Low · CVSS 3.7
A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option or ‘pandoc-server’ can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf.
Published Jul 11, 2025 · Updated Jul 5, 2026
High · CVSS 7.5
Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System v1.0 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.5
Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.5
Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.1
Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.5
Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.5
Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.1
Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.1
Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.1
Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.1
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 7.1
Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack.
Published Jul 28, 2025 · Updated Jul 5, 2026
High · CVSS 8.1
An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request
Published Jul 30, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function
Published Jul 30, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.
Published Jul 29, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
Published Jul 30, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data packets. This issue allows attackers to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.
Published Jul 9, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data packets. This issue allows attackers to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.
Published Jul 9, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive information via the cid parameter in the GET request.
Published Jul 8, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
WINSTAR WN572HP3 v230525 was discovered to contain a heap overflow via the CONTENT_LENGTH variable at /cgi-bin/upload.cgi.
Published Jul 2, 2025 · Updated Jul 5, 2026
High · CVSS 8.8
Archer 6.11.00204.10014 allows attackers to execute arbitrary code via crafted system inputs that would be exported into the CSV and be executed after the user opened the file with compatible applications. NOTE: the Supplier does not accept this as a valid vulnerability report against their product.
Published Jul 31, 2025 · Updated Jul 5, 2026
High · CVSS 7.5
In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT_GLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected.
Published Jul 21, 2025 · Updated Jul 5, 2026
High · CVSS 7.5
In TRENDnet TPL-430AP FW1.0, the USERLIMIT_GLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users are connected.
Published Jul 21, 2025 · Updated Jul 5, 2026
High · CVSS 7.5
In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 exposes identity information in plaintext, is vulnerable to offline dictionary attacks, and lacks flexibility in negotiating security parameters.
Published Jul 21, 2025 · Updated Jul 5, 2026
High · CVSS 7.3
In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE Responders are allowed to use IKEv1 Aggressive Mode with Pre-Shared Keys to conduct offline attacks on the openly transmitted hash of the PSK.
Published Jul 21, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
Tenda AC8V4 V16.03.34.06` was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument `mac` leads to heap-based buffer overflow.
Published Jul 24, 2025 · Updated Jul 5, 2026
Medium · CVSS 5.3
Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/WifiGuestSet. The manipulation of the argument `shareSpeed` leads to stack-based buffer overflow.
Published Jul 24, 2025 · Updated Jul 5, 2026
High · CVSS 8.6
Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow.
Published Jul 24, 2025 · Updated Jul 5, 2026
Medium · CVSS 5.3
Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg. The manipulation of the argument `timeZone` and `timeType` leads to stack-based buffer overflow.
Published Jul 24, 2025 · Updated Jul 5, 2026
Medium · CVSS 5.3
Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/fast_setting_wifi_set. The manipulation of the argument `timeZone` leads to stack-based buffer overflow.
Published Jul 24, 2025 · Updated Jul 5, 2026
High · CVSS 8.6
An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks.
Published Jul 31, 2025 · Updated Jul 5, 2026
High · CVSS 8
CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR). The user profile functionality allows enabling or disabling stickers through a parameter (company_id) sent in the request. However, this operation is not properly validated on the server side. An authenticated user can manipulate the request to target other users' accounts and toggle the sticker setting by modifying the company_id or other object identifiers.
Published Jul 31, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.1
A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This allows an attacker to upload a crafted HTML file containing malicious content, such as a fake login form for credential harvesting or scripts for Cross-Site Scripting (XSS) attacks. Since the content is served from a trusted domain, it significantly increases the likelihood of successful phishing or script execution against other users.
Published Jul 31, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request.
Published Jul 31, 2025 · Updated Jul 5, 2026
High · CVSS 7.8
The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows local attackers to gain root shell access. Once accessed, the device exposes critical data including Wi-Fi credentials and ONVIF service credentials stored in plaintext, enabling further compromise of the network and connected systems.
Published Jul 30, 2025 · Updated Jul 5, 2026
Medium · CVSS 5.4
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.
Published Jul 23, 2025 · Updated Jul 5, 2026
High · CVSS 7.1
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
Published Jul 23, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.1
Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding
Published Jul 25, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function.
Published Jul 25, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.
Published Jul 25, 2025 · Updated Jul 5, 2026
High · CVSS 8.8
An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call.
Published Jul 28, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack.
Published Jul 29, 2025 · Updated Jul 5, 2026
High · CVSS 7.6
Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.
Published Jul 29, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
Published Jul 30, 2025 · Updated Jul 5, 2026
Critical · CVSS 9.8
Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.
Published Jul 17, 2025 · Updated Jul 5, 2026
High · CVSS 7.1
agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
Published Jul 18, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access arbitrary files on the system.
Published Jul 18, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access sensitive components and information.
Published Jul 18, 2025 · Updated Jul 5, 2026
High · CVSS 8.2
Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.
Published Jul 18, 2025 · Updated Jul 5, 2026
Medium · CVSS 6.5
A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure.
Published Jul 18, 2025 · Updated Jul 5, 2026
