Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2025-5615 2025-06-04 MEDIUM 6.3 A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file…
CVE-2025-5614 2025-06-04 MEDIUM 6.3 A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been classified as critical. Affected is an unknown function of the file /search-report-result.php. The manipulation…
CVE-2025-5613 2025-06-04 MEDIUM 6.3 A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This issue affects some unknown processing of the file /request-details.php. The manipulation of…
CVE-2025-5612 2025-06-04 MEDIUM 6.3 A vulnerability has been found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This vulnerability affects unknown code of the file /reporting.php. The manipulation of…
CVE-2025-5611 2025-06-04 MEDIUM 6.3 A vulnerability, which was classified as critical, was found in CodeAstro Real Estate Management System 1.0. This affects an unknown part of the file /submitpropertyupdate.php. The manipulation of…
CVE-2025-5610 2025-06-04 MEDIUM 6.3 A vulnerability, which was classified as critical, has been found in CodeAstro Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file…
CVE-2025-48947 2025-06-04 N/A 0.0 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may…
CVE-2025-48951 2025-06-03 N/A 0.0 Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited,…
CVE-2025-46548 2025-06-03 MEDIUM 6.5 If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication instead of making sure…
CVE-2025-48881 2025-05-30 HIGH 8.3 Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can…
CVE-2025-4353 2025-05-06 MEDIUM 6.3 A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424. Affected is an unknown function of the file /paraframework/queryTsDictionaryType.htm. The…
CVE-2025-4352 2025-05-06 MEDIUM 6.3 A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424. This issue affects some unknown processing of the file…
CVE-2025-46341 2025-06-04 HIGH 7.1 FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either…
CVE-2025-46204 2025-06-04 MEDIUM 6.5 An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint.
CVE-2025-46203 2025-06-04 MEDIUM 6.5 An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.
CVE-2025-46011 2025-06-04 MEDIUM 6.5 Listmonk v2.4.0 through v4.1.0 is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges.
CVE-2025-43924 2025-06-03 MEDIUM 6.1 Cross Site Scripting vulnerability was discovered in Unicom Focal Point 7.6.1. The val parameter in SettingController (for /fp/admin/settings/loginpage) and the rootserviceurl parameter in FriendsController (for /fp/admin/settings/friends), entered by…
CVE-2025-43923 2025-06-03 MEDIUM 6.5 An issue was discovered in ReportController in Unicom Focal Point 7.6.1. A user who has administrative privilege in Focal Point can perform SQL injection via the image parameter…
CVE-2025-31136 2025-06-04 MEDIUM 6.7 FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting…
CVE-2025-29093 2025-06-04 HIGH 8.2 File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component.
CVE-2025-23106 2025-06-04 MEDIUM 6.5 An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation.
CVE-2025-23101 2025-06-04 MEDIUM 6.5 An issue was discovered in Samsung Mobile Processor Exynos 1380. A Use-After-Free in the mobile processor leads to privilege escalation.
CVE-2025-23096 2025-06-04 MEDIUM 6.5 An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation.
CVE-2025-23095 2025-06-04 MEDIUM 6.5 An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation.
CVE-2025-20286 2025-06-04 CRITICAL 9.9 A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker…
CVE-2024-11831 2025-02-10 MEDIUM 5.4 A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing…
CVE-2024-40747 2025-01-07 MEDIUM 6.1 Various module chromes didn't properly process inputs, leading to XSS vectors.
CVE-2024-40748 2025-01-07 HIGH 7.5 Lack of output escaping in the id attribute of menu lists.
CVE-2024-40749 2025-01-07 HIGH 7.5 Improper Access Controls allows access to protected views.
CVE-2025-22204 2025-02-04 CRITICAL 9.8 Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability.
CVE-2025-22205 2025-02-04 HIGH 7.5 Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
CVE-2025-22206 2025-02-04 MEDIUM 4.7 A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the…
CVE-2025-22208 2025-02-15 MEDIUM 4.7 A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the…
CVE-2025-22209 2025-02-15 MEDIUM 4.7 A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the…
CVE-2025-22210 2025-02-25 HIGH 7.2 A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.
CVE-2025-25226 2025-04-08 CRITICAL 9.8 Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It…
CVE-2025-25227 2025-04-08 HIGH 7.5 Insufficient state checks lead to a vector that allows to bypass 2FA checks.
CVE-2024-10144 2025-05-15 MEDIUM 4.8 The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users…
CVE-2024-10054 2025-05-15 MEDIUM 4.8 The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site…
CVE-2024-10107 2025-05-15 MEDIUM 4.8 The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin…
CVE-2024-10145 2025-05-15 MEDIUM 4.8 The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored…
CVE-2024-10504 2025-05-15 MEDIUM 5.4 The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could…
CVE-2024-11109 2025-05-15 MEDIUM 4.8 The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
CVE-2024-3996 2025-05-15 MEDIUM 6.1 The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform…
CVE-2025-5609 2025-06-04 HIGH 8.8 A vulnerability classified as critical was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument…
CVE-2025-5608 2025-06-04 HIGH 8.8 A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formsetreboottimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads…
CVE-2025-5607 2025-06-04 HIGH 8.8 A vulnerability was found in Tenda AC18 15.03.05.05. It has been rated as critical. This issue affects the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the…
CVE-2025-48935 2025-06-04 N/A 0.0 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check…
CVE-2025-48934 2025-06-04 N/A 0.0 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables listed in the `--deny-env` option of the `deno…
CVE-2025-5606 2025-06-04 MEDIUM 6.3 A vulnerability was found in Tenda AC18 15.03.05.05. It has been declared as critical. This vulnerability affects the function formSetIptv of the file /goform/SetIPTVCfg. The manipulation of the…
« Anterior Página 1099 de 4308 Siguiente »