Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Courier Management System | CVE-2025-13396 A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public… |
9,8 | 0,35 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63218 The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users,… |
9,8 | 0,68 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Emby.Security | CVE-2025-64325 Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has… |
9,0 | 0,44 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63216 The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the… |
10,0 | 0,76 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63217 The Itel DAB MUX (IDMUX build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the… |
9,8 | 0,59 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63228 The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /upload_file.php endpoint. An attacker can exploit this by sending a crafted POST request with a malicious file (e.g., a PHP webshell) to the server. The… |
9,8 | 0,82 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63225 The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized… |
9,8 | 0,65 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63694 DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage. |
9,8 | 0,38 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63695 DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php. |
9,8 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| FortiWeb | Fortinet FortiWeb OS Command Injection Vulnerability Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. |
7,2 | 54,72 % | Tak | |
| Train Station Ticketing System | CVE-2025-13344 A weakness has been identified in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. The attack can be initiated remotely. The exploit has… |
9,8 | 0,68 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Simple Pizza Ordering System | CVE-2025-13323 A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /listorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public… |
9,8 | 0,48 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| DWR-M920 / DWR-M921 / DWR-M960 (+2 produktów) | CVE-2025-13305 A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched… |
9,8 | 3,85 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Chrome | Google Chromium V8 Type Confusion Vulnerability Typowe pomylenie w V8 w Google Chrome umożliwia zdalnemu atakującemu potencjalne wykorzystanie uszkodzenia sterty. |
8,8 | 4,9 % | Tak | |
| Courier Management System | CVE-2025-13302 Wstrzyknięcie SQL w Courier Management System umożliwia zdalne ataki na bazę danych. |
9,8 | 0,41 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Courier Management System | CVE-2025-13303 Wstrzyknięcie SQL w Courier Management System umożliwia zdalne wykonanie ataku. |
9,8 | 0,4 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web-Based Internet Laboratory Management System | CVE-2025-13300 Wstrzyknięcie SQL w itsourcecode Web-Based Internet Laboratory Management System umożliwia zdalny atak. |
9,8 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web-Based Internet Laboratory Management System | CVE-2025-13301 Wstrzyknięcie SQL w itsourcecode Web-Based Internet Laboratory Management System umożliwia zdalny atak. |
9,8 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web-Based Internet Laboratory Management System | CVE-2025-13298 Wstrzyknięcie SQL w itsourcecode Web-Based Internet Laboratory Management System umożliwia zdalne ataki. |
9,8 | 0,45 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web-Based Internet Laboratory Management System | CVE-2025-13299 Wstrzyknięcie SQL w itsourcecode Web-Based Internet Laboratory Management System umożliwia zdalne ataki. |
9,8 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2024-44659 SQL Injection w PHPGurukul Online Shopping Portal umożliwia nieautoryzowany dostęp do danych. |
9,8 | 0,44 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Web-Based Internet Laboratory Management System | CVE-2025-13297 Wstrzyknięcie SQL w itsourcecode Web-Based Internet Laboratory Management System umożliwia zdalne ataki. |
9,8 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Supplier Management System | CVE-2025-13291 Wstrzyknięcie SQL w Campcodes Supplier Management System umożliwia zdalne wykonanie ataku. |
9,8 | 0,42 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Produkt nieustalony | CVE-2025-63747 QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can… |
9,8 | 0,47 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków | |
| Online Voting System | CVE-2025-13285 Wstrzyknięcie SQL w itsourcecode Online Voting System umożliwia zdalne ataki. |
9,8 | 0,45 %Nieaktualne | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 11:02 UTC – 15.11.2026, 16:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.