CVE-2024-1662

Information Disclosure in Porty's PowerBank

Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allows Retrieve Embedded Sensitive Data. This issue affects PowerBank Application: before 2.02.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Porty

Products

Powerbank Powerbank Application

CVE-2025-7744

SQLi in Dolusoft's Omaspot

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection. This issue affects Omaspot: before 12.09.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dolusoft

Products

Omaspot

CVE-2025-7760

Reflected XSS in Ofisimo's Association Web Package Flora

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies Association Web Package Flora allows XSS Through HTTP Headers. This issue affects Association Web Package Flora: from v3.0 through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Ofisimo

Products

Association Web Package Flora

CVE-2025-7799

Reflected XSS in Zirve Information Technologies' e-Taxpayer Accounting Website

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS. This issue affects e-Taxpayer Accounting Website: through 07082025.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Zirve Information Technologies Inc.

Products

E-taxpayer Accounting Website

CVE-2025-8025

Improper Access Control in Dinosoft Business Solutions' Dinosoft ERP

Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dinosoft ERP: from < 3.0.1 through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dinosoft Business Solutions

Products

Dinosoft Erp

CVE-2025-8057

IDOR in Patika Global Technologies' HumanSuite

Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Patika Global Technologies HumanSuite allows Exploiting Trust in Client. This issue affects HumanSuite: before 53.21.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Patika Global Technologies

Products

Humansuite

CVE-2025-8079

Reflected XSS in Akıllı Ticaret Software Technologies' Smart Trade E-Commerce

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. Smart Trade E-Commerce allows Reflected XSS. This issue affects Smart Trade E-Commerce: before 4.5.0.0.1.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-8276

HTML Injection in Patika Global Technologies' HumanSuite

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing. This issue affects HumanSuite: before 53.21.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Patika Global Technologies

Products

Humansuite

CVE-2025-8303

XSS in EKA Software's Real Estate Script V5 (With Doping Module – Store Module – New Language System)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EKA Software Computer Information Advertising Services Ltd. Real Estate Script V5 (With Doping Module – Store Module – New Language System) allows Cross-Site Scripting (XSS). This issue affects Real Estate Script V5 (With Doping Module – Store Module – New Language System): through 17022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Eka Software Computer Information Advertising Services Ltd.

Products

Real Estate Script V5 (with Doping Module – Store Module – New Language System)

CVE-2025-8308

Reflected XSS in Key Software's INFOREX

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Key Software Solutions Inc. INFOREX- General Information Management System allows XSS Through HTTP Headers. This issue affects INFOREX- General Information Management System: from 2025 and before through 18022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Key Software Solutions Inc.

Products

Inforex- General Information Management System

CVE-2025-8350

Authentication Bypass with Redirect in BiEticaret Software's BiEticaret CMS

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Inrove Software And Internet Services

Products

Bieticaret Cms

CVE-2025-8411

XSS in Dokuzsoft Technology's E-Commerce Web Design Product

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology E-Commerce Web Design Product allows XSS Through HTTP Headers. This issue affects E-Commerce Web Design Product: before 11.08.2025.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-8456

Reflected XSS in Kod8 Software's Kod8 Individual and SME Website

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trade Ltd. Co. Kod8 Individual and SME Website allows Reflected XSS. This issue affects Kod8 Individual and SME Website: through 03022026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Kod8

Products

Kod8 Individual And Sme Website

CVE-2025-8461

Reflected XSS in Seres Software's syWEB

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 03022026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Seres Software

Products

Syweb

CVE-2025-8463

IDOR in SecHard Information Technologies' SecHard

Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHard: before 3.6.2-20250805.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-8532

IDOR in Bimser's eBA Document and Workflow Management System

Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Bimser

Products

Eba Document And Workflow Management System

CVE-2025-8587

Time-Based Blind SQLi in AKCE Software's SKSPro

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows SQL Injection. This issue affects SKSPro: through 07012026.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Akce Akceyazilim

Products

Skspro Skspro

CVE-2025-8589

Reflected XSS in AKCE Software's SKSPro

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Reflected XSS. This issue affects SKSPro: through 07012026.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Akce

Products

Skspro

CVE-2025-8590

Information Disclosure in AKCE Software's SKSPro

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexing. This issue affects SKSPro: through 07012026.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Akce

Products

Skspro

CVE-2025-8664

XSS in Saysis Computer Systems' StarCities

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities E-Municipality Management allows Cross-Site Scripting (XSS). This issue affects StarCities E-Municipality Management: before 20250825.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Saysis

Products

Starcities