CVE-2025-5837

PHPGurukul Employee Record Management System allemployees.php sql injection

A vulnerability classified as critical has been found in PHPGurukul Employee Record Management System 1.3. Affected is an unknown function of the file /admin/allemployees.php. The manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Employee Record Management System

CVE-2025-5839

Tenda AC9 POST Request AdvSetLanip fromadvsetlanip buffer overflow

A vulnerability, which was classified as critical, has been found in Tenda AC9 15.03.02.13. Affected by this issue is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Handler. The manipulation of the argument lanMask leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Tenda

Products

Ac9 Ac9 Firmware

CVE-2025-20063

arkui_ace_engine has a type confusion vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-21082

arkui_ace_engine has a type confusion vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-23235

arkcompiler_ets_runtime has an out-of-bounds write vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through out-of-bounds read.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-24493

kernel_liteos_a has a race condition vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-25217

arkui_ace_enginehas a NULL pointer dereference vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-26691

telephony_call_manager has an improper preservation of permissions vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-26693

security_access_token has an improper preservation of permissions vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-27131

kernel_liteos_m has an improper input vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-27242

Ssecurity_component_manager has an improper input vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-27247

Pasteboard has an improper preservation of permissions vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-27563

security_access_token has an improper preservation of permissions vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Openatom

Products

Openharmony

CVE-2025-5847

Tenda AC9 HTTP POST Request SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow

A vulnerability has been found in Tenda AC9 15.03.02.13 and classified as critical. Affected by this vulnerability is the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Tenda

Products

Ac9 Ac9 Firmware

CVE-2025-5848

Tenda AC15 HTTP POST Request setPptpUserList formSetPPTPUserList buffer overflow

A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. The manipulation of the argument list leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Tenda

Products

Ac15 Ac15 Firmware

CVE-2025-5849

Tenda AC15 HTTP POST Request SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow

A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been classified as critical. This affects the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Tenda

Products

Ac15 Ac15 Firmware

CVE-2025-5850

Tenda AC15 HTTP POST Request SetLEDCf formsetschedled buffer overflow

A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been declared as critical. This vulnerability affects the function formsetschedled of the file /goform/SetLEDCf of the component HTTP POST Request Handler. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 6.9% KEV · Not listed

Vendors

Tenda

Products

Ac15 Ac15 Firmware

CVE-2025-5851

Tenda AC15 HTTP POST Request AdvSetLanip fromadvsetlanip buffer overflow

A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been rated as critical. This issue affects the function fromadvsetlanip of the file /goform/AdvSetLanip of the component HTTP POST Request Handler. The manipulation of the argument lanMask leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Tenda

Products

Ac15 Ac15 Firmware

CVE-2025-5852

Tenda AC6 setPptpUserList formSetPPTPUserList buffer overflow

A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Tenda

Products

Ac6 Ac6 Firmware

CVE-2025-5853

Tenda AC6 SetRemoteWebCfg formSetSafeWanWebMan stack-based overflow

A vulnerability classified as critical was found in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg. The manipulation of the argument remoteIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 7.8% KEV · Not listed

Vendors

Tenda

Products

Ac6 Ac6 Firmware