Vuldb Updates

A vulnerability categorized as critical has been discovered in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /vehicle/search of the component API. Executing manipulation of the argument vehicleTypeCode can lead to sql injection. This vulnerability is handled as CVE-2025-6118. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability marked as critical has been reported in Customer Support System 1.0. This vulnerability affects unknown code of the file /customer_support/manage_user.php. Performing manipulation of the argument ID results in sql injection. This vulnerability is known as CVE-2025-40728. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, was found in Customer Support System 1.0. This affects an unknown function of the file /customer_support/index.php. Such manipulation of the argument page leads to cross site scripting. This vulnerability is referenced as CVE-2025-40729. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in fuyang_lipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a and classified as critical. This impacts the function queryPage of the file platform-schedule/src/main/java/com/platform/controller/ScheduleJobController.java. Executing manipulation of the argument beanName can lead to sql injection. This vulnerability is tracked as CVE-2025-7934. The attack can be launched remotely. Moreover, an exploit is present. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

A vulnerability was found in Linksys E1700 1.0.0.4.003. It has been declared as critical. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing manipulation of the argument command can lead to os command injection. The identification of this vulnerability is CVE-2025-9528. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in InstantCMS up to 1.6. It has been declared as critical. This affects the function eval of the component HTTP GET Request Handler. Executing manipulation of the argument look can lead to improper neutralization of directives in dynamically evaluated code. This vulnerability is tracked as CVE-2013-10051. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability was found in qBittorrent up to 5.1.1. It has been declared as problematic. This impacts an unknown function of the file rsswidget.cpp of the component Link URL Handler. Such manipulation leads to incorrect resource transfer. This vulnerability is uniquely identified as CVE-2025-54310. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability categorized as problematic has been discovered in Meshtastic Firmware up to 2.6.10. This affects an unknown part of the component Direct Message Handler. Such manipulation leads to insufficient entropy. This vulnerability is referenced as CVE-2025-52464. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. It has been declared as critical. Affected by this issue is some unknown functionality of the file /adpweb/a/base/barcodeDetail/. Executing manipulation of the argument barcodeNo/barcode/itemNo can lead to sql injection. This vulnerability is registered as CVE-2025-6267. It is possible to launch the attack remotely. No exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as problematic was found in Trend Micro Worry-Free Business Security. This impacts an unknown function. The manipulation results in uncontrolled search path. This vulnerability is cataloged as CVE-2025-49487. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is advised.

A vulnerability categorized as critical has been discovered in M-Files Server. Affected by this vulnerability is an unknown functionality of the component API Endpoint. The manipulation results in path traversal. This vulnerability is reported as CVE-2025-5964. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability was found in fuyang_lipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a. It has been classified as critical. Affected is the function SysLogController of the file platform-admin/src/main/java/com/platform/controller/SysLogController.java. The manipulation of the argument key leads to sql injection. This vulnerability is listed as CVE-2025-7935. The attack may be initiated remotely. In addition, an exploit is available. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.

A vulnerability was found in transformeroptimus superagi 0.0.14. It has been declared as critical. Affected by this issue is the function os.path.join/get_root_input_dir of the component File Upload Endpoint. The manipulation results in path traversal. This vulnerability is cataloged as CVE-2025-51475. The attack may be launched remotely. There is no exploit available.

A vulnerability described as critical has been identified in Ollama 0.6.7. The impacted element is the function server.auth.getAuthorizationToken of the file /api/pull. The manipulation of the argument realm results in improper access controls. This vulnerability is known as CVE-2025-51471. It is possible to launch the attack remotely. No exploit is available. Applying a patch is advised to resolve this issue.

A vulnerability classified as critical was found in Onyx Enterprise Edition 0.27.0. This impacts an unknown function of the file /api/manage/admin/user-group/id of the component PATCH Request Handler. Such manipulation leads to authorization bypass. This vulnerability is uniquely identified as CVE-2025-51479. The attack can be launched remotely. No exploit exists. A patch should be applied to remediate this issue.

A vulnerability was found in TransformerOptimus SuperAGI 0.0.14. It has been rated as critical. Affected by this vulnerability is the function AgentTemplate.eval_agent_config of the component Agent Template Configuration. This manipulation causes code injection. This vulnerability is tracked as CVE-2025-51472. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

A vulnerability categorized as problematic has been discovered in RAGFlow 0.17.2. Affected by this issue is the function api.apps.dialog_app.set_dialog. Such manipulation of the argument assistant greeting leads to cross site scripting. This vulnerability is listed as CVE-2025-51462. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as critical, has been found in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /pages/save_room.php. The manipulation of the argument floorno leads to sql injection. This vulnerability is referenced as CVE-2025-11399. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability, which was classified as critical, was found in SourceCodester Hotel and Lodge Management System 1.0. This impacts an unknown function of the file /del_room.php. The manipulation of the argument ID results in sql injection. This vulnerability is identified as CVE-2025-11400. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0 and classified as critical. Affected is an unknown function of the file /pages/save_curr.php. This manipulation of the argument currcode causes sql injection. This vulnerability is tracked as CVE-2025-11401. The attack is possible to be carried out remotely. Moreover, an exploit is present.