Aggregator

Submit #638446 / VDB-325133

A vulnerability identified as problematic has been detected in LionCoders SalePro POS up to 5.5.0. This issue affects some unknown processing of the component Login. Performing manipulation results in cleartext transmission of sensitive information. This vulnerability is identified as CVE-2025-10776. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability categorized as critical has been discovered in Wavlink WL-NU516U1 240425. This vulnerability affects the function sub_4012A0 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to os command injection. This vulnerability is referenced as CVE-2025-10775. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Ruijie 6000-E10 up to 2.4.3.6-20171117. It has been rated as critical. This affects an unknown part of the file /view/vpn/autovpn/sub_commit.php. This manipulation of the argument key causes os command injection. The identification of this vulnerability is CVE-2025-10774. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #650795 / VDB-325132

A vulnerability was found in B-Link BL-AC2100 up to 1.0.3. It has been declared as critical. Affected by this issue is the function delshrpath of the file /goform/set_delshrpath_cfg of the component Web Management Interface. The manipulation of the argument Type results in stack-based buffer overflow. This vulnerability was named CVE-2025-10773. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #650641 / VDB-325131

A vulnerability was found in huggingface LeRobot up to 0.3.3. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the file lerobot/common/robot_devices/robots/lekiwi_remote.py of the component ZeroMQ Socket Handler. The manipulation leads to missing authentication. This vulnerability is uniquely identified as CVE-2025-10772. The attack can only be initiated within the local network. No exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #649968 / VDB-325130

Submit #649901 / VDB-325129

Submit #649798 / VDB-325128

A vulnerability was found in jeecgboot JimuReport up to 2.1.2 and classified as critical. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. This vulnerability is handled as CVE-2025-10771. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability has been found in jeecgboot JimuReport up to 2.1.2 and classified as critical. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the component MySQL JDBC Handler. Performing manipulation results in deserialization. This vulnerability is known as CVE-2025-10770. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability, which was classified as critical, was found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connection_url leads to deserialization. This vulnerability is traded as CVE-2025-10769. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. This vulnerability appears as CVE-2025-10768. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #649793 / VDB-325125

Submit #649778 / VDB-325127

Submit #649755 / VDB-325126

Submit #649728 / VDB-325125