Total
401054 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-60803 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../register. | |||||
| CVE-2025-60801 | 1 Jishenghua | 1 Jsherp | 2026-06-17 | N/A | 8.2 HIGH |
| jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. | |||||
| CVE-2025-60800 | 1 Jishenghua | 1 Jsherp | 2026-06-17 | N/A | 7.5 HIGH |
| Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request. | |||||
| CVE-2025-60799 | 1 Phppgadmin Project | 1 Phppgadmin | 2026-06-17 | N/A | 6.1 MEDIUM |
| phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data. | |||||
| CVE-2025-60798 | 1 Phppgadmin Project | 1 Phppgadmin | 2026-06-17 | N/A | 6.5 MEDIUM |
| phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise. | |||||
| CVE-2025-60797 | 1 Phppgadmin Project | 1 Phppgadmin | 2026-06-17 | N/A | 6.5 MEDIUM |
| phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation. | |||||
| CVE-2025-60796 | 1 Phppgadmin Project | 1 Phppgadmin | 2026-06-17 | N/A | 6.1 MEDIUM |
| phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions. | |||||
| CVE-2025-60794 | 1 Perfood | 1 Couchauth | 2026-06-17 | N/A | 6.5 MEDIUM |
| Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking. | |||||
| CVE-2025-60791 | 2026-06-17 | N/A | 6.2 MEDIUM | ||
| Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing. | |||||
| CVE-2025-60790 | 1 Processwire | 1 Processwire | 2026-06-17 | N/A | 6.5 MEDIUM |
| ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service. | |||||
| CVE-2025-60786 | 1 Kagilum | 1 Icescrum | 2026-06-17 | N/A | 8.8 HIGH |
| A Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via uploading a crafted Zip file. | |||||
| CVE-2025-60785 | 1 Kagilum | 1 Icescrum | 2026-06-17 | N/A | 8.8 HIGH |
| A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a crafted HTML page. | |||||
| CVE-2025-60784 | 1 Xiaozhangbang | 1 Voluntary Like System | 2026-06-17 | N/A | 6.5 MEDIUM |
| A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase votes at a reduced cost. Furthermore, by modifying the zid parameter, attackers can influence purchases made by other users, amplifying the impact. This issue stems from insufficient server-side validation of these parameters, potentially leading to economic loss and unfair manipulation of vote counts. | |||||
| CVE-2025-60783 | 1 Rajvi-patel-22 | 1 Restaurant-management-system-dbms-project | 2026-06-17 | N/A | 6.5 MEDIUM |
| There is a SQL injection vulnerability in Restaurant Management System DBMS Project v1.0 via login.php. The vulnerability allows attackers to manipulate the application's database through specially crafted SQL query strings. | |||||
| CVE-2025-60782 | 1 Iqbolshoh | 1 Php Education Management | 2026-06-17 | N/A | 5.4 MEDIUM |
| PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics management module (topics.php). Attackers can inject malicious JavaScript payloads into the Titlefield during topic creation or updates. | |||||
| CVE-2025-60781 | 1 Iqbolshoh | 1 Php Education Management | 2026-06-17 | N/A | 6.1 MEDIUM |
| PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_name parameter. | |||||
| CVE-2025-60772 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges and lock out the legitimate administrator via crafted HTTP requests. | |||||
| CVE-2025-60753 | 1 Libarchive | 1 Libarchive | 2026-06-17 | N/A | 5.5 MEDIUM |
| An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash). | |||||
| CVE-2025-60751 | 2026-06-17 | N/A | 7.5 HIGH | ||
| GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode. | |||||
| CVE-2025-60739 | 1 Ilevia | 2 Eve X1 Server, Eve X1 Server Firmware | 2026-06-17 | N/A | 9.6 CRITICAL |
| Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component | |||||