KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about…
A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this…
A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a…
A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be…
A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. The…
A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr…
A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely.…
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,…
Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal.
Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a…
Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to…
Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the…
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to…
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request…
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Wyciek pamięci w ImageMagick umożliwia atakującym wywołanie odmowy usługi.
A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient…
Błąd w GNU C Library umożliwia zwracanie nieprawidłowej pamięci, co może prowadzić do awarii procesu.
Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.
Ujawnienie informacji w ImageMagick pozwala na odczytanie danych poza granicami profilu.
Wycieki pamięci w ImageMagick mogą prowadzić do odmowy usługi.
Wycieki pamięci w ImageMagick prowadzą do nieefektywnego zarządzania zasobami.
Wycieki pamięci w ImageMagick mogą prowadzić do zwiększonego zużycia zasobów.
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used…
Wstrzyknięcie poleceń w NellyW8 MCP4EDA umożliwia lokalne wykonanie kodu.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A vulnerability was detected in SEMCMS up to 5.0. | A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about… |
Do wiadomości | 2,1 | 0,19 % | ||
| A flaw has been found in SEMCMS up to 5.0. | A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this… |
Do wiadomości | 2,1 | 0,19 % | ||
| A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. | A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a… |
Do wiadomości | 2,1 | 0,19 % | ||
| A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. | A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be… |
Do wiadomości | 2,1 | 0,19 % | ||
| A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. | A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. The… |
Do wiadomości | 2,1 | 0,19 % | ||
| A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. | A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr… |
Do wiadomości | 2,1 | 0,19 % | ||
| A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. | A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely.… |
Do wiadomości | 2,1 | 0,19 % | ||
| Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site… | Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,… |
Do wiadomości | 2,1 | 0,19 % | ||
| Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network… | Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal. |
Do wiadomości | 2,1 | 0,19 % | ||
| Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification… | Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a… |
Do wiadomości | 2,1 | 0,19 % | ||
| Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because… | Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to… |
Do wiadomości | 2,1 | 0,19 % | ||
| Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard… | Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the… |
Do wiadomości | 2,1 | 0,19 % | ||
| SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting… | SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to… |
Do wiadomości | 2,1 | 0,17 % | ||
| A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. | A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request… |
Do wiadomości | 2,1 | 0,16 % | ||
| A weakness has been identified in SourceCodester Drug Recommendation System 1.0. | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. |
Do wiadomości | 2,1 | 0,16 % | ||
| Wyciek pamięci w ImageMagick umożliwia atakującym wywołanie odmowy usługi. | Wyciek pamięci w ImageMagick umożliwia atakującym wywołanie odmowy usługi. |
Do wiadomości | 2,1 | 0,14 % | ||
| A vulnerability was determined in InstantSoft icms2 up to 2.18.2. | A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient… |
Do wiadomości | 2,1 | 0,13 % | ||
| Błąd w GNU C Library umożliwia zwracanie nieprawidłowej pamięci, co może prowadzić do awarii procesu. | Błąd w GNU C Library umożliwia zwracanie nieprawidłowej pamięci, co może prowadzić do awarii procesu. |
Do wiadomości | 2,1 | 0,11 % | ||
| Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung… | Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device. |
Do wiadomości | 2,1 | 0,11 % | ||
| Ujawnienie informacji w ImageMagick pozwala na odczytanie danych poza granicami profilu. | Ujawnienie informacji w ImageMagick pozwala na odczytanie danych poza granicami profilu. |
Do wiadomości | 2,1 | 0,11 % | ||
| Wycieki pamięci w ImageMagick mogą prowadzić do odmowy usługi. | Wycieki pamięci w ImageMagick mogą prowadzić do odmowy usługi. |
Do wiadomości | 2,1 | 0,1 % | ||
| Wycieki pamięci w ImageMagick prowadzą do nieefektywnego zarządzania zasobami. | Wycieki pamięci w ImageMagick prowadzą do nieefektywnego zarządzania zasobami. |
Do wiadomości | 2,1 | 0,1 % | ||
| Wycieki pamięci w ImageMagick mogą prowadzić do zwiększonego zużycia zasobów. | Wycieki pamięci w ImageMagick mogą prowadzić do zwiększonego zużycia zasobów. |
Do wiadomości | 2,1 | 0,1 % | ||
| A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. | A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used… |
Do wiadomości | 1,9 | 1,08 % | ||
| Wstrzyknięcie poleceń w NellyW8 MCP4EDA umożliwia lokalne wykonanie kodu. | Wstrzyknięcie poleceń w NellyW8 MCP4EDA umożliwia lokalne wykonanie kodu. |
Do wiadomości | 1,9 | 1,08 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.