Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Supplier Management System | CVE-2025-14877 A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_retailer.php. The manipulation of the argument cmbAreaCode leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly… |
9,8 | 0,39 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| SMA1000 | SonicWall SMA1000 Missing Authorization Vulnerability SonicWall SMA1000 contains a missing authorization vulnerability that could allow for privilege escalation appliance management console (AMC) of affected devices. |
6,6 | 2,76 % | Tak | |
| Webmail | RoundCube Webmail Cross-site Scripting Vulnerability RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document. |
6,1 | 27,41 % | Tak | |
| TinyWebGallery | CVE-2023-53922 TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded… |
9,3 | 1,11 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Ulicms | CVE-2023-53923 UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with… |
9,3 | 0,55 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Ulicms | CVE-2023-53914 UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative… |
9,3 | 0,69 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Online Cake Ordering System | CVE-2025-14832 A vulnerability was identified in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /updateproduct.php?action=edit. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly… |
9,8 | 0,39 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| RIOT | CVE-2025-66647 RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When copying the contents of the first… |
9,8 | 0,97 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Safari / iOS and iPadOS / macOS (+3 produktów) | Apple Multiple Products Use-After-Free WebKit Vulnerability Błąd use-after-free w Safari umożliwia zdalne wykonanie kodu przez złośliwe treści. |
8,8 | 25,65 % | Tak | |
| Produkt nieustalony | CVE-2025-67073 A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan. |
9,8 | 0,69 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| CRM | CVE-2025-62521 ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server… |
9,8 | 4,51 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-67165 An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. |
9,8 | 0,5 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-67164 An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
9,9 | 0,53 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Cisco Secure Email / Cisco Secure Email and Web Manager | Cisco Multiple Products Improper Input Validation Vulnerability Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. |
10,0 | 32,39 % | Tak | |
| Produkt nieustalony | CVE-2022-23851 Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI). |
9,8 | 0,5 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| live update | ASUS Live Update Embedded Malicious Code Vulnerability ASUS Live Update contains an embedded malicious code vulnerability client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. The impacted product… |
9,8 | 1,21 % | Tak | |
| Grassroot DICOM | CVE-2025-48429 An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An attacker can provide a malicious file to trigger this vulnerability. |
9,1 | 0,43 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63414 A Path Traversal vulnerability in the Allsky WebUI version v2024.12.06_06 allows an unauthenticated remote attacker to achieve arbitrary command execution. By sending a crafted HTTP request to the /html/execute.php endpoint with a malicious payload in the id parameter, an attacker can execute… |
10,0 | 1,85 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-50401 Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the parameter password. |
9,8 | 0,43 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-50398 Mercury D196G d196gv1-cn-up_2020-01-09_11.21.44 is vulnerable to Buffer Overflow in the function sub_404CAEDC via the parameter fac_password. |
9,8 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| HPE OneView | Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution. |
9,8 | 90,19 % | Tak | |
| PodcastGenerator | CVE-2023-53899 Podatność w PodcastGenerator umożliwia atakującym wstrzykiwanie XML i manipulację żądaniami HTTP. |
9,8 | 0,57 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| phpfm | CVE-2023-53894 phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass authentication and upload malicious PHP files to the server. |
9,3 | 0,62 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| PimpMyLog | CVE-2023-53895 PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account,… |
9,3 | 0,67 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-65318 Brak tagu Mark-of-the-Web w Canary Mail umożliwia atakującym ominięcie ochrony plików. |
9,1 | 0,56 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 07:02 UTC – 15.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.