Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,467

CVE-2025-5681

IDOR in Turtek Software's Eyotek

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 23.06.2025.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-5997

Privilege Escalation in Beamsec PhishPro

Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Beamsec
Products
Phishpro
CVE-2025-6060

XSS in DECE Software's Geodi

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DECE Software Geodi allows Cross-Site Scripting (XSS). This issue affects Geodi: before GEODI Setup 9.0.146.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Decesoftware
Products
Geodi
CVE-2025-6175

CRLF Injection in DECE Software's Geodi

Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in DECE Software Geodi allows HTTP Request Splitting. This issue affects Geodi: before GEODI Setup 9.0.146.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Decesoftware
Products
Geodi
CVE-2025-6396

XSS in Webbeyaz's web site

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webbeyaz Website Design Website Software allows Cross-Site Scripting (XSS). This issue affects Website Software: through 2025.07.14.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webbeyaz Website Design
Products
Website Software
CVE-2025-6397

XSS in Ankara Hosting's web site

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS. This issue affects Website Software: through 03022026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Ankara Hosting Website Design
Products
Website Software
CVE-2026-22750

SSL bundle configuration silently bypassed in Spring Cloud Gateway

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0  available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Vmware
Products
Spring Cloud Gateway
CVE-2025-6520

SQLi in Abis Technology's BAPSIS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection. This issue affects BAPSIS: before 202510271606.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Abis Technology
Products
Bapsis
CVE-2025-6575

XSS in Dolusoft's Omaspot

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue affects Omaspot: before 12.09.2025.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dolusoft
Products
Omaspot
CVE-2025-6830

SQLi in Xpoda Türkiye Information Technology's Password Module

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module allows SQL Injection. This issue affects Password Module: through 11022026.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Xpoda Turkiye Information Technology
Products
Xpoda Studio
CVE-2025-6918

SQLi in Ncvav's Virtual PBX Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ncvav
Products
Virtual Pbx Software
CVE-2025-6919

SQLi in Cats Informatics' Aykome

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technologies Aykome License Tracking System allows SQL Injection. This issue affects Aykome License Tracking System: before Version dated 06.10.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-6923

Reflected XSS in Talent Software's UNIS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 42957.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Talentsoft
Products
Unis
CVE-2025-6924

Reflected XSS in Talent Software's e-BAP

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Reflected XSS. This issue affects e-BAP Automation: before 42957.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Talentsoftware
Products
Bap Automation
CVE-2025-6967

Authentication Bypass in Sarman Soft's CMS

Execution After Redirect (EAR) vulnerability in Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. CMS allows JSON Hijacking (aka JavaScript Hijacking), Authentication Bypass. This issue affects CMS: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Sarman Soft Software And Technology Services Industry And Trade Ltd. Co.
Products
Cms
CVE-2026-5525

Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS

A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 characters without a trailing backslash, the application appends a backslash and null terminator without proper bounds checking, resulting in a stack buffer overflow and application crash (STATUS_STACK_BUFFER_OVERRUN).

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Notepad++ Notepad-plus-plus
Products
Notepad++ Notepad++ Notepad\+\+
CVE-2025-7013

IDOR in QRMenumPro's Menu Panel

Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This issue affects Menu Panel: through 29012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qr Menu Pro Smart Menu Systems Qrmenumpro
Products
Menu Panel Menu Panel
CVE-2025-7014

Session Hijacking in QRMenumPro's Menu Panel

Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qr Menu Pro Smart Menu Systems Qrmenumpro
Products
Menu Panel Menu Panel
CVE-2025-7015

Session Hijacking in Akinsoft's QR Menu

Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: before s1.05.12.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Qr Menu
CVE-2025-7016

Improper Access Control in Akinsoft's QR Menu

Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects QR Menu: before s1.05.12.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Qr Menu