Command injection in openvpn-cms-flask up to version 1.2.7 allows remote authenticated attackers to execute arbitrary system commands via the username parameter of the user creation API endpoint. Public exploit code is available, and the vulnerability is fixed in version 1.2.8.
A security vulnerability in A vulnerability classified as critical (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in A vulnerability classified as critical (CVSS 6.3). Risk factors: public PoC available.
Server-side request forgery in diyhi bbs up to version 6.8 allows remote authenticated attackers with low privileges to manipulate the Host header via the /admin/login endpoint, enabling limited unauthorized access to internal resources. A public proof-of-concept exploit is available, but no active exploitation has been confirmed; EPSS score indicates a low probability of exploitation (0.08%).
SQL injection in the getOfficeName method of sfturing hosp_order enables remote attackers with low privileges to manipulate the officesName parameter, potentially extracting or modifying database contents. The vulnerability is publicly documented with proof-of-concept exploit code available, though low EPSS score suggests limited real-world exploitation likelihood.
Stored cross-site scripting (XSS) in code-projects Food Distributor Site 1.0 allows an authenticated administrator to inject arbitrary JavaScript into site settings. The vulnerability is triggered via the site_phone, site_email, or address parameters in the /admin/save_settings.php endpoint. Public exploit code is available, but the high privilege requirement (administrator access) and low EPSS score (0.07%) limit real-world risk.
A heap-based buffer overflow vulnerability in HDF5 1.14.6 allows local attackers with low privileges to cause a denial of service via crafted HDF5 file metadata encoding. Exploit code is publicly available, but the low EPSS score (0.05%) and local attack requirement limit real-world urgency. No active exploitation has been confirmed by CISA KEV.
Cleartext storage of sensitive data in Bharti Airtel Thanks App 4.105.4 for Android allows physically present attackers with low privileges to read locally stored files, exposing personal information or session tokens. A publicly available proof-of-concept exploit exists, but exploitation requires physical device access and low user privileges, significantly reducing real-world risk. No active exploitation has been reported and the EPSS exploitation probability is extremely low at 0.01%.
The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal network resources-such as localhost services or cloud-provider metadata endpoints-become reachable. The endpoint takes a URL from the user and calls it server-side via fopen() without any safeguards. There is no IP address validation, nor are there any allow-list, timeout, or size restrictions. Because of this, attackers can point the application at internal targets. Using this flaw, an attacker can perform internal port scans or retrieve sensitive cloud metadata. Version 6.6.13 contains a patch for the issue.
A privilege escalation vulnerability (CVSS 2.9) that allows a bypass of build isolation. Remediation should follow standard vulnerability management procedures.
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.
Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.
Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.
Path traversal in gooaclok819 sublinkX's AddTemp function allows authenticated remote attackers to read or write arbitrary files on the server. All versions up to 1.8 are affected, with publicly disclosed exploit code available. The vulnerability is fixed in version 1.9.
CVE-2025-6765 is a security vulnerability (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
SQL injection in the findAllHosByCondition method of sfturing hosp_order allows a remote authenticated attacker to manipulate the hospitalName parameter to execute arbitrary SQL commands. The vulnerability affects the project up to commit 627f426331da8086ce8fff2017d65b1ddef384f8 and has publicly available exploit code, but it requires low-privilege authentication and has a low CVSS 4.0 score of 2.1 due to limited impact. No versioned patch exists because the project uses continuous delivery, but the issue is tracked in the GitHub repository.
SQL injection in the findDoctorByCondition function of sfturing hosp_order allows authenticated remote attackers to execute arbitrary SQL commands via the hospitalName parameter. Exploit code is publicly available, though no active exploitation has been confirmed (CISA KEV not listed, EPSS score of 0.04% indicates low exploitation probability).
SQL injection in bicycleSharingServer 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the selectAdminByNameLike function in AdminController.java, potentially exposing or altering database contents. An exploit is publicly available, though no active exploitation has been confirmed.
SQL injection in bicycleSharingServer's AdminController.java allows remote authenticated low-privilege users to manipulate the Title parameter, potentially leading to limited data exposure or modification. Public exploit code exists (GitHub issue) but no active exploitation reported and EPSS score is low (0.04%), indicating low real-world exploitation likelihood.
SQL injection in huija bicycleSharingServer via the userDao.selectUserByUserNameLike function allows low-privileged remote attackers to execute arbitrary SQL commands. The exploit has been publicly disclosed, and while no active exploitation is confirmed, the vulnerability is present in the rolling-release codebase up to at least commit 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. An attacker could extract or modify sensitive data, potentially compromising user accounts or the underlying database.
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.
Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.