Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2025-7013

IDOR in QRMenumPro's Menu Panel

Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This issue affects Menu Panel: through 29012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qr Menu Pro Smart Menu Systems Qrmenumpro
Products
Menu Panel Menu Panel
CVE-2025-7014

Session Hijacking in QRMenumPro's Menu Panel

Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qr Menu Pro Smart Menu Systems Qrmenumpro
Products
Menu Panel Menu Panel
CVE-2025-7015

Session Hijacking in Akinsoft's QR Menu

Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: before s1.05.12.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Qr Menu
CVE-2025-7016

Improper Access Control in Akinsoft's QR Menu

Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects QR Menu: before s1.05.12.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Qr Menu
CVE-2026-40989

Self Routing guard bypassed via function composition

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Function Spring Cloud Function
CVE-2025-7047

Missing Authorization in Utarit Informatics' SoliClub

Missing Authorization vulnerability in Utarit Informatics Services Inc. SoliClub allows Privilege Abuse. This issue affects SoliClub: before 5.3.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Soliclub
CVE-2025-7347

IDOR in Dinibh Puzzle's Dinibh Patrol Tracking System

Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers. This issue affects Dinibh Patrol Tracking System: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dinibh Puzzle Software Solutions
Products
Dinibh Patrol Tracking System
CVE-2025-7355

IDOR in Beefull Energy Technologies' Beefull App

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Beefull Energy
Products
Beefull App
CVE-2026-40990

Unbounded cache for function definitions

OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Function Spring Cloud Function
CVE-2025-7358

Use of Hard-coded Credentials in Utarit Informatics' SoliClub

Use of Hard-coded Credentials vulnerability in Utarit Informatics Services Inc. SoliClub allows Authentication Abuse. This issue affects SoliClub: before 5.3.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Soliclub
CVE-2025-7630

OTP Password Brute Forcing in DorukNet's Wispotter

Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc. Wispotter allows Password Brute Forcing, Brute Force. This issue affects Wispotter: from 1.0 before v2025.10.08.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Doruk Communication And Automation Industry And Trade Inc.
Products
Wispotter
CVE-2025-7631

Time-Based Blind SQLi in Tumeva Internet Technologies' Tumeva Prime News Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tumeva Internet Technologies Software Information Advertising and Consulting Services Trade Ltd. Co. Tumeva Prime News Software allows SQL Injection. This issue affects Tumeva Prime News Software: from v.1.0.1 before v1.0.2.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Tumeva Internet Technologies Software Information Advertising And Consulting Services Trade Ltd. Co.
Products
Tumeva News Software
CVE-2025-7636

SQLi in Ergosis Security Systems' ZEUS PDKS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc. ZEUS PDKS allows SQL Injection. This issue affects ZEUS PDKS: from <1.0.5.10 through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ergosis Security Systems Computer Industry And Trade Inc.
Products
Zeus Pdks
CVE-2025-7702

Open Redirect in PUSULA's Manageable Email Sending System

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pusula Communication Information Internet Industry and Trade Ltd. Co. Manageable Email Sending System allows Exploiting Trust in Client. This issue affects Manageable Email Sending System: from <=2025.06 before 2025.08.06.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Pusula
Products
Manageable Email Sending System
CVE-2025-7706

Improper Access Control in TUBITAK BILGEM's Liderahenk

Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion. This issue affects Liderahenk: from 3.0.0 to 3.3.1 before 3.5.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tubitak Bilgem Software Technologies Research Institute
Products
Liderahenk
CVE-2025-7713

Reflected XSS in Global Medya's PHP CMS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows XSS Through HTTP Headers. This issue affects Content Management System (CMS): through 21072025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Global Interactive Design Media Software Globalmedya
Products
Content Management System Content Management System
CVE-2026-47265

AIOHTTP vulnerable to cross-origin redirect with per-request cookies

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs Aiohttp
Products
Aiohttp Aiohttp
CVE-2025-7714

Time Based SQLi in Global Medya's PHP CMS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows Command Line Execution through SQL Injection. This issue affects Content Management System (CMS): through 21072025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Global Interactive Design Media Software Globalmedya
Products
Content Management System Content Management System
CVE-2025-7743

Sensitive Data Exposure in Dolusoft's Omaspot

Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: before 12.09.2025.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Dolusoft
Products
Omaspot
CVE-2026-11312

bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bytedance
Products
Infinistore