CVE-2025-45819 - Slims Senayan Library Management Systems SQL Injection
CVE ID : CVE-2025-45819
Published : May 8, 2025, 3:15 p.m. | 3 hours, 35 minutes ago
Description : Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/author.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45819
Published : May 8, 2025, 3:15 p.m. | 3 hours, 35 minutes ago
Description : Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/author.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-45820 - Slims Senayan Library Management Systems SQL Injection Vulnerability
CVE ID : CVE-2025-45820
Published : May 8, 2025, 3:15 p.m. | 3 hours, 35 minutes ago
Description : Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/bibliography/pop_author_edit.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45820
Published : May 8, 2025, 3:15 p.m. | 3 hours, 35 minutes ago
Description : Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/bibliography/pop_author_edit.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-4207 - PostgreSQL Buffer Over-Read Denial of Service
CVE ID : CVE-2025-4207
Published : May 8, 2025, 3:15 p.m. | 3 hours, 35 minutes ago
Description : Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-4207
Published : May 8, 2025, 3:15 p.m. | 3 hours, 35 minutes ago
Description : Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-51295 - PHPJabbers Event Booking Calendar HTML Injection Vulnerability
CVE ID : CVE-2023-51295
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key, title" parameters.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2023-51295
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code, title, plugin_sms_api_key, title" parameters.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2023-51328 - PHPJabbers Cleaning Business Software Stored XSS
CVE ID : CVE-2023-51328
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : PHPJabbers Cleaning Business Software v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "c_name, name" parameters.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2023-51328
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : PHPJabbers Cleaning Business Software v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "c_name, name" parameters.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-26842 - Znuny S/MIME Encryption Information Disclosure Vulnerability
CVE ID : CVE-2025-26842
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with access to the CommunicationLog.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-26842
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with access to the CommunicationLog.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-26844 - Znuny Cookie Without HttpOnly Flag Vulnerability
CVE ID : CVE-2025-26844
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-26844
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-43926 - Znuny Unauthenticated User Preference Injection Vulnerability
CVE ID : CVE-2025-43926
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-43926
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user preferences with arbitrary keys. When fetching user data via GetUserData, these keys and values are retrieved and given as a whole to other function calls, which then might use these keys/values to affect permissions or other settings.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-45841 - TOTOLINK NR1800X Remote Stack Overflow Vulnerability
CVE ID : CVE-2025-45841
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45841
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-45842 - TOTOLINK NR1800X Buffer Overflow Vulnerability
CVE ID : CVE-2025-45842
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45842
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-45843 - TOTOLINK NR1800X Router Authenticated Stack Overflow Vulnerability
CVE ID : CVE-2025-45843
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45843
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-45844 - TOTOLINK NR1800X Router Stack Overflow Vulnerability
CVE ID : CVE-2025-45844
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiBasicCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45844
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiBasicCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-45845 - TOTOLINK NR1800X Stack Overflow Vulnerability
CVE ID : CVE-2025-45845
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45845
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-45846 - ALFA AIP-W512 Stack Overflow Vulnerability
CVE ID : CVE-2025-45846
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the torrentsindex parameter in the formBTClinetSetting function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45846
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the torrentsindex parameter in the formBTClinetSetting function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-45847 - ALFA AIP-W512 Remote Stack-Based Buffer Overflow
CVE ID : CVE-2025-45847
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the targetAPMac parameter in the formWsc function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-45847
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the targetAPMac parameter in the formWsc function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-4132 - Rapid7 Corporate Website Open Redirect Vulnerability
CVE ID : CVE-2025-4132
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : Rapid7 Corporate Website prior to May 2nd 2025, suffered from a URL Redirection to Untrusted Site ('Open Redirect') vulnerability whereby, due to misconfigured headers, an attacker could successfully redirect users to a malicious site of their control. This vulnerability has been fixed as of May 2nd 2025.
Severity: 3.1 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-4132
Published : May 8, 2025, 4:15 p.m. | 2 hours, 35 minutes ago
Description : Rapid7 Corporate Website prior to May 2nd 2025, suffered from a URL Redirection to Untrusted Site ('Open Redirect') vulnerability whereby, due to misconfigured headers, an attacker could successfully redirect users to a malicious site of their control. This vulnerability has been fixed as of May 2nd 2025.
Severity: 3.1 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-26845 - Znuny Eval Injection Vulnerability
CVE ID : CVE-2025-26845
Published : May 8, 2025, 5:16 p.m. | 1 hour, 35 minutes ago
Description : An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a command executed by the user running the backup.pl script.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-26845
Published : May 8, 2025, 5:16 p.m. | 1 hour, 35 minutes ago
Description : An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a command executed by the user running the backup.pl script.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-26847 - Znuny Support Bundle Password Exposure Vulnerability
CVE ID : CVE-2025-26847
Published : May 8, 2025, 5:16 p.m. | 1 hour, 35 minutes ago
Description : An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-26847
Published : May 8, 2025, 5:16 p.m. | 1 hour, 35 minutes ago
Description : An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-44021 - OpenStack Ironic Unintended File Writing Vulnerability
CVE ID : CVE-2025-44021
Published : May 8, 2025, 5:16 p.m. | 1 hour, 35 minutes ago
Description : OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can provide a path to any local file (readable by ironic-conductor), which may then be written to the target node disk. This is difficult to exploit in practice, because a node deployed in this manner should never reach the ACTIVE state, but it still represents a danger in environments running with non-default, insecure configurations such as with automated cleaning disabled. The fixed versions are 24.1.3, 26.1.1, and 29.0.1.
Severity: 2.8 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-44021
Published : May 8, 2025, 5:16 p.m. | 1 hour, 35 minutes ago
Description : OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can provide a path to any local file (readable by ironic-conductor), which may then be written to the target node disk. This is difficult to exploit in practice, because a node deployed in this manner should never reach the ACTIVE state, but it still represents a danger in environments running with non-default, insecure configurations such as with automated cleaning disabled. The fixed versions are 24.1.3, 26.1.1, and 29.0.1.
Severity: 2.8 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2024-13009 - Eclipse Jetty Gzip Buffer Release Vulnerability
CVE ID : CVE-2024-13009
Published : May 8, 2025, 6:15 p.m. | 35 minutes ago
Description : In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2024-13009
Published : May 8, 2025, 6:15 p.m. | 35 minutes ago
Description : In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-1948 - Jetty HTTP/2 Buffer Overflow
CVE ID : CVE-2025-1948
Published : May 8, 2025, 6:15 p.m. | 35 minutes ago
Description : In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-1948
Published : May 8, 2025, 6:15 p.m. | 35 minutes ago
Description : In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...