An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.
Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidation function.
Buffer overflow in Tenda AC6 router firmware version 15.03.05.16_multi can be triggered via a crafted deviceId parameter in the addWifiMacFilter function, potentially allowing remote unauthenticated attackers to read sensitive memory and modify limited data after overcoming high attack complexity. While no active exploitation has been confirmed, a public proof-of-concept exploit exists, and the EPSS score is very low.
Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.
Rejected reason: An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 14.0% and no vendor patch available.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL via the ID parameter in /myprofile.php, potentially leading to data theft or manipulation. A proof-of-concept exploit is publicly available, but the EPSS score is very low (0.06%) and no active exploitation has been reported.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter in /myprofileup.php. A public proof-of-concept exploit is available, but the EPSS score of 0.06% indicates low probability of widespread exploitation and no active exploitation has been confirmed.
SQL injection in Campcodes Employee Management System 1.0 via the ID parameter in /mark.php allows remote attackers to execute arbitrary SQL commands. Exploit code is publicly available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability affects version 1.0.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate the database via the ID parameter of the empproject.php endpoint, potentially exposing or modifying employee data. A public proof-of-concept exploit is available, but the EPSS exploitation probability is very low (0.06%), and there is no evidence of active exploitation (not listed in CISA KEV).
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate the database via the 'ID' parameter in /eloginwel.php. A publicly disclosed exploit exists, but no evidence of active exploitation in the wild. The vulnerability has a low EPSS score (0.06%) and a CVSS 4.0 base score of 5.5, indicating limited impact to confidentiality, integrity, and availability.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /edit.php. Exploit code is publicly available, though no active exploitation has been confirmed, and EPSS estimates a 0.06% probability of exploitation. The vulnerability is rated critical but carries a medium CVSS 4.0 score of 5.5 due to limited impact.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the mailuid parameter in /process/eprocess.php. This critical vulnerability can lead to unauthorized data access or manipulation. Exploit code is publicly available, though EPSS estimates a low probability (0.06%) of widespread exploitation.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter of the /changepassemp.php password change page. This unauthenticated, remotely exploitable flaw can lead to unauthorized data access or modification. Public exploit code is available, but the EPSS score of 0.06% indicates low exploitation probability, and no active exploitation has been confirmed.
SQL injection in Campcodes Employee Management System 1.0 allows unauthenticated remote attackers to inject arbitrary SQL commands via the mailuid parameter in /process/aprocess.php. This can lead to database compromise, including unauthorized data access and modification. A public proof
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of the /applyleave.php endpoint, leading to unauthorized database access or modification. A publicly available proof-of-concept exploit exists, enabling data exfiltration without authentication. The vulnerability received a CVSS 4.0 base score of 5.5 (Medium) and has a low EPSS exploitation probability (0.06%).
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported, and EPSS predicts a low likelihood of widespread use.
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID parameter in the /large.php file to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. Public exploit code is available, though the EPSS score of 0.06% suggests low likelihood of widespread exploitation.
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' parameter of /addpro.php. With no authentication or user interaction required, an attacker can read, modify, or delete data. Exploit code is publicly available but EPSS indicates a low probability of widespread exploitation.
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the 'cid' parameter in /pages/payment_add.php to execute arbitrary SQL commands. A publicly available proof-of-concept exists, but no active exploitation has been reported. Exploitation can lead to unauthorized data access, modification, or deletion.
Intelbras RX1500 Router v2.2.17 and before is vulnerable to Integer Overflow. The websReadEvent function incorrectly uses the int type when processing the "command" field of the http header, causing the array to cross the boundary and overwrite other fields in the array.
A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier allows an attacker can reconfigure the target device to use an external LDAP service controlled by the attacker. If an LDAP password is set on the target device, the attacker can force the target device to authenticate to the attacker controlled LDAP service. This will allow the attacker to capture the plaintext password of the configured LDAP service.
A security vulnerability in is a ticket escalation process helper for GLPI. (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Dear Flipbook - PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected execution of scripts in the browser on interaction.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-45083 is a security vulnerability (CVSS 6.1) that allows attackers. Remediation should follow standard vulnerability management procedures.
A security vulnerability in JUnit (CVSS 5.8). Remediation should follow standard vulnerability management procedures.
Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet balance.
An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token-which may be retrievable from host registry keys or improperly secured logs-can retrieve a plaintext response disclosing sensitive credentials. These may include an API key, AWS IAM access and secret keys, and a base64-encoded JWT signing key used in the tenant’s SSO IdP configuration.
Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with program files tr069/tr069_uci.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with program files tr069/tr098.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router modules allows Resource Leak Exposure. This vulnerability is associated with program files router/phonebook/pbwork-queue.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (traffic_stat modules) allows Resource Leak Exposure. This vulnerability is associated with program files traffic_stat/traffic_service/traffic_service.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router components allows Resource Leak Exposure. This vulnerability is associated with program files router/phonebook/pb.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
Resource leak vulnerability in ASR180x in router allows Resource Leak Exposure. This vulnerability is associated with program files router/sms/sms.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (con_mgr components) allows Resource Leak Exposure. This vulnerability is associated with program files con_mgr/dialer_task.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak Exposure.This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
Missing authorization in The Plus Addons for Elementor Pro allows authenticated attackers to manipulate access controls, leading to data modification and service disruption. Versions prior to 6.3.7 are affected. No known active exploitation or public exploit exists, and the EPSS probability is very low (0.06%).
Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks protection against Clickjacking attacks. This vulnerability allows an attacker to embed the Sunshine interface within a malicious website using an invisible or disguised iframe. If a user is tricked into interacting (one or multiple clicks) with the malicious page while authenticated, they may unknowingly perform actions within the Sunshine application without their consent. This issue has been patched in version 2025.628.4510.
IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API key validation. However, the POST /invocations endpoint failed to do so, resulting in an authentication bypass. This vulnerability allows unauthorized users to access the same inference features available on protected endpoints, potentially exposing sensitive functionality or allowing unintended access to backend resources.
A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data.
Dell NetWorker, versions 19.12.0.1 and prior, contains a Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private repositories within an organization. This issue could be exploited by leveraging a user-to-server token with no scopes via the Search API endpoint. Successful exploitation required an organization administrator to install a malicious GitHub App in the organization’s repositories. This vulnerability impacted only GitHub Enterprise Server version 3.17 and was addressed in version 3.17.2. The vulnerability was reported through the GitHub Bug Bounty program.