cve,poc_name,poc_description,poc_url,poc_source,poc_stars,poc_date_discovered,cve_url,cve_title,cve_description,cve_vendor,cve_products,cve_cvssv3_base_score,cve_cvssv3_base_severity,cve_epss
CVE-2025-21298,CVE-2025-21298,Proof of concept & details for CVE-2025-21298,https://github.com/ynwarcs/CVE-2025-21298,github,0,2025-01-21T03:16:51.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-21298,Windows OLE Remote Code Execution Vulnerability in Microsoft Products,"The Windows OLE Remote Code Execution Vulnerability allows an attacker to execute arbitrary code on an affected system via maliciously crafted OLE objects. Successful exploitation could enable attackers to install programs; view, change, or delete data; or create new accounts with full user rights. It's imperative for users to apply the necessary patches and updates provided by Microsoft to mitigate risks associated with this vulnerability.",Microsoft,"Windows 10 Version 1809,Windows Server 2019,Windows Server 2019 (server Core Installation),Windows Server 2022,Windows 10 Version 21h2,Windows 11 Version 22h2,Windows 10 Version 22h2,Windows Server 2025 (server Core Installation),Windows 11 Version 22h3,Windows 11 Version 23h2,Windows Server 2022, 23h2 Edition (server Core Installation),Windows 11 Version 24h2,Windows Server 2025,Windows 10 Version 1507,Windows 10 Version 1607,Windows Server 2016,Windows Server 2016 (server Core Installation),Windows Server 2008 Service Pack 2,Windows Server 2008 Service Pack 2 (server Core Installation),Windows Server 2008  Service Pack 2,Windows Server 2008 R2 Service Pack 1,Windows Server 2008 R2 Service Pack 1 (server Core Installation),Windows Server 2012,Windows Server 2012 (server Core Installation),Windows Server 2012 R2,Windows Server 2012 R2 (server Core Installation)",9.8,CRITICAL,0.000910000002477318
CVE-2021-1732,CVE-2021-1732,Compiled CVE-2021-1732(WIndows XP-10(till 20H1) LPE),https://github.com/Sausageinforest/CVE-2021-1732,github,0,2025-01-21T02:50:48.000Z,https://securityvulnerability.io/vulnerability/CVE-2021-1732,Windows Win32k Elevation of Privilege Vulnerability,Windows Win32k Elevation of Privilege Vulnerability,Microsoft,"Windows 10 Version 1803,Windows 10 Version 1809,Windows Server 2019,Windows Server 2019 (server Core Installation),Windows 10 Version 1909,Windows Server, Version 1909 (server Core Installation),Windows 10 Version 2004,Windows Server Version 2004,Windows 10 Version 20h2,Windows Server Version 20h2",7.8,HIGH,0.03497999906539917
CVE-2024-6387,CVE-2024-6387,This is an altered PoC for d0rb/CVE-2024-6387. This takes glibc addresses and trys to exploit the CVE through them.,https://github.com/AzrDll/CVE-2024-6387,github,0,2025-01-20T18:38:40.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-6387,Signal Handler Race Condition in OpenSSH's Server,"A regression vulnerability discovered in OpenSSH's server (sshd) involves a race condition affecting the handling of signals. This vulnerability allows an attacker to exploit the sshd service by failing to authenticate within a specified timeframe. If successfully triggered, this flaw could alter the normal operation of the sshd service. As a result, an unauthenticated remote attacker may gain the ability to execute arbitrary code, potentially compromising the affected system. This vulnerability underscores the importance of timely security updates and robust configurations to safeguard systems running OpenSSH.",Red Hat,"Red Hat Enterprise Linux 9,Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions,Red Hat Enterprise Linux 9.2 Extended Update Support,Red Hat Enterprise Linux 6,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Openshift Container Platform 4",8.1,HIGH,0.0026100000832229853
CVE-2021-44228,CVE-2021-44228,调试环境,https://github.com/ZacharyZcR/CVE-2021-44228,github,0,2025-01-20T17:04:01.000Z,https://securityvulnerability.io/vulnerability/CVE-2021-44228,Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints,"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",Apache,Apache Log4j2,10,CRITICAL,0.972320020198822
CVE-2024-9796,CVE-2024-9796,Vulnerable website to the CVE-2024-9796,https://github.com/viniciuslazzari/CVE-2024-9796,github,0,2025-01-20T03:40:57.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-9796,Unauthorized SQL Injection Attacks via T Parameter in WP-Advanced-Search Plugin,"The WP-Advanced-Search WordPress plugin, prior to version 3.3.9.2, contains a vulnerability that arises from improper handling of user input in the t parameter. This lack of sanitization and escaping before usage in SQL statements allows unauthenticated users to execute arbitrary SQL queries. As a result, attackers can manipulate database queries, potentially leading to data exfiltration or alteration. It is crucial for website owners using this plugin to update to the latest version to protect against unauthorized access and mitigate the risk of SQL injection attacks.",WP-Advanced-Search,WP-advanced-search,9.8,CRITICAL,0.009739999659359455
CVE-2025-0581,CVE-2025-0581 - Proof of Concept,,https://github.com/KhukuriRimal/Vulnerabilities/blob/main/CampCodes%20-%20Stored%20Cross%20Site%20Scripting-%20Account%20Takeover%20Possibility.pdf,refferences,,2025-01-20T03:00:11.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0581,Cross Site Scripting Vulnerability in CampCodes School Management Software,"A cross site scripting vulnerability has been identified in version 1.0 of CampCodes School Management Software. The issue is found within the Chat History component, specifically in the /chat/group/send file. An attacker can manipulate the 'message' argument to execute malicious scripts remotely, potentially compromising user data and session integrity. This vulnerability has been publicly disclosed and may be exploited by attackers to target users of the software.",Campcodes,School Management Software,5.3,MEDIUM,0.0006799999973736703
CVE-2025-0580,CVE-2025-0580 - Proof of Concept,,https://gist.github.com/mcdruid/0d1fdbba445587639ee5da66e7abfcc9,refferences,,2025-01-20T02:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0580,Improper Authorization in Shiprocket Module for OpenCart,"A vulnerability exists in the Shiprocket Module for OpenCart that affects its REST API functionality, specifically in the handling of the 'contentHash' argument within the /index.php?route=extension/module/rest_api&action=getOrders endpoint. This flaw can potentially lead to improper authorization, allowing malicious actors to exploit the system remotely. Although the attack complexity is considered high, the vulnerability has been publicly disclosed, making it a critical concern for users of this module. The vendor has been informed of this issue but has not provided a response or remediation guidance.",Shiprocket,Shiprocket Module,6.3,MEDIUM,0.0005200000014156103
CVE-2025-0579,CVE-2025-0579 - Proof of Concept,,https://gist.github.com/mcdruid/3c9fc9bd4e882cee21f8a37998f56fce,refferences,,2025-01-20T02:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0579,SQL Injection Vulnerability in Shiprocket Module for OpenCart,"A SQL injection vulnerability has been identified in the Shiprocket Module for OpenCart, specifically within the REST API functionality exposed through /index.php?route=extension/shiprocket/module/restapi. The issue stems from improper handling of the 'x-username' argument, allowing for remote exploitation. This vulnerability could enable an attacker to manipulate SQL queries, posing significant risks to data integrity and application security. The vendor was alerted about this vulnerability disclosure but has not yet responded, making it crucial for users to assess their environments and implement mitigations.",OpenCart,Shiprocket Module,6.9,MEDIUM,0.0005200000014156103
CVE-2024-41570,CVE-2024-41570-SSRF-RCE,Havoc SSRF to RCE,https://github.com/HimmeL-Byte/CVE-2024-41570-SSRF-RCE,github,4,2025-01-19T23:48:41.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-41570,Arbitrary Network Traffic Execution via SSRF in Havoc 2.0.7,"An unauthenticated server-side request forgery (SSRF) vulnerability in the demon callback handling of Havoc 2 0.7 allows attackers to exploit the system by sending arbitrary network traffic originating from the team server. This flaw enables attackers to make requests from the server to any internal or external network service, posing a serious security risk for organizations utilizing Havoc. Attackers can potentially access sensitive information or further exploit other weaknesses in the network by leveraging this SSRF vulnerability.",Havoc 2,Havoc,9.8,CRITICAL,0.0010600000387057662
CVE-2025-0566,CVE-2025-0566 - Proof of Concept,,https://pan.baidu.com/s/1DBDf27oCTIMkW-PSZwg02Q?pwd=tara,refferences,,2025-01-19T06:31:12.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0566,Stack-based Buffer Overflow in Tenda AC15 Router,"The Tenda AC15 router suffers from a stack-based buffer overflow vulnerability in the formSetDevNetName function found in the /goform/SetDevNetName file. This flaw arises from improper handling of the 'mac' argument, allowing attackers to exploit the vulnerability remotely. Once publicly disclosed, this potential exploit poses significant risks for users, enabling unauthorized access and control over affected devices. It is crucial for users to update their devices to mitigate the risks associated with this vulnerability.",Tenda,Ac15,8.7,HIGH,0.0011399999493733048
CVE-2025-0565,CVE-2025-0565 - Proof of Concept,,https://github.com/En0t5/vul/blob/main/zzcms/zzcsm-sql-inject.md,refferences,,2025-01-19T06:00:18.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0565,SQL Injection Vulnerability in ZZCMS 2023,"A SQL injection vulnerability exists in the ZZCMS 2023 product, specifically within the /index.php file. This weakness arises from improper validation of the 'id' argument, allowing attackers to manipulate SQL queries and potentially gain unauthorized access to sensitive data. Exploitation can be performed remotely, increasing the risk for users. The exploit details have been made public, emphasizing the need for immediate attention to safeguard affected systems.",ZZCMS,Zzcms,6.9,MEDIUM,0.0005200000014156103
CVE-2025-0564,CVE-2025-0564 - Proof of Concept,,https://github.com/LiuSir5211314/-sir/issues/3,refferences,,2025-01-19T03:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0564,SQL Injection Vulnerability in Fantasy-Cricket by Code-Projects,"A vulnerability exists in the Fantasy-Cricket application, specifically in the /authenticate.php file. This flaw allows attackers to manipulate the 'uname' parameter, leading to SQL injection attacks. The nature of this vulnerability enables remote exploitation, exposing the application to significant risks. Given the public disclosure of this exploit, it is crucial for users to be aware and mitigate potential threats to their deployments of Fantasy-Cricket.",Code-projects,Fantasy-cricket,6.9,MEDIUM,0.0005200000014156103
CVE-2024-13375,CVE-2024-13375,CVE-2024-13375 Unverified Password Change,https://github.com/McTavishSue/CVE-2024-13375,github,2,2025-01-18T19:35:47.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13375,Privilege Escalation Vulnerability in Adifier System Plugin for WordPress,"The Adifier System plugin for WordPress has a vulnerability that allows for privilege escalation through account takeover. This issue arises from the plugin's failure to properly authenticate users prior to permitting updates to sensitive account details, including passwords. As a result, malicious actors can exploit this flaw to alter the credentials of any user, including those with administrative privileges, thereby gaining unauthorized access. It is crucial for users of this plugin to ensure they are running the latest version and implement proper security measures to mitigate this risk.",Spoonthemes,Adifier System,9.8,CRITICAL,0.000910000002477318
CVE-2025-0560,CVE-2025-0560 - Proof of Concept,,https://github.com/KhukuriRimal/Vulnerabilities/blob/main/CampCodes%20-%20School%20Management%20Software%20-%20Stored%20Cross%20Site%20Scripting.pdf,refferences,,2025-01-18T15:00:17.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0560,Cross-Site Scripting Vulnerability in CampCodes School Management Software,"A cross-site scripting vulnerability in CampCodes School Management Software version 1.0 affects the Photo Gallery Page component. The issue arises from inadequate input validation in the '/photo-gallery' function, allowing attackers to manipulate the argument 'Description'. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser. Remote exploitation is possible, and the vulnerability has been publicly disclosed, raising significant security concerns for users of the affected software.",Campcodes,School Management Software,5.1,MEDIUM,0.0006799999973736703
CVE-2025-0559,CVE-2025-0559 - Proof of Concept,,https://github.com/KhukuriRimal/Vulnerabilities/blob/main/CampCodes%20-%20School%20Management%20Software%20-%20Cross%20Site%20Scripting.pdf,refferences,,2025-01-18T14:00:17.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0559,Cross Site Scripting in Campcodes School Management Software,"A vulnerability has been discovered in Campcodes School Management Software, specifically within the Create Id Card Page component found at the /create-id-card path. This flaw allows for the manipulation of the ID Card Title argument, leading to a cross site scripting (XSS) attack. Attackers may exploit this flaw remotely, potentially compromising user data and application integrity. The details of the exploit have been made public, raising concerns about the security implications for users of the affected software.",Campcodes,School Management Software,5.1,MEDIUM,0.0006799999973736703
CVE-2025-0558,CVE-2025-0558 - Proof of Concept,,https://github.com/ggg48966/123123/blob/main/TDuckCloud.md,refferences,,2025-01-18T13:00:08.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0558,SQL Injection Vulnerability in TDuckCloud tduck-platform,"A vulnerability has been identified in the TDuckCloud tduck-platform which allows attackers to perform SQL injection through the QueryProThemeRequest function. This flaw arises from improper manipulation of the color argument found in the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java. Remote attackers can exploit this vulnerability to execute unauthorized SQL commands, potentially compromising database security and application integrity. The flaw has been publicly disclosed, with the vendor being notified but not responding to the concerns raised.",Tduckcloud,Tduck-platform,5.3,MEDIUM,0.0007900000200606883
CVE-2024-9020,CVE-2024-9020 - Proof of Concept,,https://wpscan.com/vulnerability/6caa4e5d-8112-4d00-8e97-b41df611a071/,refferences,,2025-01-18T06:00:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-9020,Stored Cross-Site Scripting Vulnerability in List Category Posts Plugin for WordPress,"The List Category Posts Plugin for WordPress, prior to version 0.90.3, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises because the plugin fails to properly validate and escape certain shortcode attributes when rendering pages or posts that incorporate these shortcodes. As a result, users with contributor roles or higher could exploit this flaw, executing arbitrary JavaScript code when other users view the affected content. Such attacks can lead to unauthorized actions on behalf of users or disclosure of sensitive information, underscoring the importance of updating to a secured version of the plugin.",WordPress,List Category Posts,,,0.0004299999854993075
CVE-2024-57727,CVE-2024-57727,CVE-2024-57727,https://github.com/imjdl/CVE-2024-57727,github,0,2025-01-18T00:45:51.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-57727,Path Traversal Vulnerabilities in SimpleHelp Remote Support Software,"The SimpleHelp Remote Support Software version 5.5.7 and earlier is susceptible to multiple path traversal vulnerabilities. These vulnerabilities allow unauthenticated remote attackers to exploit the system by crafting specific HTTP requests. Through this exploitation, attackers can download arbitrary files from the host server, potentially exposing sensitive data such as server configuration files, secrets, and hashed user passwords. This vulnerability highlights the critical need for timely updates and robust security measures to protect sensitive information from unauthorized access.",SimpleHelp,SimpleHelp Remote Support Software,7.5,HIGH,0.0008999999845400453
CVE-2022-34169,CVE-2022-34169,"A PoC for CVE-2022-34169, for the SU_PWN challenge from SUCTF 2025",https://github.com/Disnaming/CVE-2022-34169,github,0,2025-01-18T00:32:37.000Z,https://securityvulnerability.io/vulnerability/CVE-2022-34169,Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets,The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.,Apache,Apache Xalan-j,7.5,HIGH,0.0038499999791383743
CVE-2025-0541,CVE-2025-0541 - Proof of Concept,,https://github.com/nbeisss/CVE/issues/1,refferences,,2025-01-17T21:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0541,SQL Injection Vulnerability in Codezips Gym Management System by Codezips,"A SQL injection vulnerability exists in the Codezips Gym Management System 1.0, specifically affecting the /dashboard/admin/edit_member.php file. This flaw allows attackers to manipulate the 'name' argument, potentially leading to unauthorized database access. Exploitation can occur remotely, and while the primary vector is known, other parameters may also be susceptible, increasing the risk of broader attacks. Immediate actions are recommended to mitigate this risk.",Codezips,Gym Management System,5.3,MEDIUM,0.0007900000200606883
CVE-2024-43468,CVE-2024-43468_mTLS_go,CVE-2024-43468 SCCM SQL Injection Exploit (mTLS version),https://github.com/nikallass/CVE-2024-43468_mTLS_go,github,0,2025-01-17T21:20:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-43468,Remote Code Execution Vulnerability Affects Microsoft Configuration Manager,"The vulnerability in Microsoft Configuration Manager allows remote code execution, potentially enabling attackers to gain control over affected systems. This security flaw can be exploited if an attacker sends a specially crafted request to the vulnerable application, leading to unauthorized execution of malicious code. Organizations using impacted versions of Microsoft Configuration Manager should prioritize applying available updates to mitigate risks associated with this vulnerability.",Microsoft,Microsoft Configuration Manager,9.8,CRITICAL,0.0005200000014156103
CVE-2025-0540,CVE-2025-0540 - Proof of Concept,,https://github.com/magic2353112890/cve/issues/1,refferences,,2025-01-17T21:00:17.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0540,SQL Injection Vulnerability in itsourcecode Tailoring Management System 1.0,"A vulnerability exists within the itsourcecode Tailoring Management System 1.0, specifically in the expadd.php file. This flaw is due to insufficient validation of the 'expcat' argument, which allows for SQL injection attacks. As a result, attackers can manipulate the query structure, potentially exposing sensitive data and compromising database integrity. The attack can be executed remotely, raising concerns about the security of installations utilizing this software. Public disclosure of the exploit has heightened the urgency for users to take immediate protective measures.",Itsourcecode,Tailoring Management System,5.3,MEDIUM,0.0007900000200606883
CVE-2025-0538,CVE-2025-0538 - Proof of Concept,,https://github.com/aaryan-11-x/My-CVEs/blob/main/CVE-2025-0538.md,refferences,,2025-01-17T20:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0538,Cross-Site Scripting Vulnerability in Code-Projects Tourism Management System 1.0,"A Cross-Site Scripting (XSS) vulnerability has been identified in the Tourism Management System version 1.0, specifically within the /admin/manage-pages.php file. This vulnerability arises from improper handling of the 'pgedetails' argument, which allows attackers to inject malicious scripts. Successfully exploiting this flaw not only jeopardizes the security of the application but also could enable unauthorized users to execute arbitrary code remotely. The vulnerability is publicly disclosed, making it imperative for users to apply appropriate security patches to mitigate the risk.",Code-projects,Tourism Management System,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0538,CVE-2025-0538 - Proof of Concept,,https://github.com/aaryan-11-x/My-CVEs/blob/main/Stored%20XSS%20-%20Code-Projects%20Tourism%20Management%20System%201.0.md,refferences,,2025-01-17T20:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0538,Cross-Site Scripting Vulnerability in Code-Projects Tourism Management System 1.0,"A Cross-Site Scripting (XSS) vulnerability has been identified in the Tourism Management System version 1.0, specifically within the /admin/manage-pages.php file. This vulnerability arises from improper handling of the 'pgedetails' argument, which allows attackers to inject malicious scripts. Successfully exploiting this flaw not only jeopardizes the security of the application but also could enable unauthorized users to execute arbitrary code remotely. The vulnerability is publicly disclosed, making it imperative for users to apply appropriate security patches to mitigate the risk.",Code-projects,Tourism Management System,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0537,CVE-2025-0537 - Proof of Concept,,https://github.com/aaryan-11-x/My-CVEs/blob/main/CVE-2025-0537.md,refferences,,2025-01-17T20:00:10.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0537,Cross-Site Scripting Vulnerability in Code-Projects Car Rental Management System,"A vulnerability has been discovered in the Car Rental Management System version 1.0 developed by code-projects. Specifically, this issue resides in the file /admin/manage-pages.php, where improper handling of the 'pgdetails' argument allows for cross-site scripting (XSS) attacks. When exploited, this vulnerability enables attackers to execute malicious scripts in the context of a user's session. The flaw can be triggered remotely, potentially affecting numerous users. This issue has been disclosed publicly, showcasing the need for immediate attention and mitigation measures.",Code-projects,Car Rental Management System,5.1,MEDIUM,0.00044999999227002263
CVE-2025-0537,CVE-2025-0537 - Proof of Concept,,https://github.com/aaryan-11-x/My-CVEs/blob/main/Stored%20XSS%20-%20Code-Projects%20Online%20Car%20Rental%20System%201.0.md,refferences,,2025-01-17T20:00:10.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0537,Cross-Site Scripting Vulnerability in Code-Projects Car Rental Management System,"A vulnerability has been discovered in the Car Rental Management System version 1.0 developed by code-projects. Specifically, this issue resides in the file /admin/manage-pages.php, where improper handling of the 'pgdetails' argument allows for cross-site scripting (XSS) attacks. When exploited, this vulnerability enables attackers to execute malicious scripts in the context of a user's session. The flaw can be triggered remotely, potentially affecting numerous users. This issue has been disclosed publicly, showcasing the need for immediate attention and mitigation measures.",Code-projects,Car Rental Management System,5.1,MEDIUM,0.00044999999227002263
CVE-2025-0536,CVE-2025-0536 - Proof of Concept,,https://github.com/lan041221/cve/blob/main/Attendance_Tracking_Management_System_SQL_Injection.md,refferences,,2025-01-17T19:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0536,SQL Injection Vulnerability in Attendance Tracking Management System by 1000 Projects,"A vulnerability has been identified in the Attendance Tracking Management System, specifically within the /admin/edit_action.php file. This flaw allows for SQL injection through the manipulation of the attendance_id parameter. Attackers can exploit this vulnerability remotely, potentially compromising the system's database and exposing sensitive information. The issue has been publicly disclosed, making it imperative for users to address this risk to safeguard their systems.",1000 Projects,Attendance Tracking Management System,5.3,MEDIUM,0.0007900000200606883
CVE-2025-0535,CVE-2025-0535 - Proof of Concept,,https://github.com/lan041221/cve/blob/main/SQL_Injection_in_Gym_Management_System.md,refferences,,2025-01-17T19:00:16.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0535,SQL Injection Vulnerability in Codezips Gym Management System,"A vulnerability has been identified within the Codezips Gym Management System version 1.0, specifically impacting the file /dashboard/admin/edit_mem_submit.php. The issue arises from improper handling of the uid parameter, which can lead to SQL injection attacks. Malicious actors can exploit this vulnerability remotely, allowing unauthorized access to the database underlying the system. Given the public disclosure of the exploit, it is crucial for users of this software to implement immediate security measures to safeguard their databases from potential threats.",Codezips,Gym Management System,5.3,MEDIUM,0.0007900000200606883
CVE-2025-0534,CVE-2025-0534 - Proof of Concept,,https://github.com/onupset/CVE/issues/3,refferences,,2025-01-17T18:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0534,SQL Injection Vulnerability in 1000 Projects Campaign Management System for Women,"A SQL injection vulnerability has been identified in the 1000 Projects Campaign Management System Platform for Women version 1.0, specifically within the login functionality of the file /Code/loginnew.php. The flaw allows for manipulation of the Username argument, enabling attackers to execute arbitrary SQL commands and potentially gain unauthorized access to the underlying database. This security issue can be exploited remotely, highlighting the need for immediate patching and robust security practices to protect user data and system integrity.",1000 Projects,Campaign Management System Platform For Women,6.9,MEDIUM,0.00044999999227002263
CVE-2025-0533,CVE-2025-0533 - Proof of Concept,,https://github.com/onupset/CVE/issues/2,refferences,,2025-01-17T18:00:16.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0533,SQL Injection Vulnerability in 1000 Projects Campaign Management System Platform for Women,"A vulnerability exists in the 1000 Projects Campaign Management System Platform for Women 1.0, specifically in the file /Code/sc_login.php. An attacker can exploit this vulnerability through the manipulation of the 'uname' argument, allowing for SQL injection attacks that can be executed remotely. This flaw has been publicly disclosed, emphasizing the urgent need for implementation of security measures to mitigate potential exploitation.",1000 Projects,Campaign Management System Platform For Women,6.9,MEDIUM,0.00044999999227002263
CVE-2025-0532,CVE-2025-0532 - Proof of Concept,,https://github.com/TIANN0/CVE/issues/1,refferences,,2025-01-17T17:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0532,SQL Injection Vulnerability in Codezips Gym Management System by Codezips,"A vulnerability in the Codezips Gym Management System, specifically within the /dashboard/admin/new_submit.php file, allows for SQL injection through improper handling of the m_id argument. This flaw can be exploited remotely by attackers, potentially compromising the integrity and confidentiality of the database. Given its exposure and the public disclosure of the exploit, it is critical for users of this software to implement security measures to mitigate this risk.",Codezips,Gym Management System,5.3,MEDIUM,0.0007900000200606883
CVE-2025-0531,CVE-2025-0531 - Proof of Concept,,https://github.com/LamentXU123/cve/blob/main/sql_injection2.md,refferences,,2025-01-17T16:00:19.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0531,SQL Injection Vulnerability in Code-Projects Chat System by Code-Projects,"A SQL injection vulnerability exists in the Code-Projects Chat System 1.0, specifically in the user input processing of /user/leaveroom.php. By manipulating the 'id' parameter, an attacker can execute unauthorized SQL queries, potentially compromising the underlying database. This vulnerability can be remotely exploited, making it critical for users of this system to apply immediate countermeasures to protect their data integrity and security.",Code-projects,Chat System,5.3,MEDIUM,0.0007900000200606883
CVE-2025-0530,CVE-2025-0530 - Proof of Concept,,https://github.com/ha0day125/cve/blob/main/xss-ha0day.md,refferences,,2025-01-17T15:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0530,Cross-Site Scripting Vulnerability in Job Recruitment by Code-Projects,"A cross-site scripting vulnerability exists in the Job Recruitment 1.0 application by Code-Projects, specifically in the handling of user input in the file /_parse/_feedback_system.php. This issue allows remote attackers to inject malicious scripts, potentially compromising user data and performing unauthorized actions. It is crucial for users of Job Recruitment 1.0 to address this vulnerability promptly to safeguard their applications from exploitation.",Code-projects,Job Recruitment,5.3,MEDIUM,0.0006799999973736703
CVE-2025-0529,CVE-2025-0529 - Proof of Concept,,https://gist.github.com/higordiego/f9943e2e6ba81a02a85dd07c742eecfc,refferences,,2025-01-17T15:00:15.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0529,Stack-based Buffer Overflow in Login Form of Train Ticket Reservation System by Code-Projects,"A stack-based buffer overflow vulnerability exists in the Train Ticket Reservation System 1.0, specifically in the Login Form component. This issue arises when the 'username' argument is manipulated by an attacker, allowing for potential exploitation. The attack must be conducted locally, thus limiting its immediate accessibility. The details of this vulnerability have been publicly disclosed, which raises concerns about its potential exploitation in real-world scenarios.",Code-projects,Train Ticket Reservation System,4.8,MEDIUM,0.00044999999227002263
CVE-2025-0528,CVE-2025-0528 - Proof of Concept,,https://github.com/Pr0b1em/IoT/blob/master/TendaAC10v16.03.10.20telnet.md,refferences,,2025-01-17T14:31:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0528,"Command Injection Vulnerability in Tenda AC8, AC10 and AC18 Routers","A command injection vulnerability exists in Tenda AC8, AC10, and AC18 routers due to improper handling of the /goform/telnet functionality by the HTTP Request Handler. This flaw allows an attacker to execute arbitrary commands on the affected devices remotely, potentially gaining unauthorized access or control. It is crucial for users to address this issue to mitigate the associated risks and protect their network security.",Tenda,"Ac8,Ac10,Ac18",8.6,HIGH,0.000699999975040555
CVE-2025-0527,CVE-2025-0527 - Proof of Concept,,https://github.com/Curious-L/-/issues/4,refferences,,2025-01-17T13:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0527,SQL Injection Vulnerability in Admission Management System by Code-Projects,"A significant SQL injection vulnerability has been identified in the Admission Management System v1.0, specifically affecting the /signupconfirm.php file. The vulnerability arises from improper handling of the 'in_eml' parameter, enabling attackers to manipulate SQL queries remotely. This exploitation can result in unauthorized access to sensitive data and potentially compromise the system's integrity. Furthermore, other parameters could also be vulnerable, presenting a wider attack surface. Organizations using the impacted version are urged to take immediate action to mitigate this risk.",Code-projects,Admission Management System,6.9,MEDIUM,0.0005200000014156103
CVE-2024-9474,CVE-2024-9474,Palo Alto RCE Vuln,https://github.com/aratane/CVE-2024-9474,github,0,2025-01-17T05:07:14.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-9474,Palo Alto Networks PAN-OS Privilege Escalation Vulnerability Affects Firewall,"A privilege escalation vulnerability exists in Palo Alto Networks PAN-OS software, allowing an administrator with access to the management web interface to execute actions on the firewall with heightened root privileges. This could potentially lead to unauthorized control and management of the firewall, exposing the organization to a range of security threats. It is important to note that cloud-based NGFW and Prisma Access solutions remain unaffected by this vulnerability.",Palo Alto Networks,"Cloud Ngfw,Pan-os,Prisma Access",7.2,HIGH,0.9749000072479248
CVE-2025-0282,CVE-2025-0282,"PoC for CVE-2025-0282: A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways",https://github.com/sfewer-r7/CVE-2025-0282,github,4,2025-01-16T23:45:53.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0282,Stack-Based Buffer Overflow in Ivanti Connect Secure and Policy Secure,"A stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways, prior to designated versions. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected systems, posing significant risks to security and data integrity. Users are advised to upgrade to the latest versions of these products to mitigate potential exploitation.",Ivanti,"Connect Secure,Policy Secure,Neurons For Zta Gateways",9,CRITICAL,0.15324999392032623
CVE-2022-31814,CVE-2022-31814,Proof of concept for CVE-2022-31814,https://github.com/Inplex-sys/CVE-2022-31814,github,0,2025-01-16T22:59:45.000Z,https://securityvulnerability.io/vulnerability/CVE-2022-31814,,pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.,Netgate,Pfblockerng,9.8,CRITICAL,0.9709699749946594
CVE-2019-5029,CVE-2019-5029,This is a Python script PoC for CVE-2019-5029,https://github.com/yZ1337/CVE-2019-5029,github,0,2025-01-16T17:34:58.000Z,https://securityvulnerability.io/vulnerability/CVE-2019-5029,,An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded by backticks or $() can be inserted into the editor and will be executed by the Exhibitor process when it launches ZooKeeper. An attacker can execute any command as the user running the Exhibitor process.,Exhibitor Project,Exhibitor,9.8,CRITICAL,0.6834400296211243
CVE-2022-40684,fortigate-belsen-leak,Research repository tracking affected IPs from the Fortigate CVE-2022-40684 configuration leak by Belsen Group,https://github.com/arsolutioner/fortigate-belsen-leak,github,12,2025-01-16T15:54:15.000Z,https://securityvulnerability.io/vulnerability/CVE-2022-40684,,"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.",Fortinet,"Fortinet FortiOS, Fortiproxy, Fortiswitchmanager",9.8,CRITICAL,0.9728000164031982
CVE-2023-25136,CVE-2023-25136,"This vulnerability is of the ""double-free"" type, which occurs during the processing of key exchange (KEX) algorithms in OpenSSH. A ""double-free"" vulnerability happens when memory that has already been freed is freed again. This issue can indirectly lead to remote code execution (RCE) by an attacker.",https://github.com/mrmtwoj/CVE-2023-25136,github,0,2025-01-16T15:07:45.000Z,https://securityvulnerability.io/vulnerability/CVE-2023-25136,,"OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states ""remote code execution is theoretically possible.""",Openssh,Openssh,6.5,MEDIUM,0.011730000376701355
CVE-2025-21385,CVE-2025-21385,The SSRF vulnerability in Microsoft Purview,https://github.com/Pauloxc6/CVE-2025-21385,github,1,2025-01-16T09:14:12.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-21385,Server-Side Request Forgery Vulnerability in Microsoft Purview,"A Server-Side Request Forgery (SSRF) vulnerability exists in Microsoft Purview, enabling an authorized attacker to exploit the application to disclose sensitive information over a network. This flaw can allow unauthorized access to internal resources, leading to potential data leakage and compromising the integrity of the system. It is crucial for organizations using Microsoft Purview to implement appropriate security measures and apply updates as they become available to mitigate the risks associated with this vulnerability.",Microsoft,Microsoft Purview,8.8,HIGH,0.0005000000237487257
CVE-2025-0282,CVE-2025-0282,Ivanti Connect Secure IFT TLS Stack Overflow pre-auth RCE (CVE-2025-0282),https://github.com/watchtowrlabs/CVE-2025-0282,github,3,2025-01-16T03:27:12.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0282,Stack-Based Buffer Overflow in Ivanti Connect Secure and Policy Secure,"A stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways, prior to designated versions. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected systems, posing significant risks to security and data integrity. Users are advised to upgrade to the latest versions of these products to mitigate potential exploitation.",Ivanti,"Connect Secure,Policy Secure,Neurons For Zta Gateways",9,CRITICAL,0.15324999392032623
CVE-2025-0492,CVE-2025-0492 - Proof of Concept,,https://tasty-foxtrot-3a8.notion.site/D-link-DIR-823X-FUN_00412244-NULL-Pointer-Dereference-1730448e619580fcb7f9d871c6e7190a,refferences,,2025-01-15T22:00:17.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0492,Null Pointer Dereference in D-Link DIR-823X,"A vulnerability exists in the D-Link DIR-823X models 240126 and 240802 due to improper handling of a function resulting in a null pointer dereference. This flaw allows remote attackers to exploit the device, potentially leading to a denial of service. Awareness of this vulnerability is crucial as it has been publicly disclosed, increasing the risk of exploitation.",D-link,Dir-823x,8.7,HIGH,0.00044999999227002263
CVE-2025-0491,CVE-2025-0491 - Proof of Concept,,https://github.com/Fanli2012/native-php-cms/issues/13#issue-2770022466,refferences,,2025-01-15T22:00:14.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0491,SQL Injection Vulnerability in Fanli2012 Native-PHP-CMS Product,"A SQL injection vulnerability exists in a specific function of the Fanli2012 native-php-cms version 1.0, located in the file /fladmin/cat_dodel.php. By manipulating the 'id' argument, attackers can execute arbitrary SQL queries against the database. This flaw allows for remote exploitation, posing significant risks including unauthorized data access and potential data corruption. The vulnerability has been publicly disclosed, which increases the urgency for affected users to implement mitigations or patches.",Fanli2012,Native-PHP-cms,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0490,CVE-2025-0490 - Proof of Concept,,https://github.com/Fanli2012/native-php-cms/issues/12#issue-2770013163,refferences,,2025-01-15T21:31:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0490,SQL Injection Vulnerability in Fanli2012 Native-PHP-CMS 1.0,"A SQL injection vulnerability exists in the Fanli2012 native-php-cms version 1.0, specifically affecting the processing of the file /fladmin/article_dodel.php. The flaw allows an attacker to manipulate the 'id' argument, enabling unauthorized database operations. This vulnerability can be exploited remotely, posing significant risks to systems utilizing this content management system.",Fanli2012,Native-PHP-cms,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0489,CVE-2025-0489 - Proof of Concept,,https://github.com/Fanli2012/native-php-cms/issues/11#issue-2769999157,refferences,,2025-01-15T21:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0489,SQL Injection Vulnerability in Fanli2012 Native-PHP-CMS,"A SQL injection vulnerability has been discovered in Fanli2012's native-php-cms version 1.0, specifically in the /fladmin/friendlink_dodel.php file. The issue arises from improper handling of the 'id' parameter, which allows attackers to manipulate SQL queries. This flaw can be exploited remotely, potentially allowing unauthorized users to execute arbitrary SQL commands within the application's database. The vulnerability has been disclosed publicly, raising concerns for users of this CMS. It is crucial for administrators to patch this vulnerability promptly to safeguard their systems from potential SQL injection attacks.",Fanli2012,Native-PHP-cms,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0488,CVE-2025-0488 - Proof of Concept,,https://github.com/Fanli2012/native-php-cms/issues/10#issue-2769983658,refferences,,2025-01-15T21:00:17.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0488,SQL Injection Vulnerability in Fanli2012 Native-PHP-CMS 1.0,"A security vulnerability has been identified in the Fanli2012 native-php-cms version 1.0, located specifically in the product_list.php file. This issue allows attackers to manipulate the 'cat' argument, potentially leading to SQL injection attacks. The vulnerability can be exploited remotely, making it particularly severe, as it exposes systems to unauthorized access and data manipulation. Public disclosure of the exploit indicates that it may already be under active exploitation. It is crucial for users of this software to apply necessary patches and updates to mitigate risks.",Fanli2012,Native-PHP-cms,5.3,MEDIUM,0.00044999999227002263
CVE-2025-0487,CVE-2025-0487 - Proof of Concept,,https://github.com/Fanli2012/native-php-cms/issues/9#issue-2769962332,refferences,,2025-01-15T20:31:06.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0487,SQL Injection Vulnerability in Fanli2012 Native-PHP-CMS 1.0,"A security flaw has been identified in Fanli2012 native-php-cms version 1.0, specifically affecting the functionality of the file /fladmin/cat_edit.php. The vulnerability stems from improper handling of the 'id' parameter, allowing for SQL injection attacks that can be executed remotely. Since details of this exploit have been made public, it poses a significant threat, making it crucial for users to implement timely security measures to prevent potential data breaches.",Fanli2012,Native-PHP-cms,5.3,MEDIUM,0.00044999999227002263