CVE & CWE, restez informé

CVE-2024-44659 - CRITICAL
17/11/2025

PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-13288 - HIGH
17/11/2025

A security vulnerability has been detected in Tenda CH22 1.0.0.1. This impacts the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-13319 - HIGH
17/11/2025

An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-63747 - CRITICAL
17/11/2025

QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can gain administrative access.

OWSAP: A07

>> Plus d'informations avec CVE Find

CVE-2025-63748 - HIGH
17/11/2025

QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The application fails to restrict file types, enabling the upload of executable PHP files. Once uploaded, the file can be accessed through the "View Attachment" option, which executes the PHP payload on the server.

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-13258 - HIGH
17/11/2025

A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-9501 - CRITICAL
17/11/2025

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.

CVE-2025-13284 - CRITICAL
17/11/2025

ThinPLUS developed by ThinPLUS has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.

oscommandinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-13189 - HIGH
15/11/2025

A vulnerability has been found in D-Link DIR-816L 2_06_b09_beta. This affects the function genacgi_main of the file gena.cgi. The manipulation of the argument SERVER_ID/HTTP_SID leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported b...

overflow

>> Plus d'informations avec CVE Find

CVE-2025-13190 - HIGH
15/11/2025

A vulnerability was found in D-Link DIR-816L 2_06_b09_beta. This vulnerability affects the function scandir_main of the file /portal/__ajax_exporer.sgi. The manipulation of the argument en results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the m...

overflow

>> Plus d'informations avec CVE Find

CVE-2025-13191 - HIGH
15/11/2025

A vulnerability was determined in D-Link DIR-816L 2_06_b09_beta. This issue affects the function soapcgi_main of the file /soap.cgi. This manipulation causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-13188 - CRITICAL
14/11/2025

A vulnerability was detected in D-Link DIR-816L 2_06_b09_beta. Affected by this vulnerability is the function authenticationcgi_main of the file /authentication.cgi. Performing manipulation of the argument Password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. This vulnerability only affects products that are no lo...

overflow

>> Plus d'informations avec CVE Find

CVE-2025-55034 - HIGH
14/11/2025

General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.

OWSAP: A07

>> Plus d'informations avec CVE Find

CVE-2025-58083 - CRITICAL
14/11/2025

General Industrial Controls Lynx+ Gateway  is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.

authorisationproblemOWSAP: A07

>> Plus d'informations avec CVE Find

CVE-2025-64309 - HIGH
14/11/2025

Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

OWSAP: A02

>> Plus d'informations avec CVE Find

CVE-2025-9317 - HIGH
14/11/2025

The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes.

OWSAP: A02

>> Plus d'informations avec CVE Find

CVE-2025-54339 - CRITICAL
14/11/2025

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges.

OWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-54343 - CRITICAL
14/11/2025

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 exploitable remotely for Escalation of Privileges.

OWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-63680 - HIGH
14/11/2025

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a same-basename script, Nero BackItUp renders the file as a folder icon and then invokes ShellExecuteW, whic...

directorytraversalOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-13169 - CRITICAL
14/11/2025

A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /add_query_reserve.php. Such manipulation of the argument room_id leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find