Total
306530 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-38994 | 1 Amoyjs | 1 Common | 2025-07-07 | N/A | 7.3 HIGH |
| amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | |||||
| CVE-2025-40732 | 1 Code-projects | 1 Daily Expense Manager | 2025-07-07 | N/A | 7.5 HIGH |
| user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php | |||||
| CVE-2025-40731 | 1 Code-projects | 1 Daily Expense Manager | 2025-07-07 | N/A | 9.8 CRITICAL |
| SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php. | |||||
| CVE-2025-21191 | 1 Microsoft | 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more | 2025-07-07 | N/A | 7.0 HIGH |
| Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-6487 | 1 Totolink | 2 A3002r, A3002r Firmware | 2025-07-07 | 9.0 HIGH | 8.8 HIGH |
| A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been rated as critical. This issue affects the function formRoute of the file /boafrm/formRoute. The manipulation of the argument subnet leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2023-47253 | 1 Qualitor | 1 Qualitor | 2025-07-07 | N/A | 9.8 CRITICAL |
| Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter. | |||||
| CVE-2025-6486 | 1 Totolink | 2 A3002r, A3002r Firmware | 2025-07-07 | 9.0 HIGH | 8.8 HIGH |
| A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-6123 | 1 Carmelogarcia | 1 Restaurant Order System | 2025-07-07 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability has been found in code-projects Restaurant Order System 1.0 and classified as critical. This vulnerability affects unknown code of the file /payment.php. The manipulation of the argument tabidNoti leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-6161 | 1 Fabianros | 1 Simple Food Ordering System | 2025-07-07 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /editproduct.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2023-28267 | 1 Microsoft | 14 Remote Desktop Client, Windows 10 1507, Windows 10 1607 and 11 more | 2025-07-07 | N/A | 6.5 MEDIUM |
| Remote Desktop Protocol Client Information Disclosure Vulnerability | |||||
| CVE-2023-29362 | 1 Microsoft | 13 Remote Desktop Client, Windows 10 1507, Windows 10 1607 and 10 more | 2025-07-07 | N/A | 8.8 HIGH |
| Remote Desktop Client Remote Code Execution Vulnerability | |||||
| CVE-2023-29352 | 1 Microsoft | 8 Remote Desktop Client, Windows 10 1809, Windows 10 21h2 and 5 more | 2025-07-07 | N/A | 6.5 MEDIUM |
| Windows Remote Desktop Security Feature Bypass Vulnerability | |||||
| CVE-2025-26645 | 1 Microsoft | 16 Remote Desktop Client, Windows 10 1507, Windows 10 1607 and 13 more | 2025-07-07 | N/A | 8.8 HIGH |
| Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2023-28290 | 1 Microsoft | 1 Remote Desktop App | 2025-07-07 | N/A | 5.3 MEDIUM |
| Microsoft Remote Desktop app for Windows Information Disclosure Vulnerability | |||||
| CVE-2024-6040 | 1 Lollms | 1 Lollms Web Ui | 2025-07-07 | N/A | 8.8 HIGH |
| In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine. | |||||
| CVE-2025-6538 | 1 Bourgesloic | 1 Post Rating And Review | 2025-07-07 | N/A | 6.4 MEDIUM |
| The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-2040 | 1 Iocoder | 1 Ruoyi-vue-pro | 2025-07-07 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-26206 | 1 Selldone | 1 Storefront | 2025-07-07 | N/A | 9.0 CRITICAL |
| Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component | |||||
| CVE-2025-26849 | 1 Docusnap | 1 Docusnap | 2025-07-07 | N/A | 4.3 MEDIUM |
| There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules. | |||||
| CVE-2025-26320 | 1 T0mer | 1 Broadlinkmanager | 2025-07-07 | N/A | 6.5 MEDIUM |
| t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping. | |||||