CVE-2025-4764

SQLi in Aida Computer's Hotspot

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows SQL Injection. This issue affects Hotel Guest Hotspot: through 22012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Aida

Products

Hotel Guest Hotspot

CVE-2025-4784

SQLi in Moderec's Tourtella

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection. This issue affects Tourtella: before 26.05.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Moderec

Products

Tourtella

CVE-2025-4822

SQLi in Bayraktar Solar Energies' ScadaWatt Otopilot

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL Injection. This issue affects ScadaWatt Otopilot: before 27.05.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-5243

Arbitrary File Upload in SMG Software's Information Portal

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information Portal: before 13.06.2025.

CVSS 3.1 · 10 Critical EPSS 1.5% KEV · Not listed

Vendors

—

Products

—

CVE-2025-5253

DoS in Kron Technologies' Kron PAM

Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS. This issue affects Kron PAM: before 3.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-5254

Stored XSS in Kron Technologies' Kron PAM

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM allows Stored XSS. This issue affects Kron PAM: before 3.7.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-5260

SSRF in PozitifIK's Pik Online

Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery. This issue affects Pik Online: before 3.1.5.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-5261

IDOR in PozitifIK's Pik Online

Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Trusted Identifiers. This issue affects Pik Online: before 3.1.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-4312

DrangSoft｜GCB/FCB Audit Software - Missing Authentication

GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Dragonsoft Drangsoft

Products

Gcb\/fcb Government Financial Cybersecurity Configuration Audit Software Gcb/fcb Audit Software Gcb Fcb Audit Software

CVE-2026-33551

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Openstack

Products

Keystone

CVE-2025-5319

SQLi in Emit Informatics' DIGITA Efficiency Management System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. DIGITA Efficiency Management System allows SQL Injection. This issue affects DIGITA Efficiency Management System: through 03022026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Emit

Products

Efficiency Management System

CVE-2025-5329

SQLi in Martcode Software's Delta Course Automation

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc. Delta Course Automation allows SQL Injection. This issue affects Delta Course Automation: through 04022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Martcode

Products

Delta Course Automation

CVE-2025-5518

IDOR in ArgusTech's BILGER

Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers. This issue affects BILGER: before 2.4.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Argustech

Products

Bilger

CVE-2025-5519

Information Disclosure in ArgusTech's BILGER

Insertion of Sensitive Information Into Sent Data vulnerability in ArgusTech BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Argustech

Products

Bilger

CVE-2025-5681

IDOR in Turtek Software's Eyotek

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 23.06.2025.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-5997

Privilege Escalation in Beamsec PhishPro

Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Beamsec

Products

Phishpro

CVE-2025-6060

XSS in DECE Software's Geodi

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DECE Software Geodi allows Cross-Site Scripting (XSS). This issue affects Geodi: before GEODI Setup 9.0.146.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Decesoftware

Products

Geodi

CVE-2025-6175

CRLF Injection in DECE Software's Geodi

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in DECE Software Geodi allows HTTP Request Splitting. This issue affects Geodi: before GEODI Setup 9.0.146.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Decesoftware

Products

Geodi

CVE-2025-6396

XSS in Webbeyaz's web site

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webbeyaz Website Design Website Software allows Cross-Site Scripting (XSS). This issue affects Website Software: through 2025.07.14.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Webbeyaz Website Design

Products

Website Software

CVE-2025-6397

XSS in Ankara Hosting's web site

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS. This issue affects Website Software: through 03022026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Ankara Hosting Website Design

Products

Website Software