Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2025-8350

Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Inrove Software And Internet Services
Products
Bieticaret Cms
CVE-2025-8411

XSS in Dokuzsoft Technology's E-Commerce Web Design Product

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology E-Commerce Web Design Product allows XSS Through HTTP Headers. This issue affects E-Commerce Web Design Product: before 11.08.2025.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-8456

Reflected XSS in Kod8 Software's Kod8 Individual and SME Website

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trade Ltd. Co. Kod8 Individual and SME Website allows Reflected XSS. This issue affects Kod8 Individual and SME Website: through 03022026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Kod8
Products
Kod8 Individual And Sme Website
CVE-2025-8461

Reflected XSS in Seres Software's syWEB

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 03022026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Seres Software
Products
Syweb
CVE-2025-8463

IDOR in SecHard Information Technologies' SecHard

Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHard: before 3.6.2-20250805.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-8532

IDOR in Bimser's eBA Document and Workflow Management System

Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bimser
Products
Eba Document And Workflow Management System
CVE-2025-8587

Time-Based Blind SQLi in AKCE Software's SKSPro

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows SQL Injection. This issue affects SKSPro: through 07012026.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Akce Akceyazilim
Products
Skspro Skspro
CVE-2025-8589

Reflected XSS in AKCE Software's SKSPro

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Reflected XSS. This issue affects SKSPro: through 07012026.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Akce
Products
Skspro
CVE-2025-8590

Information Disclosure in AKCE Software's SKSPro

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexing. This issue affects SKSPro: through 07012026.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Akce
Products
Skspro
CVE-2025-8664

XSS in Saysis Computer Systems' StarCities

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities E-Municipality Management allows Cross-Site Scripting (XSS). This issue affects StarCities E-Municipality Management: before 20250825.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Saysis
Products
Starcities
CVE-2025-8668

Reflected XSS in E-Kalite Software Hardware Engineering's Turboard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard allows Reflected XSS. This issue affects Turboard: from 2025.07 before 2026.02.  NOTE: This CVE record updated after the vendor implemented mitigations.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
E-kalite Software Hardware Engineering Design And Internet Services Industry And Trade Ltd. Co.
Products
Turboard
CVE-2025-8695

Reflected XSS in Netcad Software's NetGIS Server

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS. This issue affects NetGIS Server: from 5.2.4 through 22.08.2025.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-8855

2FA Expiry Bypass in Optimus Software's Brokerage Automation

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Optimus Software
Products
Brokerage Automation
CVE-2025-8884

IDOR in VHS Electronic Software's ACE Center

Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers. This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vhs Electronic Software
Products
Ace Center
CVE-2025-8886

Authorization Bypass in Usta Information Systems' Aybs Interaktif

Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorization vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Privilege Abuse, Authentication Bypass. This issue affects Aybs Interaktif: from 2024 through 28082025.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Usta
Products
Aybs
CVE-2026-48840

Exim Proxy Misconfiguration Causes Uninitialized Memory Disclosure

Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Exim
Products
Exim
CVE-2025-8887

IDOR in Usta Information Systems' Aybs Interaktif

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs Interaktif: from 2024 through 28082025.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Usta
Products
Aybs
CVE-2025-9031

Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web

Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netdatasoft
Products
Divvy Drive
CVE-2025-9035

Reflected XSS in Horato Internet Technologies' Virtual Library Platform

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-9062

IDOR in MeCODE Informatics' Envanty

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This issue affects Envanty: before 1.0.6.   NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Mecode Informatics And Engineering Services
Products
Envanty