5391 vulnerabilidades Orden: CVSS EPSS Año ID
CVE-2025-59104
Access Manager 92xx-k7 General
7.0
HIGH
EPSS
0.0%
2025 CWE-1234 2 PoCs

With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through this vulnerability.

CVE-2025-24209
Safari General
7.0
HIGH
EPSS
0.6%
2025 2 PoCs

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2025-20890
Samsung Mobile Devices General
7.0
HIGH
EPSS
0.1%
2025 1 PoC

Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.

CVE-2025-8863
YugabyteDB Web
7.0
HIGH
EPSS
0.0%
2025 CWE-319 1 PoC

YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission

CVE-2025-5306
Pandora FMS General
7.0
HIGH
EPSS
71.3%
2025 CWE-77 1 PoC

Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778

CVE-2025-32023
redis Database
7.0
HIGH
EPSS
18.4%
2025 CWE-680 4 PoCs

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This

CVE-2025-2680
Bank Locker Management System Web Database
6.9
MEDIUM
EPSS
0.1%
2025 CWE-89 1 PoC

A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edit-assign-locker.php?ltid=1. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-6403
School Fees Payment System Web Database ⚡ nuclei
6.9
MEDIUM
EPSS
1.2%
2025 CWE-89 0 PoCs

A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-6580
Best Salon Management System Database
6.9
MEDIUM
EPSS
0.2%
2025 CWE-89 1 PoC

A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the component Login. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-5562
Curfew e-Pass Management System Web Database
6.9
MEDIUM
EPSS
0.2%
2025 CWE-89 1 PoC

A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/edit-category-detail.php. The manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7961
KAP General
6.9
MEDIUM
EPSS
0.0%
2025 CWE-94 1 PoC

Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0.

CVE-2025-5252
News Portal Project Web Database
6.9
MEDIUM
EPSS
0.2%
2025 CWE-89 1 PoC

A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit-subadmin.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-0802
Best Employee Management System Web
6.9
MEDIUM
EPSS
0.1%
2025 CWE-284 1 PoC

A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/View_user.php of the component Administrative Endpoint. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-4895
Doctors Appointment System Web Database
6.9
MEDIUM
EPSS
0.2%
2025 CWE-89 1 PoC

A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing of the file /admin/delete-session.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-4728
Best Online News Portal Web Database
6.9
MEDIUM
EPSS
0.2%
2025 CWE-89 1 PoC

A vulnerability was found in SourceCodester Best Online News Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /search.php. The manipulation of the argument searchtitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-2066
Life Insurance Management System Web Database
6.9
MEDIUM
EPSS
0.1%
2025 CWE-89 1 PoC

A vulnerability has been found in projectworlds Life Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /updateAgent.php. The manipulation of the argument agent_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-13578
Library System Web Database
6.9
MEDIUM
EPSS
0.0%
2025 CWE-89 1 PoC

A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-9473
Online Bank Management System Web Database
6.9
MEDIUM
EPSS
0.0%
2025 CWE-89 2 PoCs

A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. This impacts an unknown function of the file /feedback.php. The manipulation of the argument msg leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2025-9476
Human Resource Information System Web
6.9
MEDIUM
EPSS
0.1%
2025 CWE-434 1 PoC

A vulnerability has been found in SourceCodester Human Resource Information System 1.0. Affected by this issue is some unknown functionality of the file /Superadmin_Dashboard/process/editemployee_process.php. Such manipulation of the argument employee_file201 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-15127
Hotels_Server Web Database
6.9
MEDIUM
EPSS
0.0%
2025 CWE-89 1 PoC

A security vulnerability has been detected in FantasticLBP Hotels_Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown functionality of the file /controller/api/Room.php. Such manipulation of the argument hotelId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not