KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has…
A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Executing a manipulation of the argument myusername can lead to sql injection. The attack can be…
A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument stud_no results in sql injection. The attack can be…
A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the component Login. Such manipulation of the argument txtUsername leads to sql injection. It is possible to…
A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality of the file /results.php of the component Search. The manipulation of the argument user_query…
A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /customer_register.php. Executing manipulation can lead to unrestricted upload. It is possible to launch…
md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in…
hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This…
Przepełnienie bufora w MLX umożliwia ujawnienie informacji lub awarię aplikacji.
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent…
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled…
Błąd w Vault Terraform Provider może prowadzić do obejścia uwierzytelnienia w LDAP.
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing…
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it…
EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password may be identified through a brute force attack.
Brak nagłówków antycache w AuthKit dla Next.js pozwala na ujawnienie tokenów sesji wielu użytkownikom.
Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. This issue has been patched in version…
Wstrzyknięcie SQL w itsourcecode Online File Management System umożliwia zdalne ataki.
Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network.
Azure Monitor Elevation of Privilege Vulnerability
Microsoft SharePoint Online Elevation of Privilege Vulnerability
Azure Bastion Elevation of Privilege Vulnerability
Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of [regsvr32.exe] it loads. An attacker can place a…
An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force…
Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2025-13560 A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The manipulation of the argument email results in… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,42 % | ||
| CVE-2025-13556 A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Executing a manipulation of the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,42 % | ||
| CVE-2025-13555 A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,42 % | ||
| CVE-2025-13554 A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the component Login. Such manipulation of… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,42 % | ||
| CVE-2025-13546 A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality of the file /results.php of… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-13544 A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected is an unknown function of the file /customer_register.php. Executing… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,41 % | ||
| CVE-2025-65108 md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter… |
Wysoki priorytet |
CVSS 10,0EPSS 0,96 % | ||
| CVE-2025-64767 hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows… |
Wysoki priorytet |
CVSS 9,1EPSS 0,23 % | ||
| CVE-2025-62608 Przepełnienie bufora w MLX umożliwia ujawnienie informacji lub awarię aplikacji. |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,56 % | ||
| CVE-2025-30201 Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,1EPSS 0,81 % | ||
| CVE-2025-41115 SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle… |
Wysoki priorytet |
CVSS 9,8EPSS 17,5 % | ||
| CVE-2025-13357 Błąd w Vault Terraform Provider może prowadzić do obejścia uwierzytelnienia w LDAP. |
Wysoki priorytet |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2025-11127 The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing… |
Wysoki priorytet |
CVSS 9,8EPSS 0,35 % | ||
| CVE-2025-11456 The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post()… |
Wysoki priorytet |
CVSS 9,8EPSS 0,79 % | ||
| CVE-2025-64310 EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password may be identified through a… |
Wysoki priorytet |
CVSS 9,3EPSS 0,48 % | ||
| CVE-2025-64762 Brak nagłówków antycache w AuthKit dla Next.js pozwala na ujawnienie tokenów sesji wielu użytkownikom. |
Wysoki priorytet |
CVSS 9,1EPSS 0,39 % | ||
| CVE-2025-64755 Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to… |
Wysoki priorytet |
CVSS 9,8EPSS 0,62 % | ||
| CVE-2025-13485 Wstrzyknięcie SQL w itsourcecode Online File Management System umożliwia zdalne ataki. |
Wysoki priorytet |
CVSS 9,8EPSS 0,4 % | ||
| CVE-2025-64655 Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privileges over a network. |
Wysoki priorytet |
CVSS 9,8EPSS 0,52 % | ||
| CVE-2025-62207 Azure Monitor Elevation of Privilege Vulnerability |
Wysoki priorytet |
CVSS 9,8EPSS 0,76 % | ||
| CVE-2025-59245 Microsoft SharePoint Online Elevation of Privilege Vulnerability |
Wysoki priorytet |
CVSS 9,8EPSS 1,13 % | ||
| CVE-2025-49752 Azure Bastion Elevation of Privilege Vulnerability |
Wysoki priorytet |
CVSS 10,0EPSS 0,91 % | ||
| CVE-2025-63685 Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,4 % | ||
| CVE-2025-63807 An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,52 % | ||
| CVE-2025-10571 Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. |
Wysoki priorytet |
CVSS 9,4EPSS 0,32 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 15:02 UTC – 12.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.