KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila subscription. This is fixed in version 0.24.4. As a workaround, disable shared…
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended.
Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to steal…
Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute…
Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&'…
GOM Player 2.3.90.5360 contains a buffer overflow vulnerability in the equalizer preset name input field that allows attackers to crash the application. Attackers can overwrite the preset name with 260 'A' characters to trigger a buffer overflow and cause…
MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without…
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered
Błąd w OpenShift GitOps pozwala na eskalację uprawnień do root w klastrze.
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the…
A vulnerability was detected in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This affects an unknown part of the file /controller/api/OrderList.php. The manipulation of the argument telephone results in sql injection. The attack…
A flaw has been found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This vulnerability affects unknown code of the file /controller/api/hotelList.php. This manipulation of the argument pickedHotelName/type causes sql…
A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been…
XSS w MISP umożliwia atakującemu wykonanie złośliwego skryptu w ścieżce wykonania.
Przepełnienie bufora w snap7-rs umożliwia zdalne wykonanie kodu.
Wstrzyknięcie SQL w campcodes Advanced Online Examination System umożliwia zdalne ataki.
Przepełnienie bufora w snap7-rs umożliwia zdalne wykonanie kodu.
Wstrzyknięcie SQL w COVID Tracking System umożliwia zdalne wykonanie kodu.
Wstrzyknięcie SQL w COVID Tracking System umożliwia zdalne wykonanie nieautoryzowanych zapytań.
Wstrzyknięcie SQL w Campcodes Supplier Management System umożliwia zdalne wykonanie ataku.
A vulnerability has been found in itsourcecode Student Managemen System 1.0. Affected by this issue is some unknown functionality of the file /advisers.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The…
A vulnerability was detected in D-Link DIR-860LB1 and DIR-868LB1 203b01/203b03. Affected is an unknown function of the component DHCP Daemon. The manipulation of the argument Hostname results in command injection. It is possible to launch the attack…
A vulnerability was determined in itsourcecode Student Management System 1.0. Impacted is an unknown function of the file /addrecord.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit…
Wstrzyknięcie SQL w Online Cake Ordering System umożliwia zdalne ataki.
Wstrzyknięcie SQL w systemie zamówień ciast itsourcecode umożliwia zdalne manipulowanie danymi.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-59947 NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscription and vanila… |
Wysoki priorytet |
CVSS 9,0EPSS 0,33 % | ||
| CVE-2025-64725 Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround,… |
Wysoki priorytet |
CVSS 9,8EPSS 0,35 % | ||
| CVE-2023-53877 Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based,… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,45 % | ||
| CVE-2023-53871 Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,64 % | ||
| CVE-2023-53872 Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands… |
Wysoki priorytet |
CVSS 9,3EPSS 1,12 % | ||
| CVE-2023-53874 GOM Player 2.3.90.5360 contains a buffer overflow vulnerability in the equalizer preset name input field that allows attackers to crash the application. Attackers can overwrite the preset… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2025-65213 MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,74 % | ||
| CVE-2025-66844 In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,29 % | ||
| CVE-2025-13888 Błąd w OpenShift GitOps pozwala na eskalację uprawnień do root w klastrze. |
Wysoki priorytet |
CVSS 9,1EPSS 0,69 % | ||
| CVE-2025-14156 The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly… |
Wysoki priorytet |
CVSS 9,8EPSS 6,76 % | ||
| CVE-2025-14710 A vulnerability was detected in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This affects an unknown part of the file /controller/api/OrderList.php. The… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,42 % | ||
| CVE-2025-14711 A flaw has been found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This vulnerability affects unknown code of the file /controller/api/hotelList.php. This… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,45 % | ||
| CVE-2025-14704 A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal.… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 12,49 % | ||
| CVE-2025-67906 XSS w MISP umożliwia atakującemu wykonanie złośliwego skryptu w ścieżce wykonania. |
Wysoki priorytet |
CVSS 9,0EPSS 0,33 % | ||
| CVE-2025-14673 Przepełnienie bufora w snap7-rs umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,49 % | ||
| CVE-2025-14668 Wstrzyknięcie SQL w campcodes Advanced Online Examination System umożliwia zdalne ataki. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14672 Przepełnienie bufora w snap7-rs umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,49 % | ||
| CVE-2025-14666 Wstrzyknięcie SQL w COVID Tracking System umożliwia zdalne wykonanie kodu. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14667 Wstrzyknięcie SQL w COVID Tracking System umożliwia zdalne wykonanie nieautoryzowanych zapytań. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14664 Wstrzyknięcie SQL w Campcodes Supplier Management System umożliwia zdalne wykonanie ataku. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14661 A vulnerability has been found in itsourcecode Student Managemen System 1.0. Affected by this issue is some unknown functionality of the file /advisers.php. Such manipulation of the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14659 A vulnerability was detected in D-Link DIR-860LB1 and DIR-868LB1 203b01/203b03. Affected is an unknown function of the component DHCP Daemon. The manipulation of the argument Hostname… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 3,8 % | ||
| CVE-2025-14653 A vulnerability was determined in itsourcecode Student Management System 1.0. Impacted is an unknown function of the file /addrecord.php. This manipulation of the argument ID causes sql… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14652 Wstrzyknięcie SQL w Online Cake Ordering System umożliwia zdalne ataki. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14650 Wstrzyknięcie SQL w systemie zamówień ciast itsourcecode umożliwia zdalne manipulowanie danymi. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,4 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 11.11.2026, 23:02 UTC – 12.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.