KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Błąd w rclone umożliwia atakującym ustawienie bitów setuid/setgid na plikach, co prowadzi do eskalacji uprawnień.
Otwarte przekierowanie w CloudPanel Community Edition umożliwia zdalne ataki.
Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the…
Błąd w AnythingLLM pozwala na dostęp do danych innych użytkowników w trybie wieloosobowym.
Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a high complexity attack may enable data…
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed…
Luka w Oracle E-Business Intelligence pozwala na nieautoryzowane modyfikacje danych po interakcji użytkownika.
A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads…
A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack…
A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is possible. The exploit has…
A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql…
A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to…
A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed…
A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack…
A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site…
A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attack…
A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was…
A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The…
A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manipulation of the argument viewRoleId/cfType can lead to cross site scripting. The attack can be launched remotely. The…
Lokalne atakowanie w linuxfabrik-lib pozwala na nadpisywanie plików przez symlink.
Wada wykonania przejściowego w procesorach AMD umożliwia lokalnemu atakującemu wyciek danych.
W AnythingLLM przed wersją 1.13.0 nieprawidłowe sprawdzanie symlinków pozwala na kopiowanie plików spoza dozwolonego katalogu.
A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to…
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Błąd w rclone umożliwia atakującym ustawienie bitów setuid/setgid na plikach, co prowadzi do eskalacji uprawnień. | Błąd w rclone umożliwia atakującym ustawienie bitów setuid/setgid na plikach, co prowadzi do eskalacji uprawnień. |
Do wiadomości | 2,0 | 0,23 % | ||
| Otwarte przekierowanie w CloudPanel Community Edition umożliwia zdalne ataki. | Otwarte przekierowanie w CloudPanel Community Edition umożliwia zdalne ataki. |
Do wiadomości | 2,0 | 0,22 % | ||
| Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. | Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the… |
Do wiadomości | 2,0 | 0,22 % | ||
| Błąd w AnythingLLM pozwala na dostęp do danych innych użytkowników w trybie wieloosobowym. | Błąd w AnythingLLM pozwala na dostęp do danych innych użytkowników w trybie wieloosobowym. |
Do wiadomości | 2,0 | 0,22 % | ||
| Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User… | Unrestricted upload of file with dangerous type for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a high complexity attack may enable data… |
Do wiadomości | 2,0 | 0,22 % | ||
| A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. | A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed… |
Do wiadomości | 2,0 | 0,22 % | ||
| Luka w Oracle E-Business Intelligence pozwala na nieautoryzowane modyfikacje danych po interakcji użytkownika. | Luka w Oracle E-Business Intelligence pozwala na nieautoryzowane modyfikacje danych po interakcji użytkownika. |
Do wiadomości | 2,0 | 0,21 % | ||
| A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8… | A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads… |
Do wiadomości | 2,0 | 0,21 % | ||
| A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. | A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack… |
Do wiadomości | 2,0 | 0,2 % | ||
| A flaw has been found in ZZCMS 2025. | A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is possible. The exploit has… |
Do wiadomości | 2,0 | 0,2 % | ||
| A vulnerability was found in Comsenz Discuz! | A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql… |
Do wiadomości | 2,0 | 0,2 % | ||
| A vulnerability has been found in SourceCodester Inventory System 1.0. | A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to… |
Do wiadomości | 2,0 | 0,2 % | ||
| A weakness has been identified in y_project RuoYi up to 4.8.3. | A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed… |
Do wiadomości | 2,0 | 0,2 % | ||
| A vulnerability has been found in InstantSoft icms2 up to 2.18.2. | A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack… |
Do wiadomości | 2,0 | 0,2 % | ||
| A vulnerability was found in code-projects Human Resource Management System 1.0. | A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site… |
Do wiadomości | 2,0 | 0,2 % | ||
| A flaw has been found in code-projects Human Resource Management 1.0. | A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attack… |
Do wiadomości | 2,0 | 0,2 % | ||
| A vulnerability was detected in Netis WF2409E 3.3.42541. | A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was… |
Do wiadomości | 2,0 | 0,19 % | ||
| A weakness has been identified in Omega Solution CoinEx Crypto 2025. | A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The… |
Do wiadomości | 2,0 | 0,19 % | ||
| A flaw has been found in Eleveo Call Recording Software 9.7.0. | A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/audio.jsp of the component Play Audio Page. Executing a manipulation of the argument viewRoleId/cfType can lead to cross site scripting. The attack can be launched remotely. The… |
Do wiadomości | 2,0 | 0,19 % | ||
| Lokalne atakowanie w linuxfabrik-lib pozwala na nadpisywanie plików przez symlink. | Lokalne atakowanie w linuxfabrik-lib pozwala na nadpisywanie plików przez symlink. |
Do wiadomości | 2,0 | 0,19 % | ||
| Wada wykonania przejściowego w procesorach AMD umożliwia lokalnemu atakującemu wyciek danych. | Wada wykonania przejściowego w procesorach AMD umożliwia lokalnemu atakującemu wyciek danych. |
Do wiadomości | 2,0 | 0,19 % | ||
| W AnythingLLM przed wersją 1.13.0 nieprawidłowe sprawdzanie symlinków pozwala na kopiowanie plików spoza dozwolonego katalogu. | W AnythingLLM przed wersją 1.13.0 nieprawidłowe sprawdzanie symlinków pozwala na kopiowanie plików spoza dozwolonego katalogu. |
Do wiadomości | 2,0 | 0,19 % | ||
| A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow. | A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow. |
Do wiadomości | 2,0 | 0,19 % | ||
| Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file… | Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to… |
Do wiadomości | 2,0 | 0,19 % | ||
| A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. | A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The… |
Do wiadomości | 2,0 | 0,18 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.