Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2025-0642

Hard-coded Credentials in PosCube's Assist

Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allows Excavation, Authentication Bypass. This issue affects Assist: through 10.02.2025.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Poscube
Products
Assist
CVE-2025-0643

XSS in Narkom Communication Technologies' Pyxis Signage

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Stored XSS. This issue affects Pyxis Signage: through 31012025.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Narkom
Products
Pyxis Signage
CVE-2025-0645

Arbitrary File Upload in Narkom Communication Technologies' Pyxis Signage

Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Pyxis Signage: through 31012025.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Narkom
Products
Pyxis Signage
CVE-2025-0670

IDOR in Akinsoft's ProKuafor

Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft ProKuafor allows Resource Leak Exposure. This issue affects ProKuafor: from s1.02.07 before v1.02.08.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Prokuafor
CVE-2025-0875

IDOR in Proliz Software's OBS

Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Parameter Injection. This issue affects OBS (Student Affairs Information System): before v26.0328.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-0876

XSS in Isin Basi Advertisement & IT's Workif

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies Trade Inc. IT's Workif allows Cross-Site Scripting (XSS). This issue affects IT's Workif: through 20251003. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-0877

XSS in AtaksAPP's Reservation Management System

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management System allows Cross-Site Scripting (XSS). This issue affects Reservation Management System: before 4.2.3.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-0878

XSS in Akinsoft's LimonDesk

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XSS). This issue affects LimonDesk: from s1.02.14 before v1.02.17.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Limondesk
CVE-2025-0879

XSS in Shopside Software's Shopside App

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shopside Software Shopside App allows Cross-Site Scripting (XSS). This issue requires high privileges. This issue affects Shopside App: before 17.02.2025.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-0984

Arbitrary File Upload in Netoloji Software's E-Flow

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection. This issue affects E-Flow: before 3.23.00.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-0987

IDOR in CB Project's CVLand

Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection. This issue affects CVLand: from 2.1.0 through 20251103. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Cb Project
Products
Cvland
CVE-2025-1029

Hardcoded Credentials in Utarit Informatics' SoliClub

Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc. SoliClub allows Read Sensitive Constants Within an Executable. This issue affects SoliClub: from 5.2.4 before 5.3.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Soliclub
CVE-2025-1030

Sensitive Data Exposure in Utarit Informatics' SoliClub

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Utarit Informatics Services Inc. SoliClub allows Query System for Information. This issue affects SoliClub: from 5.2.4 before 5.3.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Soliclub
CVE-2025-1031

IDOR in Utarit Informatics' SoliClub

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse. This issue affects SoliClub: from 5.2.4 before 5.3.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Soliclub
CVE-2025-1035

Path Traversal in Komtera Technolgies' KLog Server

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls. This issue affects KLog Server: before 3.1.1.

CVSS 3.1 · 5.7 Medium EPSS 9.8% KEV · Not listed
Vendors
—
Products
—
CVE-2025-1161

Improper Authorization in Nomysoft Informatics' Nomysem

Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue affects Nomysem: through May 2025.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nomysost
Products
Nomysem
CVE-2025-1269

Open Redirect in HAVELSAN's Open Source Project Liman MYS

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. This issue affects Liman MYS: before 2.1.1 - 1010.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-1301

Reflected XSS in Yordam Informatics' Library Automation System

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yordam Informatics Library Automation System allows Reflected XSS. This issue affects Library Automation System: before 21.6.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Yordam
Products
Library Automation System
CVE-2025-1469

IDOR in Turtek Software's Eyotek

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 11.03.2025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-1496

Improper Authentication in BG-TEK's Coslat Hotspot

Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authentication Abuse. This issue affects Coslat Hotspot: before 6.26.0.R.20250227.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—