CVE-2025-67404
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2025-67403
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-6740
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PUBLISHED
- Vendor
- arshidkv12
- Product
- Database Addon for Contact Form 7 – CFDB7
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67399
An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller (Wi-Fi and BLE module) on the device is open to access
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67397
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-6739
The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the databa
PUBLISHED
- Vendor
- bauc
- Product
- WPQuiz
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-6738
A vulnerability, which was classified as critical, has been found in huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. Affected by this issue is the function userDao.selectUserByUserNameLike of the file UserServiceImpl.java. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no
PUBLISHED
- Vendor
- huija
- Product
- bicycleSharingServer
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-6737
Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authentication material and access the gateway server with low-privilege permissions.
PUBLISHED
- Vendor
- Securden
- Product
- Unified PAM
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-67366
@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path traversal vulnerability in its "read_content" tool. This vulnerability arises from improper symlink handling in the path validation mechanism: the resolvePath function checks path validity before resolving symlinks, while fs.readFile resolves symlinks automatically during file access. This allows attackers to bypass directory restrictions by
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67364
fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical paths. The safePath and isPathAllowed functions use path.resolve() which does not handle symlinks, allowing attackers to bypass directory access restrictions by creating symlinks within allowed directories that point to restricted system paths.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-6736
A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/install of the component Add New Themes Page. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- juzaweb
- Product
- CMS
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-6735
A vulnerability classified as critical has been found in juzaweb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Import Page. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- juzaweb
- Product
- CMS
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-67349
A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67344
jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67342
RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67341
jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-6734
A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been rated as critical. This issue affects the function sub_484E40 of the file /goform/formP2PLimitConfig of the component API. The manipulation of the argument except leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- UTT
- Product
- HiPER 840G
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-6733
A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been declared as critical. This vulnerability affects the function sub_416928 of the file /goform/formConfigDnsFilterGlobal of the component API. The manipulation of the argument GroupName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- UTT
- Product
- HiPER 840G
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-67325
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-6732
A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the component API. The manipulation of the argument passwd1 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- UTT
- Product
- HiPER 840G
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-6731
A vulnerability was found in yzcheng90 X-SpringBoot up to 5.0 and classified as critical. Affected by this issue is the function uploadApk of the file /sys/oss/upload/apk of the component APK File Handler. The manipulation of the argument File leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- yzcheng90
- Product
- X-SpringBoot
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67305
In RUCKUS Network Director (RND) < 4.5.0.56, the OVA appliance contains hardcoded SSH keys for the postgres user. These keys are identical across all deployments, allowing an attacker with network access to authenticate via SSH without a password. Once authenticated, the attacker can access the PostgreSQL database with superuser privileges, create administrative users for the web interface, and potentially escalate privileges further.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-67304
In Ruckus Network Director (RND) < 4.5.0.54, the OVA appliance contains hardcoded credentials for the ruckus PostgreSQL database user. In the default configuration, the PostgreSQL service is accessible over the network on TCP port 5432. An attacker can use the hardcoded credentials to authenticate remotely, gaining superuser access to the database. This allows creation of administrative users for the web interface, extraction of password hashes, and execution of arbitrary OS commands.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-67303
An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-6730
The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success.
PUBLISHED
- Vendor
- amans2k
- Product
- Bonanza – WooCommerce Free Gifts Lite
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67298
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67291
A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67290
A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-6729
The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PUBLISHED
- Vendor
- qazomardok
- Product
- PayMaster for WooCommerce
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67289
An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code via uploading a crafted XML file.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-67288
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file validation (as shown in the documentation) belongs to the system administrator who is implementing Umbraco CMS in their environment, not to Umbraco CMS itself. The Supplier also states that PDF JavaScript runs in a completely isolated sandbox, not the browser's DOM context, which means
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-67285
A SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0. The reason for this issue is that attackers inject malicious code from the parameter 'id' and use it directly in SQL queries without the need for appropriate cleaning or validation.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67282
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download password hashes of other user, access work items of other user, modify restricted content in workflows, modify the applications logo and manipulate the profile of other user.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67281
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the database and its content.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67280
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67279
An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via the application stores password hashes in MD5 format
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67278
An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before v.9.1.2 allows a remote attacker to escalate privileges via a crafted HTTP request
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67274
An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data retrieval module endpoints
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67269
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive
PUBLISHED
- Vendor
- n/a, Red Hat, Red Hat
- Product
- n/a, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-67268
A flaw was found in gpsd. The hnd_129540 function, responsible for handling NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to properly validate the user-supplied satellite count. A remote attacker can exploit this by sending a specially crafted packet with an excessive satellite count, leading to a heap-based out-of-bounds write. This memory corruption can result in a Denial of Service (DoS) and potentially allow for arbitrary code execution.
PUBLISHED
- Vendor
- Red Hat, n/a, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 10.0 Extended Update Support, n/a, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10
- Provider severity
- CRITICAL, HIGH
- Conflicts
- 3
CVE-2025-67264
An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pro+ allows a local attacker to execute arbitrary code and escalate privileges via the EngineerMode ADB shell, due to incomplete patching of CVE-2025-31710
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67263
Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name and Surname fields. An attacker can insert malicious HTML or script content into these fields, which, persisted in the database.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67261
Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67260
The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-6726
The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classic_gallery_slider_options() function in all versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited post meta for arbitrary posts.
PUBLISHED
- Vendor
- krasenslavov
- Product
- Block Editor Gallery Slider for WordPress – Image Slider, Gallery Carousel & Lightbox Plugin
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-67259
A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students details, tutor/admin profiles, and internal course metadata.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67255
In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-67254
NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-6725
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
PUBLISHED
- Vendor
- Progress Software, Progress Software, Progress Software, Progress Software, Progress Software, Progress Software
- Product
- Telerik UI for ASP.NET MVC, Kendo UI for Angular, Kendo UI for jQuery, Telerik UI for ASP.NET Core, KendoReact, Telerik UI for Blazor
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-67246
A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control in the IOCTL handler. This driver exposes a device interface accessible to a normal user and handles attacker-controlled structures containing the lower 4GB of physical addresses. The handler maps arbitrary physical memory via MmMapIoSpace and copies data back to user mode without verifying the caller's privileges or the target address range. This allows unprivileged users to r
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1