Export limit exceeded: 372400 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372400 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-10251 | 1 Foxcms | 1 Foxcms | 2025-10-02 | 6.3 Medium |
| A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulation of the argument ids results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-9586 | 1 Comfast | 2 Cf-n1, Cf-n1 Firmware | 2025-10-02 | 6.3 Medium |
| A vulnerability was identified in Comfast CF-N1 2.6.0. This vulnerability affects the function wireless_device_dissoc of the file /usr/bin/webmgnt. Such manipulation of the argument mac leads to command injection. The attack may be performed from a remote location. The exploit is publicly available and might be used. | ||||
| CVE-2025-11112 | 1 Phpgurukul | 1 Employee Record Management System | 2025-10-02 | 4.3 Medium |
| A security vulnerability has been detected in PHPGurukul Employee Record Management System 1.3. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument First name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2025-10271 | 2 10oa, Erjinzhi | 2 10oa, 10oa | 2025-10-02 | 4.3 Medium |
| A vulnerability was found in erjinzhi 10OA 1.0. This impacts an unknown function of the file /trial/mvc/finder. The manipulation of the argument Name results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-10272 | 2 10oa, Erjinzhi | 2 10oa, 10oa | 2025-10-02 | 4.3 Medium |
| A vulnerability was determined in erjinzhi 10OA 1.0. Affected is an unknown function of the file /trial/mvc/catalogue. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-10273 | 2 10oa, Erjinzhi | 2 10oa, 10oa | 2025-10-02 | 3.5 Low |
| A vulnerability was identified in erjinzhi 10OA 1.0. Affected by this vulnerability is an unknown functionality of the file /view/file.aspx. Such manipulation of the argument File leads to path traversal. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-10274 | 2 10oa, Erjinzhi | 2 10oa, 10oa | 2025-10-02 | 4.3 Medium |
| A security flaw has been discovered in erjinzhi 10OA 1.0. Affected by this issue is some unknown functionality of the file /trial/mvc/item. Performing manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-54254 | 1 Adobe | 2 Experience Manager, Experience Manager Forms | 2025-10-02 | 8.6 High |
| Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction. | ||||
| CVE-2025-56562 | 1 Signify | 1 Wiz Connected | 2025-10-02 | 7.5 High |
| An incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a DoS on Wiz devices only requiring the MAC address. | ||||
| CVE-2025-56557 | 1 Tuya | 1 Tuya | 2025-10-02 | 9.1 Critical |
| An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol. | ||||
| CVE-2025-10155 | 1 Mmaitre314 | 1 Picklescan | 2025-10-02 | 7.8 High |
| An Improper Input Validation vulnerability in the scanning logic of mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass pickle files security checks by supplying a standard pickle file with a PyTorch-related file extension. When the pickle file incorrectly considered safe is loaded, it can lead to the execution of malicious code. | ||||
| CVE-2025-11092 | 2 D-link, Dlink | 3 Dir-823x, Dir-823x, Dir-823x Firmware | 2025-10-02 | 6.3 Medium |
| A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. | ||||
| CVE-2025-11095 | 2 D-link, Dlink | 3 Dir-823x, Dir-823x, Dir-823x Firmware | 2025-10-02 | 6.3 Medium |
| A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulation of the argument delvalue results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. | ||||
| CVE-2025-10156 | 1 Mmaitre314 | 1 Picklescan | 2025-10-02 | 9.8 Critical |
| An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 picklescan allows a remote attacker to bypass security scans. This is achieved by crafting a ZIP archive containing a file with a bad Cyclic Redundancy Check (CRC), which causes the scanner to halt and fail to analyze the contents for malicious pickle files. When the file incorrectly considered safe is loaded, it can lead to the execution of malicious code. | ||||
| CVE-2025-11096 | 2 D-link, Dlink | 3 Dir-823x, Dir-823x, Dir-823x Firmware | 2025-10-02 | 6.3 Medium |
| A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. | ||||
| CVE-2025-11097 | 2 D-link, Dlink | 3 Dir-823x, Dir-823x, Dir-823x Firmware | 2025-10-02 | 6.3 Medium |
| A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-11098 | 2 D-link, Dlink | 3 Dir-823x, Dir-823x, Dir-823x Firmware | 2025-10-02 | 6.3 Medium |
| A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of the argument macList results in command injection. The attack may be performed from remote. The exploit has been made public and could be used. | ||||
| CVE-2025-11099 | 2 D-link, Dlink | 3 Dir-823x, Dir-823x, Dir-823x Firmware | 2025-10-02 | 6.3 Medium |
| A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2025-11100 | 2 D-link, Dlink | 3 Dir-823x, Dir-823x, Dir-823x Firmware | 2025-10-02 | 6.3 Medium |
| A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. | ||||
| CVE-2023-34634 | 1 Getgreenshot | 1 Greenshot | 2025-10-02 | 7.8 High |
| Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened. | ||||