Explore CVE records

HighPublished 22 Aug 2025, 00:34 WIB

CVE-2025-7051

N-central Syslog Configuration Insecure Direct Object Reference

On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

Excerpt language: en.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

MedPublished 22 Aug 2025, 00:20 WIB

CVE-2025-57768

Stored XSS in “hours” fields when creating or editing an issue, using SQLite database

Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Planned Hours field when creating a new project. When sending a POST request to /issues/new/, the value provided in the Planned Hours field is included in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

MedPublished 22 Aug 2025, 00:10 WIB

CVE-2025-43754

Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspect…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 03:01 WIB

Official record

MedPublished 22 Aug 2025, 00:05 WIB

CVE-2025-57765

WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'pre_cadastro_adotante.php' parameter 'msg_e'

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the pre_cadastro_adotante.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:30 WIB

Official record

MedPublished 22 Aug 2025, 00:04 WIB

CVE-2025-57764

WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg_e'

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cargos.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.4.7.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:30 WIB

Official record

MedPublished 22 Aug 2025, 00:02 WIB

CVE-2025-9311

itsourcecode Apartment Management System addfair.php sql injection

A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /fair/addfair.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:30 WIB

Official record

MedPublished 22 Aug 2025, 00:01 WIB

CVE-2025-8402

Nil pointer dereference in bulk import crashes server

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature.

Excerpt language: en.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:30 WIB

Official record

MedPublished 22 Aug 2025, 00:01 WIB

CVE-2025-6465

Path traversal in image upload with preview overwrite

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:30 WIB

Official record

MedPublished 21 Aug 2025, 23:59 WIB

CVE-2025-57763

Cross-Site Scripting (XSS) Reflected in 'insere_despacho.php' parameter 'sccs'

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the insere_despacho.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the cpf sccs. This vulnerability is fixed in 3.4.7.

Excerpt language: en.

CVSS6.4v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:30 WIB

Official record

MedPublished 21 Aug 2025, 23:46 WIB

CVE-2025-57762

WeGIA Stored Cross-Site Scripting (XSS) vulnerability in the endpoint 'dependente_docdependente.php' with parameter 'nome'

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scripting (XSS) vulnerability in the dependente_docdependente.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the nome parameter. The injected scripts are stored o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:30 WIB

Official record

MedPublished 21 Aug 2025, 23:40 WIB

CVE-2025-43755

A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:31 WIB

Official record

CritPublished 21 Aug 2025, 23:40 WIB

CVE-2025-57761

WeGIA SQL Injection vulnerability via 'id_funcionario' param at endpoint `/html/funcionario/dependente_remover.php`

WeGIA is a Web manager for charitable institutions. Prior to 3.4.10, there is a SQL Injection vulnerability in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_funcionario parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:31 WIB

Official record

MedPublished 21 Aug 2025, 23:40 WIB

CVE-2025-7969

Markdown-it 14.1.0 - Cross-site scripting (XSS)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs. This issue affects markdown-it: 14.1.0. NOTE: the Supplier does not consider this issue to be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Dec 2025, 04:06 WIB

Official record

MedPublished 21 Aug 2025, 23:32 WIB

CVE-2025-9310

yeqifu carRental Druid login.html hard-coded credentials

A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unknown functionality of the file /carRental_war/druid/login.html of the component Druid. Executing manipulation can lead to hard-coded credentials. The attack may be launched remotely…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:31 WIB

Official record

LowPublished 21 Aug 2025, 23:32 WIB

CVE-2025-9309

Tenda AC10 MD5 Hash shadow hard-coded credentials

A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing manipulation results in hard-coded credentials. The attack needs to be approached locally. A high degree of complexity is needed for the attack. The exploitabilit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:31 WIB

Official record

HighPublished 21 Aug 2025, 23:21 WIB

CVE-2025-57755

claude-code-router CORS. misconfiguration

claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfigu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.1v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:31 WIB

Official record

MedPublished 21 Aug 2025, 23:19 WIB

CVE-2025-43756

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScrip…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:31 WIB

Official record

CritPublished 21 Aug 2025, 23:14 WIB

CVE-2025-57754

eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)

eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltratio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:31 WIB

Official record

MedPublished 21 Aug 2025, 23:03 WIB

CVE-2025-57753

vite-plugin-static-copy files not included in `src` are accessible with a crafted request

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2.

Excerpt language: en.

CVSS6v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:32 WIB

Official record

MedPublished 21 Aug 2025, 23:02 WIB

CVE-2025-9308

yarnpkg Yarn request-manager.js setOptions redos

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:32 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage