KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kindeditor/php/upload_json.php. Performing manipulation of the argument imgFile results in…
A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the…
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this…
A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_unit.php. Such manipulation of the argument txtunitDetails leads to sql injection. The attack can be…
A flaw has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/add_distributor.php. This manipulation of the argument txtDistributorAddress causes sql injection. The attack can be initiated remotely. The…
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes…
Wstrzyknięcie poleceń w Cybersecurity AI umożliwia atakującym wykonanie dowolnych komend na zdalnym serwerze.
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the…
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.
Hardkodowane dane Wi-Fi w Meatmeet Pro umożliwiają nieautoryzowany dostęp do sieci.
The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the Wi-Fi network of the vendor.…
The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit.…
Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its contents, and modify the requests in transit. This may result in a…
An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several…
UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value…
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new…
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath'…
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request…
Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and…
Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit the vulnerability by sending a crafted POST request with oversized…
A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request.
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page…
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page…
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page…
A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-14522 A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kindeditor/php/upload_json.php.… |
Wysoki priorytet |
CVSS 9,8EPSS 0,31 % | ||
| CVE-2025-14518 A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,35 % | ||
| CVE-2025-14265 In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary… |
Wysoki priorytet |
CVSS 9,1EPSS 0,37 % | ||
| CVE-2025-14515 A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_unit.php. Such manipulation of… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-14514 A flaw has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/add_distributor.php. This manipulation of the argument… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,42 % | ||
| CVE-2025-13764 The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function… |
Wysoki priorytet |
CVSS 9,8EPSS 0,35 % | ||
| CVE-2025-67511 Wstrzyknięcie poleceń w Cybersecurity AI umożliwia atakującym wykonanie dowolnych komend na zdalnym serwerze. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,6EPSS 2,02 % | ||
| CVE-2025-67510 Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() +… |
Wysoki priorytet |
CVSS 9,4EPSS 0,41 % | ||
| CVE-2025-65294 Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,8 % | ||
| CVE-2025-65823 Hardkodowane dane Wi-Fi w Meatmeet Pro umożliwiają nieautoryzowany dostęp do sieci. |
Wysoki priorytet |
CVSS 9,8EPSS 0,43 % | ||
| CVE-2025-65826 The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network,… |
Wysoki priorytet |
CVSS 9,8EPSS 0,3 % | ||
| CVE-2025-65827 The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept… |
Wysoki priorytet |
CVSS 9,1EPSS 0,26 % | ||
| CVE-2025-65830 Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its… |
Wysoki priorytet |
CVSS 9,1EPSS 0,27 % | ||
| CVE-2025-65820 An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not… |
Wysoki priorytet |
CVSS 9,8EPSS 0,47 % | ||
| CVE-2020-36902 UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,14 % | ||
| CVE-2023-53740 Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,88 % | ||
| CVE-2020-36897 QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,3 % | ||
| CVE-2020-36898 QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication.… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 1,74 % | ||
| CVE-2020-36892 Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,05 % | ||
| CVE-2020-36885 Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 1,23 % | ||
| CVE-2025-65602 A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request. |
Wysoki priorytet |
CVSS 9,8EPSS 0,54 % | ||
| CVE-2025-64538 Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could… |
Wysoki priorytet |
CVSS 9,3EPSS 0,64 % | ||
| CVE-2025-64539 Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could… |
Wysoki priorytet |
CVSS 9,3EPSS 0,48 % | ||
| CVE-2025-64537 Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could… |
Wysoki priorytet |
CVSS 9,3EPSS 0,74 % | ||
| CVE-2025-13607 A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL. |
Wysoki priorytet |
CVSS 9,3EPSS 0,78 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 03:02 UTC – 12.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.