Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2025-1929

SQLi in RiskTurk's Treasury Management Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Risk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine ve Risk Yönetimi Yazılımı allows SQL Injection, CAPEC - 7 - Blind SQL Injection. This issue affects Reel Sektör Hazine ve Risk Yönetimi Yazılımı: through 1.0.0.4.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-2154

Stored XSS in EchoCCS's Specto CM

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Stored XSS. This issue affects Specto CM: before 17032025.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-2155

Arbitrary File Upload in EchoCCS's Specto CM

Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-2204

XSS in Tapandsign Technologies' Tap&Sign App

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tapandsign Technologies Software Inc. Tap&Sign allows Cross-Site Scripting (XSS). This issue affects Tap&Sign: through 23012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tapandsign
Products
Tap&sign
CVE-2025-2301

IDOR in Akbim Software's Online Exam Registration

Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This issue affects Online Exam Registration: before 14.03.2025.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-2307

XSS in Verisay Communication's Aidango

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Aidango allows Cross-Site Scripting (XSS). This issue affects Aidango: before 2.144.4.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-2311

Authentication Bypass in Sechard Information Technologies' SecHard

Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring. This issue affects SecHard: before 3.3.0.20220411.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-2404

XSS in Ubit Information Technologies' STOYS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting (XSS). This issue affects STOYS: from 2 before 20250916.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ubit
Products
Stoys
CVE-2025-2405

XSS in Verisay Communication's Titarus

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Titarus allows Cross-Site Scripting (XSS). This issue affects Titarus: before 2.144.4.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-2406

XSS in Verisay Communication's Trizbi

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi allows Cross-Site Scripting (XSS). This issue affects Trizbi: before 2.144.4.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-2411

OTP Bypass in Akinsoft's TaskPano

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano allows Authentication Bypass. This issue affects TaskPano: from s1.06.04 before v1.06.06.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Taskpano
CVE-2025-2412

OTP Bypass in Akinsoft's QR Menu

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass. This issue affects QR Menu: from s1.05.07 before v1.05.12.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Qr Menu
CVE-2025-2413

OTP Bypass in Akinsoft's ProKuafor

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass. This issue affects ProKuafor: from s1.02.08 before v1.02.08.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Prokuafor
CVE-2025-2414

OTP Bypass in Akinsoft's OctoCloud

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass. This issue affects OctoCloud: from s1.09.03 before v1.11.01.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Octocloud
CVE-2026-21017

Improper Privilege Handling in SecTelephonyProvider

Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung Samsung Mobile
Products
Android Samsung Mobile Devices
CVE-2026-21029

Improper Export of Android Application Components Leading to Local Privilege Escalation in Galaxy Editing Service

Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Samsung
Products
Android Mobile Devices
CVE-2025-2415

OTP Bypass in Akinsoft's MyRezzta

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass. This issue affects MyRezzta: from s2.03.01 before v2.05.01.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Myrezzta
CVE-2025-2416

OTP Bypass in Akinsoft's LimonDesk

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass. This issue affects LimonDesk: from s1.02.14 before v1.02.17.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Limondesk
CVE-2025-2417

OTP Bypass in Akinsoft's e-Mutabakat

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft e-Mutabakat allows Authentication Bypass. This issue affects e-Mutabakat: from 2.02.06 before v2.02.06.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
E-mutabakat
CVE-2025-2421

Remote Code Execution in Profelis Informatics' SambaBox

Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Informatics SambaBox allows Code Injection. This issue affects SambaBox: before 5.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Felisify
Products
Sambabox