Total
401279 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-64049 | 1 Redaxo | 1 Redaxo | 2026-06-17 | N/A | 4.8 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module. | |||||
| CVE-2025-64030 | 1 Chinasystems | 1 Eximbills Enterprise | 2026-06-17 | N/A | 5.4 MEDIUM |
| Eximbills Enterprise 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) via the /EximBillWeb/servlets/WSTrxManager endpoint. Unsanitized user input in the TMPL_INFO parameter is stored server-side and rendered to other users, enabling arbitrary JavaScript execution in their browsers. | |||||
| CVE-2025-64027 | 1 Snipeitapp | 1 Snipe-it | 2026-06-17 | N/A | 6.1 MEDIUM |
| Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. NOTE: this is disputed by the Supplier because the report only demonstrates that an authenticated user can choose to conduct a man-in-the-middle attack against himself. | |||||
| CVE-2025-64012 | 1 Invoiceplane | 1 Invoiceplane | 2026-06-17 | N/A | 4.3 MEDIUM |
| InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data. | |||||
| CVE-2025-64011 | 1 Nextcloud | 1 Nextcloud Server | 2026-06-17 | N/A | 4.3 MEDIUM |
| Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions. | |||||
| CVE-2025-63958 | 1 Millensys | 1 Vision Tools Workspace | 2026-06-17 | N/A | 9.8 CRITICAL |
| MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An unauthenticated attacker can retrieve this information by accessing the endpoint directly, potentially leading to full system compromise. The vulnerability is due to missing access controls on a privileged administrative function. | |||||
| CVE-2025-63955 | 1 Phpgurukul | 1 Student Record System | 2026-06-17 | N/A | 7.5 HIGH |
| A Cross-Site Request Forgery (CSRF) vulnerability in the manage-students.php component of PHPGurukul Student Record System v3.2 allows an attacker to trick an authenticated administrator into submitting a forged request. This leads to the unauthorized deletion of user accounts, causing a Denial of Service (DoS). | |||||
| CVE-2025-63953 | 1 Magewell | 10 Ultra Encode Aio, Ultra Encode Aio Firmware, Ultra Encode Hdmi and 7 more | 2026-06-17 | N/A | 6.5 MEDIUM |
| A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request. | |||||
| CVE-2025-63952 | 1 Magewell | 26 Pro Convert 12g Sdi 4k Plus, Pro Convert 12g Sdi 4k Plus Firmware, Pro Convert Aes67 and 23 more | 2026-06-17 | N/A | 5.7 MEDIUM |
| A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows attackers to arbitrarily create accounts via a crafted GET request. | |||||
| CVE-2025-63951 | 1 Sourcefabric | 1 Phoniebox | 2026-06-17 | N/A | 7.5 HIGH |
| An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c48c38aa9a7014 (2025-10-07). The 'rss' GET parameter receives data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, causing the application to process them and leading to errors or a denial of service. | |||||
| CVE-2025-63950 | 1 Tomaszdunia | 1 Twittodon | 2026-06-17 | N/A | 7.5 HIGH |
| An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621342c0b (2023-02-28). The 'obj' parameter receives base64-encoded data that is passed directly to the unserialize() function without validation. This allows a remote, unauthenticated attacker to inject arbitrary PHP objects, leading to a denial of service. | |||||
| CVE-2025-63949 | 1 Yohanawi | 1 Hotel Management System | 2026-06-17 | N/A | 6.1 MEDIUM |
| A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web script via the 'error' parameter in pages/room.php. | |||||
| CVE-2025-63948 | 1 Craigtaub | 1 Phpmsadmin | 2026-06-17 | N/A | 5.4 MEDIUM |
| A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commands via the dbname parameter, potentially leading to information disclosure or database manipulation. | |||||
| CVE-2025-63947 | 1 Craigtaub | 1 Phpmsadmin | 2026-06-17 | N/A | 5.4 MEDIUM |
| A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary web script or HTML via the dbname parameter after a user is authenticated. | |||||
| CVE-2025-63946 | 1 Tencent | 1 Pcmanager | 2026-06-17 | N/A | 7.4 HIGH |
| A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition. | |||||
| CVE-2025-63945 | 1 Tencent | 1 Ioa | 2026-06-17 | N/A | 7.4 HIGH |
| A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition. | |||||
| CVE-2025-63939 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter. | |||||
| CVE-2025-63938 | 1 Tinyproxy Project | 1 Tinyproxy | 2026-06-17 | N/A | 6.5 MEDIUM |
| Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. | |||||
| CVE-2025-63932 | 1 Dlink | 2 Dir-868l, Dir-868l Firmware | 2026-06-17 | N/A | 7.3 HIGH |
| D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin does not filter the HTTP SOAPAction header field. The unauthenticated remote attacker can execute the shell command. | |||||
| CVE-2025-63929 | 1 Airpig2011 | 1 Iec104 | 2026-06-17 | N/A | 7.5 HIGH |
| A null pointer dereference vulnerability exists in airpig2011 IEC104 thru Commit be6d841 (2019-07-08). When multiple threads enqueue elements concurrently via IEC10X_PrioEnQueue, the function may dereference a null or freed queue pointer, resulting in a segmentation fault and potential denial-of-service. | |||||