https://vulnogram.org/ Most recent CVEs assigned by ZUSO Advanced Research Team (ZUSO ART) (zuso_art). https://vulnogram.org/seaview/icons/zuso_art.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-96440 https://vulnogram.org/CVE-2026-96440 Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locat… High Tue, 29 Sep 2026 08:46:47 GMT https://vulnogram.org/CVE-2026-96431 https://vulnogram.org/CVE-2026-96431 Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file. Critical Tue, 29 Sep 2026 08:35:26 GMT https://vulnogram.org/CVE-2026-96430 https://vulnogram.org/CVE-2026-96430 Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter. High Tue, 29 Sep 2026 08:20:57 GMT https://vulnogram.org/CVE-2026-96429 https://vulnogram.org/CVE-2026-96429 SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter. Critical Network Exploitable Tue, 29 Sep 2026 08:17:00 GMT https://vulnogram.org/CVE-2026-96428 https://vulnogram.org/CVE-2026-96428 SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter. Critical Network Exploitable Tue, 29 Sep 2026 08:14:42 GMT https://vulnogram.org/CVE-2026-76159 https://vulnogram.org/CVE-2026-76159 Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preloa… High Tue, 15 Sep 2026 08:49:12 GMT https://vulnogram.org/CVE-2026-76158 https://vulnogram.org/CVE-2026-76158 External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolut… Critical Network Exploitable Fri, 21 Aug 2026 02:02:23 GMT https://vulnogram.org/CVE-2026-76157 https://vulnogram.org/CVE-2026-76157 Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory. High Network Exploitable Fri, 21 Aug 2026 01:47:44 GMT https://vulnogram.org/CVE-2026-76156 https://vulnogram.org/CVE-2026-76156 OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root. Critical Fri, 21 Aug 2026 01:44:13 GMT https://vulnogram.org/CVE-2026-76155 https://vulnogram.org/CVE-2026-76155 Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials. Critical Network Exploitable Fri, 21 Aug 2026 01:40:36 GMT https://vulnogram.org/CVE-2026-24727 https://vulnogram.org/CVE-2026-24727 An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary co… Critical Fri, 24 Jul 2026 08:29:06 GMT https://vulnogram.org/CVE-2026-24729 https://vulnogram.org/CVE-2026-24729 An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to execute arbitrary system commands via a malicious class file. Critical Network Exploitable Fri, 30 Jan 2026 03:50:31 GMT https://vulnogram.org/CVE-2026-24728 https://vulnogram.org/CVE-2026-24728 A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to access exposed administrative functionality without prior authentication. Critical Network Exploitable Fri, 30 Jan 2026 03:48:28 GMT https://vulnogram.org/CVE-2025-31342 https://vulnogram.org/CVE-2025-31342 An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands vi… Critical Mon, 20 Oct 2025 07:56:46 GMT https://vulnogram.org/CVE-2025-54946 https://vulnogram.org/CVE-2025-54946 A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands. Critical Network Exploitable Sat, 30 Aug 2025 03:58:59 GMT https://vulnogram.org/CVE-2025-54945 https://vulnogram.org/CVE-2025-54945 An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path. Critical Network Exploitable Sat, 30 Aug 2025 03:50:54 GMT https://vulnogram.org/CVE-2025-54944 https://vulnogram.org/CVE-2025-54944 An unrestricted upload of file with dangerous type vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to write malicious code in a specific file, which may lead to arbitrary code execution. Medium Network Exploitable Sat, 30 Aug 2025 03:45:58 GMT https://vulnogram.org/CVE-2025-54943 https://vulnogram.org/CVE-2025-54943 A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks. Critical Network Exploitable Sat, 30 Aug 2025 03:42:00 GMT https://vulnogram.org/CVE-2025-54942 https://vulnogram.org/CVE-2025-54942 A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deployment functionality without prior authentication. Critical Network Exploitable Sat, 30 Aug 2025 03:37:02 GMT https://vulnogram.org/CVE-2025-48784 https://vulnogram.org/CVE-2025-48784 A missing authorization vulnerability in Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to modify system settings without prior authorization. High Network Exploitable Fri, 06 Jun 2025 09:28:39 GMT https://vulnogram.org/CVE-2025-48783 https://vulnogram.org/CVE-2025-48783 An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to delete partial files by specifying arbitrary file paths. High Network Exploitable Fri, 06 Jun 2025 09:27:01 GMT https://vulnogram.org/CVE-2025-48782 https://vulnogram.org/CVE-2025-48782 An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a malicious… Critical Network Exploitable Fri, 06 Jun 2025 09:24:17 GMT https://vulnogram.org/CVE-2025-48781 https://vulnogram.org/CVE-2025-48781 An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths. High Network Exploitable Fri, 06 Jun 2025 09:21:58 GMT https://vulnogram.org/CVE-2025-48780 https://vulnogram.org/CVE-2025-48780 A deserialization of untrusted data vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a crafted serialized obj… Critical Network Exploitable Fri, 06 Jun 2025 09:19:04 GMT https://vulnogram.org/CVE-2025-5192 https://vulnogram.org/CVE-2025-5192 A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to bypass authentication and access application functions. Critical Network Exploitable Fri, 06 Jun 2025 09:15:17 GMT https://vulnogram.org/CVE-2025-31338 https://vulnogram.org/CVE-2025-31338 A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtain partial user data by accessing the API functionality. Medium Network Exploitable Thu, 17 Apr 2025 02:01:45 GMT https://vulnogram.org/CVE-2025-31339 https://vulnogram.org/CVE-2025-31339 An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote authenticated users to craft a malicious file. Medium Thu, 17 Apr 2025 02:00:47 GMT https://vulnogram.org/CVE-2025-31340 https://vulnogram.org/CVE-2025-31340 A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by runnin… Critical Network Exploitable Thu, 17 Apr 2025 01:59:56 GMT https://vulnogram.org/CVE-2024-12652 https://vulnogram.org/CVE-2024-12652 A Improper Control of Generation of Code ('Code Injection') vulnerability in groovy script function in SmartRobot′s Conversational AI Platform before v7.2.0 allows remote authenticated users to perform arbitrary system commands via Groovy code. Critical Thu, 26 Dec 2024 04:05:16 GMT https://vulnogram.org/CVE-2024-11984 https://vulnogram.org/CVE-2024-11984 A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands w… Critical Thu, 19 Dec 2024 04:01:05 GMT https://vulnogram.org/CVE-2024-52959 https://vulnogram.org/CVE-2024-52959 A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file. Critical Wed, 27 Nov 2024 05:23:11 GMT https://vulnogram.org/CVE-2024-52958 https://vulnogram.org/CVE-2024-52958 A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function. Critical Wed, 27 Nov 2024 05:22:47 GMT https://vulnogram.org/CVE-2024-43776 https://vulnogram.org/CVE-2024-43776 SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter. High Mon, 02 Sep 2024 04:04:00 GMT https://vulnogram.org/CVE-2024-43775 https://vulnogram.org/CVE-2024-43775 SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter. High Mon, 02 Sep 2024 04:03:26 GMT https://vulnogram.org/CVE-2024-43774 https://vulnogram.org/CVE-2024-43774 SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter. High Mon, 02 Sep 2024 04:02:47 GMT https://vulnogram.org/CVE-2024-43773 https://vulnogram.org/CVE-2024-43773 SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter. Critical Network Exploitable Mon, 02 Sep 2024 04:01:43 GMT https://vulnogram.org/CVE-2024-43772 https://vulnogram.org/CVE-2024-43772 SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter. Critical Network Exploitable Mon, 02 Sep 2024 04:01:03 GMT https://vulnogram.org/CVE-2024-7871 https://vulnogram.org/CVE-2024-7871 SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter. High Mon, 02 Sep 2024 04:00:24 GMT https://vulnogram.org/CVE-2024-6118 https://vulnogram.org/CVE-2024-6118 A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file. Critical Network Exploitable Mon, 05 Aug 2024 04:21:23 GMT https://vulnogram.org/CVE-2024-6117 https://vulnogram.org/CVE-2024-6117 A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file. Critical Mon, 05 Aug 2024 04:20:36 GMT https://vulnogram.org/CVE-2024-5262 https://vulnogram.org/CVE-2024-5262 Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymou… Critical Network Exploitable Wed, 05 Jun 2024 04:00:31 GMT https://vulnogram.org/CVE-2023-34210 https://vulnogram.org/CVE-2023-34210 SQL Injection in create customer group function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to execute arbitrary SQL commands via the ctl00$ContentPlaceHolder1$txtCustSQL parameter. High Tue, 17 Oct 2023 04:00:49 GMT https://vulnogram.org/CVE-2023-34209 https://vulnogram.org/CVE-2023-34209 Exposure of Sensitive System Information to an Unauthorized Control Sphere in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to obtain the absolute path via unencrypted VIEWSTATE parameter. Medium Tue, 17 Oct 2023 04:00:28 GMT https://vulnogram.org/CVE-2023-34208 https://vulnogram.org/CVE-2023-34208 Path Traversal in create template function in EasyUse MailHunter Ultimate 2023 and earlier allow remote authenticated users to extract files into arbitrary directories via a crafted ZIP archive. Medium Tue, 17 Oct 2023 04:00:05 GMT https://vulnogram.org/CVE-2023-34207 https://vulnogram.org/CVE-2023-34207 Unrestricted upload of file with dangerous type vulnerability in create template function in EasyUse MailHunter Ultimate 2023 and earlier allows remote authenticated users to perform arbitrary system commands with ‘NT Authority\SYSTEM‘ privilege via… Critical Tue, 17 Oct 2023 03:35:35 GMT https://vulnogram.org/CVE-2023-25133 https://vulnogram.org/CVE-2023-25133 Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6… Critical Mon, 24 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-25132 https://vulnogram.org/CVE-2023-25132 Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for… Critical Mon, 24 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-25131 https://vulnogram.org/CVE-2023-25131 Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel B… Critical Network Exploitable Mon, 24 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-45796 https://vulnogram.org/CVE-2022-45796 Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, an… Critical Fri, 16 Dec 2022 00:00:00 GMT