CVE-2025-9316
N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.
PUBLISHED
- Vendor
- N-able
- Product
- N-central
- Provider severity
- MEDIUM
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2025-9315
An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted JSON payload to the device's registration endpoint /api/v1/devices/register, allowing the attacker to register unauthorized devices without authentication. Although exploiting this vulnerability has limited modifi
PUBLISHED
- Vendor
- Moxa
- Product
- MXsecurity Series
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-9313
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5.
PUBLISHED
- Vendor
- Asseco Poland S.A.
- Product
- mMedica
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-9312
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP serv
PUBLISHED
- Vendor
- WSO2, WSO2, WSO2, WSO2, WSO2, WSO2, WSO2, WSO2, WSO2, WSO2
- Product
- org.wso2.carbon.identity.auth.service, WSO2 Traffic Manager, WSO2 Identity Server, WSO2 Open Banking KM, WSO2 API Manager, WSO2 Open Banking AM, WSO2 API Control Plane, WSO2 Open Banking IAM, WSO2 Identity Server as Key Manager, WSO2 Universal Gateway
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-9311
A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /fair/addfair.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
PUBLISHED
- Vendor
- itsourcecode
- Product
- Apartment Management System
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2025-9310
A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unknown functionality of the file /carRental_war/druid/login.html of the component Druid. Executing manipulation can lead to hard-coded credentials. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version de
PUBLISHED
- Vendor
- yeqifu
- Product
- carRental
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-9309
A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing manipulation results in hard-coded credentials. The attack needs to be approached locally. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made public and could be used.
PUBLISHED
- Vendor
- Tenda
- Product
- AC10
- Provider severity
- LOW
- Conflicts
- 2
CVE-2025-9308
A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.
PUBLISHED
- Vendor
- yarnpkg
- Product
- Yarn
- Provider severity
- LOW, MEDIUM
- Conflicts
- 2
CVE-2025-9307
A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This manipulation of the argument sesssion causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
PUBLISHED
- Vendor
- PHPGurukul
- Product
- Online Course Registration
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2025-9306
A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice/addNotice. The manipulation of the argument noticeSubject results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.
PUBLISHED
- Vendor
- SourceCodester
- Product
- Advanced School Management System
- Provider severity
- LOW, MEDIUM
- Conflicts
- 2
CVE-2025-9305
A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. The affected element is an unknown function of the file /bank/mnotice.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
PUBLISHED
- Vendor
- SourceCodester
- Product
- Online Bank Management System
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2025-9304
A weakness has been identified in SourceCodester Online Bank Management System 1.0. Impacted is an unknown function of the file /bank/show.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited.
PUBLISHED
- Vendor
- SourceCodester
- Product
- Online Bank Management System
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2025-9303
A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument desc results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
PUBLISHED
- Vendor
- TOTOLINK
- Product
- A720R
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-9302
A vulnerability was identified in PHPGurukul User Management System 1.0. This vulnerability affects unknown code of the file /signup.php. Such manipulation of the argument emailid leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
PUBLISHED
- Vendor
- PHPGurukul
- Product
- User Management System
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2025-9301
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
PUBLISHED
- Vendor
- n/a
- Product
- cmake
- Provider severity
- LOW, MEDIUM
- Conflicts
- 1
CVE-2025-9300
A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue.
PUBLISHED
- Vendor
- saitoha
- Product
- libsixel
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-9299
A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of the file /goform/getMasterPassengerAnalyseData. The manipulation of the argument Time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- Tenda
- Product
- M3
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-9298
A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Executing manipulation of the argument PPPOEPassword can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
PUBLISHED
- Vendor
- Tenda
- Product
- M3
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-9297
A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /goform/wxportalauth. Performing manipulation of the argument Type results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
PUBLISHED
- Vendor
- Tenda
- Product
- i22
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-9296
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- n/a
- Product
- Emlog Pro
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-9294
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results.
PUBLISHED
- Vendor
- expresstech
- Product
- Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-9293
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.
PUBLISHED
- Vendor
- TP-Link Systems Inc., TP Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc.
- Product
- VIGI App, Omada App, Aginet App, Tether App, Festa App, KidShield, Tapo App, Wi-Fi Navi, tpCamera App, TP-Partner App, Deco App, Omada Guard, WiFi Toolkit, Kasa App
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-9292
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
PUBLISHED
- Vendor
- TP-Link Systems Inc.
- Product
- Omada Cloud Controller
- Provider severity
- LOW
- Conflicts
- 0
CVE-2025-9291
A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers.
PUBLISHED
- Vendor
- TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc.
- Product
- Omada Switches, Omada Access Points, Omada Gateways
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-9290
An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality.
PUBLISHED
- Vendor
- TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc.
- Product
- Omada Gateway (ER706W-4G 2.0), Omada Access Point (EAP603GP-Desktop, EAP615GP-Wall 1.0/1.20, EAP625GP-Wall 1.0/1.20, EAP610GP-Desktop 1.0/1.20/1.26), EAP650-Desktop v1.0), Omada Software Controller, Omada Access Point (EAP772 v1.0, EAP773 v1.0, EAP783 v1.0, EAP787 v1.0, EAP720 v1.0, EAP725-Wall v1.0, EAp723 v2.0), Omada Gateway G36W-4G, Omada Access Point (EAP615-Wall v1.0/v1.20), Omada Hardware Controller OC220, Omada Access Point (EAP653 v1.0, EAP650-Outdoor v1.0), Omada Access Point (EAP655-Wall v1.0), Omada Festa Gateway FR365, Omada Access Point (EAP230-Wall v1.0, EAP235-Wall v1.0), Omada Gateway (ER8411), Omada Access Point (EAP215 Bridge KIT 3.0, EAP211 Bridge KIT 3.0), Omada Access Point (EAP653 UR v1.0), Omada Gateway (ER605 v2.0), Omada Cloud Controller, Omada Gateway (ER701-5G-Outdoor), Omada Access Point (EAP603-Outdoor v1.0, EAP615-Wall v1.0/v1.20), Omada Gateway (ER605W 2.0), Omada Gateway (ER7406, ER706W, ER706-4G), Omada Beam Bridge 5 UR v1.0, Omada EAP100-Bridge KIT v1.0, Omada Access Point (EAP650GP-Desktop 1.0), Omada Access Point (EAP723 v1.0, EAP772 v2.0, EAP772-Outdoor v 1.0, EAP770 v2.0), Omada Hardware Controller (OC200, OC300, OC400), Omada Gateway (ER7412-M2, ER706WP-4G, ER703WP-4G-Outdoor, DR3220v-4G, DR3650v, DR3650v-4G), Omada Gateway ER7212PC 2.0, Omada Access Point (EAP660 HD v1.0/v2.0, EAP620 HD v2.0/v3.0/v3.20, EAP610/EAP610-Outdoor v1.0/v2.0, EAP623-Outdoor HD v1.0, EAP625-Outdoor HD v1.0)EAP, Omada Gateway (ER707-M2, ER-8411), Omada Gateway (ER7206 v2.0)
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-9289
A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advanced conditions, such as network positioning or emulating a trusted entity, and user interaction by an authenticated administrator. If successful, an attacker could execute arbitrary JavaScript in the administrator’s browser, potentially exposing sensitive information and compromising confidentiality.
PUBLISHED
- Vendor
- TP-Link Systems Inc., TP-Link Systems Inc., TP-Link Systems Inc.
- Product
- Omada Software Controller, Omada cloud controller, Omada OC200, OC220, OC300, OC400
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-9288
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
PUBLISHED
- Vendor
- Not asserted
- Product
- Not asserted
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-9287
Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
PUBLISHED
- Vendor
- Not asserted
- Product
- Not asserted
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-9286
The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.
PUBLISHED
- Vendor
- hancock11
- Product
- Appy Pie Connect for WooCommerce
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-9283
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limits Storms tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
PUBLISHED
- Vendor
- Rockwell Automation
- Product
- ArmorStart® LT
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-9282
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
PUBLISHED
- Vendor
- Rockwell Automation
- Product
- ArmorStart® LT
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-9281
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive step limit storm tests, the device reboots
PUBLISHED
- Vendor
- Rockwell Automation
- Product
- ArmorStart® LT
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-9280
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the device to become unresponsive, requiring a reboot.
PUBLISHED
- Vendor
- Rockwell Automation
- Product
- ArmorStart® LT
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-9279
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limit Storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
PUBLISHED
- Vendor
- Rockwell Automation
- Product
- ArmorStart® LT
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-9278
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the device loses ICMP connectivity, causing the web application to become inaccessible.
PUBLISHED
- Vendor
- Rockwell Automation
- Product
- ArmorStart® LT
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-9277
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PUBLISHED
- Vendor
- softaculous
- Product
- SiteSEO – SEO Simplified
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-9276
Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image. The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the
PUBLISHED
- Vendor
- Cockroach Labs
- Product
- cockroach-k8s-request-cert
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-9275
Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IMS files. The issue results from the lack of proper validation of user-supplied
PUBLISHED
- Vendor
- Oxford Instruments
- Product
- Imaris Viewer
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-9274
Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IMS files. The issue results from the lack of proper initialization of a pointe
PUBLISHED
- Vendor
- Oxford Instruments
- Product
- Imaris Viewer
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-9273
CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of CData API Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the usage of MySQL connections. When connecting to a MySQL server, the product enables an option that gives the MySQL server permission to request local files from the MySQL client. An attacker can leverage
PUBLISHED
- Vendor
- CData
- Product
- API Server
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-9269
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerability can lead to internal network access / potential data disclosure from a device.
PUBLISHED
- Vendor
- Lexmark
- Product
- CX, XC, CS, MS, MX, XM, et. al.
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-9267
In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be exploited by placing a malicious DLL in the same directory as the installer executable, leading to arbitrary code execution with the privileges of the user running the installer. The issue stems from the use of insecure DLL loading practices, such as relying on
PUBLISHED
- Vendor
- Seagate
- Product
- Toolkit
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-9265
A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246
PUBLISHED
- Vendor
- Kiloview
- Product
- NDI
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-9264
A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource identifiers. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
PUBLISHED
- Vendor
- Xuxueli
- Product
- xxl-job
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-9263
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- Xuxueli
- Product
- xxl-job
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-9262
A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- wong2
- Product
- mcp-cli
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-9260
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to read arbitrary files. If allow_url_include is enabled on the server, re
PUBLISHED
- Vendor
- techjewel
- Product
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-9259
WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
PUBLISHED
- Vendor
- Uniong
- Product
- WebITR
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2025-9258
WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
PUBLISHED
- Vendor
- Uniong
- Product
- WebITR
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2025-9257
WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
PUBLISHED
- Vendor
- Uniong
- Product
- WebITR
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1