CVE-2025-65220
Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2025-6522
Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string.
PUBLISHED
- Vendor
- TrendMakers
- Product
- Sight Bulb Pro Firmware ZJ_CG32-2201
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65215
Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Supplier Name field.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65213
MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without validation, allowing arbitrary code execution. An attacker can craft a malicious pickle file that executes arbitrary Python code when loaded, enabling remote code execution with the privileges of the victim process.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-65212
An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the device management backend. By reading the corresponding username and self-decrypted MD5 password in the core configuration file, the attacker can directly log in to the backend, thereby bypassing the fr
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-6521
During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are passed in cleartext. If captured, an attacker may be able to decrypt communications between the management app and the Sight Bulb Pro which may include sensitive information such as network credentials.
PUBLISHED
- Vendor
- TrendMakers
- Product
- Sight Bulb Pro Firmware ZJ_CG32-2201
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2025-65203
KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlled script in the sandboxed document to access populated form fields and exfiltrate credentials.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-65202
TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command", "todo", and "next_file," which allows an attacker to execute arbitrary commands with root privileges.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-6520
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection. This issue affects BAPSIS: before 202510271606.
PUBLISHED
- Vendor
- Abis Technology
- Product
- BAPSIS
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-65199
A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitrary commands as root via the 'adapterName' parameter of the 'changeMTU' function. Fixed in Windscribe v2.18.3-alpha and v2.18.8.
PUBLISHED
- Vendor
- Windscribe
- Product
- Windscribe for Linux Desktop App
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-6519
E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.
PUBLISHED
- Vendor
- Copeland LP
- Product
- E3 Supervisory Control
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-65187
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65186
Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65185
There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2025-6518
A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of the argument user_message leads to improper neutralization of special elements used in a template engine. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- PySpur-Dev
- Product
- pyspur
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-65176
An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and receiving a "STATUS_LOGON_FAILURE" error, the agent will retrieve every user token on the machine and repeatedly attempt to access the network share while impersonating them. The exploitation of this vulnerability can allow an unprivileged attacker with access to the affected system to perform NTLM relay attacks.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-6517
A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component Meta URL Handler. The manipulation of the argument post leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclo
PUBLISHED
- Vendor
- Dromara
- Product
- MaxKey
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-6516
A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function H5F_addr_decode_len of the file /hdf5/src/H5Fint.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- n/a
- Product
- HDF5
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-6515
The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses from the oatpp-mcp server.
PUBLISHED
- Vendor
- oatpp
- Product
- oatpp-mcp
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-6514
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
PUBLISHED
- Vendor
- Not asserted
- Product
- Not asserted
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-65136
In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65135
In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-65134
In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POST parameter.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65133
A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remote attacker can supply a crafted HTTP request to the affected endpoint to manipulate SQL query logic and extract sensitive database information.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-65132
alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to inject and execute arbitrary JavaScript via the room_id GET parameter.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-6513
Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.
PUBLISHED
- Vendor
- Bizerba SE & Co. KG
- Product
- BRAIN2
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-65128
A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "*_nocommit" and supplying the parameters expected by the invoked function, an attacker can change configuration data, including SSID, Wi-Fi credentials, and administrative passwords, without authentication or an existing session.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-65127
A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access administrative information-retrieval functions intended for authenticated users. By invoking "get_*" operations, attackers can obtain device configuration data, including plaintext credentials, without authentication or an existing session.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65125
SQL injection in gosaliajainam/online-movie-booking 5.5 in movie_details.php allows attackers to gain sensitive information.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-65122
Regex Denial of Service in youtube-regex npm package through version 1.0.5.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-65120
Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1. If a user accesses a crafted page or URL, an arbitrary script may be executed on the web browser of the user.
PUBLISHED
- Vendor
- Japan Total System Co.,Ltd., Japan Total System Co.,Ltd., Japan Total System Co.,Ltd.
- Product
- GroupSession byCloud, GroupSession ZION, GroupSession Free edition
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2025-6512
On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.
PUBLISHED
- Vendor
- Bizerba SE & Co. KG
- Product
- BRAIN2
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-65119
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
PUBLISHED
- Vendor
- Canva
- Product
- Affinity
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-65118
The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server.
PUBLISHED
- Vendor
- AVEVA
- Product
- Process Optimization
- Provider severity
- CRITICAL, HIGH
- Conflicts
- 1
CVE-2025-65117
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements.
PUBLISHED
- Vendor
- AVEVA
- Product
- Process Optimization
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-65116
Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Dis
PUBLISHED
- Vendor
- Hitachi, Hitachi, Hitachi, Hitachi, Hitachi, Hitachi, Hitachi, Hitachi, Hitachi
- Product
- JP1/NETM/DM Manager, Job Management Partner 1/Software Distribution Manager, Job Management Partner 1/IT Desktop Management 2 - Manager, JP1/NETM/DM Client, Job Management Partner 1/Software Distribution Client, JP1/IT Desktop Management 2 - Manager, Job Management Partner 1/IT Desktop Management - Manager, JP1/IT Desktop Management 2 - Operations Director, JP1/IT Desktop Management - Manager
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65115
Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Softwa
PUBLISHED
- Vendor
- Hitachi, Hitachi, Hitachi, Hitachi, Hitachi, Hitachi, Hitachi, Hitachi, Hitachi
- Product
- JP1/NETM/DM Manager, Job Management Partner 1/Software Distribution Client, Job Management Partner 1/IT Desktop Management - Manager, Job Management Partner 1/Software Distribution Manager, JP1/IT Desktop Management 2 - Manager, Job Management Partner 1/IT Desktop Management 2 - Manager, JP1/IT Desktop Management 2 - Operations Director, JP1/NETM/DM Client, JP1/IT Desktop Management - Manager
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2025-65114
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1. Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.
PUBLISHED
- Vendor
- Apache Software Foundation
- Product
- Apache Traffic Server
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-65113
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX flagging system allows any unauthenticated user to flag any content (users, videos, photos, collections) on the platform. This can lead to mass flagging attacks, content disruption, and moderation system abuse. This issue has been patched in version 5.5.2 - #164.
PUBLISHED
- Vendor
- MacWarrior
- Product
- clipbucket-v5
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2025-65112
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3.
PUBLISHED
- Vendor
- ricardoboss
- Product
- PubNet
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2025-65111
SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correct
PUBLISHED
- Vendor
- authzed
- Product
- spicedb
- Provider severity
- LOW
- Conflicts
- 0
CVE-2025-65110
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting two conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. First, they use `vega` in an application that attaches both `vega` library and a `vega.View` instance similar to the Vega Editor to the global `window`, or has any other satisfactory function gadgets in
PUBLISHED
- Vendor
- vega
- Product
- vega
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-6511
A vulnerability classified as critical has been found in Netgear EX6150 1.0.0.46_1.0.76. This affects the function sub_410090. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
PUBLISHED
- Vendor
- Netgear
- Product
- EX6150
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2025-65109
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.
PUBLISHED
- Vendor
- mindersec
- Product
- minder
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-65108
md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.
PUBLISHED
- Vendor
- simonhaenisch
- Product
- md-to-pdf
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2025-65107
Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, a potential account takeover may happen if an authenticated user is made to call a specifically crafted URL via a CSRF or phishing attack. This issue has been patched in versions 2.95.12 and 3.131.0. A workaround for this issue involves setting AUTH_<PROVIDER>_CHECK.
PUBLISHED
- Vendor
- langfuse
- Product
- langfuse
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65106
LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object internals through template syntax. This vulnerability affects applications that accept untrusted template strings (not just template variables) in ChatPromptTemplate and related prompt template classes. This issue has been patched in versions 0.3.8
PUBLISHED
- Vendor
- langchain-ai
- Product
- langchain
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-65105
Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on syste
PUBLISHED
- Vendor
- apptainer
- Product
- apptainer
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2025-65104
Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.
PUBLISHED
- Vendor
- FirebirdSQL
- Product
- firebird
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2025-65103
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5.
PUBLISHED
- Vendor
- devcode-it
- Product
- openstamanager
- Provider severity
- HIGH
- Conflicts
- 0