Total
2980 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-55371 | 1 Jishenghua | 1 Jsherp | 2025-09-09 | N/A | 5.3 MEDIUM |
| Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing the getAllList method. | |||||
| CVE-2025-55368 | 1 Jishenghua | 1 Jsherp | 2025-09-09 | N/A | 8.8 HIGH |
| Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account. | |||||
| CVE-2025-55366 | 1 Jishenghua | 1 Jsherp | 2025-09-09 | N/A | 5.3 MEDIUM |
| Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack. | |||||
| CVE-2025-55367 | 1 Jishenghua | 1 Jsherp | 2025-09-09 | N/A | 5.3 MEDIUM |
| Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account. | |||||
| CVE-2025-50434 | 2025-09-09 | N/A | 5.3 MEDIUM | ||
| A security issue has been identified in Appian Enterprise Business Process Management version 25.3. The vulnerability is related to incorrect access control, which under certain conditions could allow unauthorized access to information. NOTE: this has been disputed because the CVE Record information does not originate from the Supplier, and the report lacks specificity about why a problem exists, how the behavior could be reproduced, and whether any action could be taken to resolve the problem. | |||||
| CVE-2025-54116 | 2025-09-09 | N/A | 7.3 HIGH | ||
| Improper access control in Windows MultiPoint Services allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-54098 | 2025-09-09 | N/A | 7.8 HIGH | ||
| Improper access control in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-49692 | 2025-09-09 | N/A | 7.8 HIGH | ||
| Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-10081 | 1 Mayuri K | 1 Pet Grooming Management Software | 2025-09-09 | 5.8 MEDIUM | 4.7 MEDIUM |
| A flaw has been found in SourceCodester Pet Management System 1.0. This impacts an unknown function of the file /admin/profile.php. This manipulation of the argument website_image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. | |||||
| CVE-2025-58752 | 2025-09-09 | N/A | N/A | ||
| Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue. | |||||
| CVE-2025-58751 | 2025-09-09 | N/A | N/A | ||
| Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue. | |||||
| CVE-2025-10116 | 2025-09-09 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was identified in SiempreCMS up to 1.3.6. This vulnerability affects unknown code of the file /docs/admin/file_upload.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. | |||||
| CVE-2025-10072 | 1 Portabilis | 1 I-educar | 2025-09-09 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performing manipulation results in improper access controls. It is possible to initiate the attack remotely. The exploit has been made public and could be used. | |||||
| CVE-2025-10071 | 1 Portabilis | 1 I-educar | 2025-09-09 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2025-10070 | 1 Portabilis | 1 I-educar | 2025-09-09 | 6.5 MEDIUM | 6.3 MEDIUM |
| A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used. | |||||
| CVE-2024-46916 | 1 Dieboldnixdorf | 1 Vynamic Security Suite | 2025-09-09 | N/A | 8.1 HIGH |
| Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical system files before the filesystem is properly mounted (e.g., leveraging a delete call in /etc/rc.d/init.d/mountfs to remove the /etc/fstab file). This can allow code execution and, in some versions, enable recovery of TPM Disk Encryption keys and decryption of the Windows system partition. | |||||
| CVE-2025-47792 | 1 Nextcloud | 1 Desktop | 2025-09-08 | N/A | 5.0 MEDIUM |
| Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available. | |||||
| CVE-2025-10083 | 1 Mayuri K | 1 Pet Grooming Management Software | 2025-09-08 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/profile.php. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2025-10085 | 1 Mayuri K | 1 Pet Grooming Management Software | 2025-09-08 | 6.5 MEDIUM | 6.3 MEDIUM |
| A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file manage_website.php. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. | |||||
| CVE-2025-58459 | 1 Jenkins | 1 Global Build Stats | 2025-09-08 | N/A | 4.3 MEDIUM |
| Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs. | |||||