CVE Vulnerability Catalog

Podatność CVE-2025-13127 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie GoldenHorn firmy TAC Information Services. Umożliwia to ataki typu Cross-Site Scripting (XSS).

Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this to bypass cryptographic protections and gain limited unauthorized write access.

Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this to gain limited unauthorized write access.

Fortinet FortiAuthenticator versions 6.6.0 through 6.6.6, and all versions of 6.5, 6.4, 6.3 have a forced browsing vulnerability that allows an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints.

The NETGEAR Nighthawk R7000P (end of service) router has an improper input validation vulnerability that allows an authenticated administrator with local network access to execute OS command injections and make unauthorized modifications to the router software.

The Photo Block plugin by Ronald Huereca up to version 1.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects all versions from n/a through 1.5.1.

IBM QRadar SIEM versions 7.5 through 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed this vulnerability in the latest update.

An Insecure Direct Object Reference vulnerability in Medtronic CareLink Network allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network before December 4, 2025.

A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1 in an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile in the Domain Name Binding Page component. The manipulation results in cross site scripting. The attack may be performed remotely and has a high complexity level.

A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1 in some unknown functionality of the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1 in the Add Data Validation Page component. Manipulation of the data[name] argument leads to cross site scripting. The attack is possible remotely.

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with root access to modify the Recovery Partition (because of a lack of integrity protection).

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to modify or erase tamper events via the Chassis management board.

Directory traversal vulnerability in SOLIDserver IPAM v8.2.3. Allows an authenticated user with administrator privileges to list directories outside the authorized area using the 'directory' parameter in '/mod/ajax.php?action=sections/list/list'.

Vulnerability in nutzam NutzBoot up to 2.6.0-SNAPSHOT, affecting the getInputStream function in nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the LiteRpc-Serializer component, leading to deserialization. The attack can be launched remotely but is difficult to exploit.

An XSS vulnerability in School Management System (rolling release) exists in /student-view.php in the Edit Student Info Page component. Manipulation of the First Name argument causes XSS. Remote attack is possible, exploit is public.

An XSS vulnerability in Skuul School Management System up to version 2.6.5 exists in the SVG File Handler component in /dashboard/schools/1/edit. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. This affects an unknown functionality of the NFC Handler component. Manipulation can lead to the use of a hard-coded cryptographic key. The attack requires physical access to the device and is difficult to exploit.

W bibliotece libexpat do wersji 2.7.3, specjalnie przygotowany plik o przybliżonym rozmiarze 2 MiB może powodować znaczne opóźnienia w czasie przetwarzania, trwające nawet kilkanaście sekund.

Mustang before 2.16.3 allows exfiltrating files via XXE attacks.

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.