 Harmonyos | 2025-09-11 | 7.5 High |
| Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect function stability. | ||||
| CVE-2025-58313 | 1 Huawei | 1 Harmonyos | 2025-09-11 | 5.1 Medium |
| Race condition vulnerability in the device standby module. Impact: Successful exploitation of this vulnerability may cause feature exceptions of the device standby module. | ||||
| CVE-2025-10028 | 2 Facebook-kimmymatillano, Itsourcecode | 2 Point Of Sale System, Pos Point Of Sale System | 2025-09-10 | 3.5 Low |
| A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This affects an unknown part of the file /inventory/main/vendors/datatables/unit_testing/templates/6776.php. Such manipulation of the argument scripts leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2025-10029 | 2 Facebook-kimmymatillano, Itsourcecode | 2 Point Of Sale System, Pos Point Of Sale System | 2025-09-10 | 3.5 Low |
| A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datatables/unit_testing/templates/complex_header_2.php. Performing manipulation of the argument scripts results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. | ||||
| CVE-2025-10033 | 2 Emiloimagtolis, Itsourcecode | 2 Online Discussion Forum, Online Discussion Forum | 2025-09-10 | 7.3 High |
| A vulnerability has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-58445 | 1 Runatlantis | 1 Atlantis | 2025-09-10 | 7.5 High |
| Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix. | ||||
| CVE-2025-10063 | 2 Facebook-kimmymatillano, Itsourcecode | 2 Point Of Sale System, Pos Point Of Sale System | 2025-09-10 | 4.3 Medium |
| A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datatables/unit_testing/templates/deferred_table.php. The manipulation of the argument scripts leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. | ||||
| CVE-2025-57808 | 1 Esphome | 2 Esphome, Esphome Firmware | 2025-09-10 | 8.1 High |
| ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1. | ||||
| CVE-2024-51423 | 1 Infor | 1 Global Human Resources | 2025-09-10 | 6.1 Medium |
| Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter. | ||||
| CVE-2025-54599 | 1 Bevy | 1 Events And Groups | 2025-09-10 | 7.5 High |
| The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration. | ||||
| CVE-2025-57611 | 1 Meh.schizofreni | 1 Rust-ffmpeg | 2025-09-10 | 5.3 Medium |
| An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the dump() method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check the return value of avfilter_graph_dump() for NULL, leading to a crash if the underlying memory allocation fails. | ||||
| CVE-2025-57612 | 1 Meh.schizofreni | 1 Rust-ffmpeg | 2025-09-10 | 7.5 High |
| An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check for a NULL return value from the av_get_sample_fmt_name() C function, which can be triggered by providing an unrecognized sample format. | ||||