Total
398387 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-30073 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions with the same reference are completed, depending on timing. This can be used to transfer more money onto employee cards than is paid. | |||||
| CVE-2025-30072 | 1 Tiiwee | 2 Twx1hakv2, Twx1hakv2 Firmware | 2026-06-17 | N/A | 7.6 HIGH |
| Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities without triggering an alarm. | |||||
| CVE-2025-30067 | 1 Apache | 1 Kylin | 2026-06-17 | N/A | 7.2 HIGH |
| Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.1. Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue. | |||||
| CVE-2025-30065 | 1 Apache | 1 Parquet Java | 2026-06-17 | N/A | 9.8 CRITICAL |
| Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue. | |||||
| CVE-2025-30064 | 2026-06-17 | N/A | N/A | ||
| An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which signing algorithm was used. As a result, an attacker can use the "ex:action" parameter in the VerifyUserByThrustedService function to generate a session for any user. | |||||
| CVE-2025-30063 | 2026-06-17 | N/A | N/A | ||
| The configuration file containing database logins and passwords is readable by any local user. | |||||
| CVE-2025-30062 | 2026-06-17 | N/A | N/A | ||
| In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection. | |||||
| CVE-2025-30061 | 2026-06-17 | N/A | N/A | ||
| In the "utils/Reporter/OpenReportWindow.pl" service, there is an SQL injection vulnerability through the "UserID" parameter. | |||||
| CVE-2025-30060 | 2026-06-17 | N/A | N/A | ||
| In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter. | |||||
| CVE-2025-30059 | 2026-06-17 | N/A | N/A | ||
| In the PrepareCDExportJSON.pl service, the "getPerfServiceIds" function is vulnerable to SQL injection. | |||||
| CVE-2025-30058 | 2026-06-17 | N/A | N/A | ||
| In the PatientService.pl service, the "getPatientIdentifier" function is vulnerable to SQL injection through the "pesel" parameter. | |||||
| CVE-2025-30057 | 2026-06-17 | N/A | N/A | ||
| In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function. | |||||
| CVE-2025-30056 | 2026-06-17 | N/A | N/A | ||
| The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system. | |||||
| CVE-2025-30055 | 2026-06-17 | N/A | N/A | ||
| The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter. | |||||
| CVE-2025-30048 | 2026-06-17 | N/A | N/A | ||
| The "serverConfig" endpoint, which returns the module configuration including credentials, is accessible without authentication. | |||||
| CVE-2025-30044 | 2026-06-17 | N/A | N/A | ||
| In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat_simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection. | |||||
| CVE-2025-30042 | 1 Cgm | 1 Clininet | 2026-06-17 | N/A | 7.8 HIGH |
| The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key. | |||||
| CVE-2025-30041 | 2026-06-17 | N/A | N/A | ||
| The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs. | |||||
| CVE-2025-30040 | 2026-06-17 | N/A | N/A | ||
| The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint. | |||||
| CVE-2025-30039 | 2026-06-17 | N/A | N/A | ||
| Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges. | |||||