Search vulnerabilities

Expected end of text, found ':' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,740

CVE-2025-6396

XSS in Webbeyaz's web site

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webbeyaz Website Design Website Software allows Cross-Site Scripting (XSS). This issue affects Website Software: through 2025.07.14.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webbeyaz Website Design
Products
Website Software
CVE-2025-6397

XSS in Ankara Hosting's web site

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS. This issue affects Website Software: through 03022026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Ankara Hosting Website Design
Products
Website Software
CVE-2026-22750

SSL bundle configuration silently bypassed in Spring Cloud Gateway

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0  available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Vmware
Products
Spring Cloud Gateway
CVE-2025-6520

SQLi in Abis Technology's BAPSIS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection. This issue affects BAPSIS: before 202510271606.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Abis Technology
Products
Bapsis
CVE-2025-6575

XSS in Dolusoft's Omaspot

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue affects Omaspot: before 12.09.2025.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dolusoft
Products
Omaspot
CVE-2025-6830

SQLi in Xpoda Türkiye Information Technology's Password Module

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module allows SQL Injection. This issue affects Password Module: through 11022026.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Xpoda Turkiye Information Technology
Products
Xpoda Studio
CVE-2025-6918

SQLi in Ncvav's Virtual PBX Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ncvav
Products
Virtual Pbx Software
CVE-2025-6919

SQLi in Cats Informatics' Aykome

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technologies Aykome License Tracking System allows SQL Injection. This issue affects Aykome License Tracking System: before Version dated 06.10.2025.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-6923

Reflected XSS in Talent Software's UNIS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 42957.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Talentsoft
Products
Unis
CVE-2025-6924

Reflected XSS in Talent Software's e-BAP

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Reflected XSS. This issue affects e-BAP Automation: before 42957.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Talentsoftware
Products
Bap Automation
CVE-2025-6967

Authentication Bypass in Sarman Soft's CMS

Execution After Redirect (EAR) vulnerability in Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. CMS allows JSON Hijacking (aka JavaScript Hijacking), Authentication Bypass. This issue affects CMS: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Sarman Soft Software And Technology Services Industry And Trade Ltd. Co.
Products
Cms
CVE-2026-5525

Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS

A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 characters without a trailing backslash, the application appends a backslash and null terminator without proper bounds checking, resulting in a stack buffer overflow and application crash (STATUS_STACK_BUFFER_OVERRUN).

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Notepad++ Notepad-plus-plus
Products
Notepad++ Notepad++ Notepad\+\+
CVE-2025-7013

IDOR in QRMenumPro's Menu Panel

Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This issue affects Menu Panel: through 29012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qr Menu Pro Smart Menu Systems Qrmenumpro
Products
Menu Panel Menu Panel
CVE-2025-7014

Session Hijacking in QRMenumPro's Menu Panel

Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qr Menu Pro Smart Menu Systems Qrmenumpro
Products
Menu Panel Menu Panel
CVE-2025-7015

Session Hijacking in Akinsoft's QR Menu

Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: before s1.05.12.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Qr Menu
CVE-2025-7016

Improper Access Control in Akinsoft's QR Menu

Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects QR Menu: before s1.05.12.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Qr Menu
CVE-2026-40989

Self Routing guard bypassed via function composition

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Function Spring Cloud Function
CVE-2025-7047

Missing Authorization in Utarit Informatics' SoliClub

Missing Authorization vulnerability in Utarit Informatics Services Inc. SoliClub allows Privilege Abuse. This issue affects SoliClub: before 5.3.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Utarit
Products
Soliclub
CVE-2025-7347

IDOR in Dinibh Puzzle's Dinibh Patrol Tracking System

Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers. This issue affects Dinibh Patrol Tracking System: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dinibh Puzzle Software Solutions
Products
Dinibh Patrol Tracking System
CVE-2025-7355

IDOR in Beefull Energy Technologies' Beefull App

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Beefull Energy
Products
Beefull App