The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low entropy allows an attacker to perform a brute-force attack against one component of the rolling code. Successful exploitation simplify an attacker to predict the next valid rolling code, granting unauthorized access to the vehicle.
The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors.
The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can capture the random number and counters transmitted in cleartext, which is sensitive information required for authentication.
CVE-2025-12063 is an authorization bypass vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It allows a non-admin user to modify or remove certain data objects without proper permissions due to an insecure direct object reference (CWE-639). The vulnerability requires low privileges and no user interaction but can only be exploited remotely with adjacent network access. While it does not impact confidentiality or availability, it can cause integrity loss by unauthorized modification of data. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using AXIS Camera Station Pro version 6 should be cautious, especially those with extensive physical security deployments. Mitigation involves strict access control reviews, network segmentation, and monitoring for suspicious activities. Countries with high adoption of Axis products and critical infrastructure reliance on video surveillance, such as Germany, France, and the UK, are most likely affected. The CVSS score is 5.7, indicating a medium severity level.
CVE-2025-12757 is a medium-severity path traversal vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It allows a non-admin user with limited privileges to access information beyond their authorization by exploiting improper pathname restrictions. The vulnerability does not require user interaction and has a CVSS score of 4.6, indicating limited confidentiality and integrity impact without affecting availability. No known exploits are currently in the wild. European organizations using AXIS Camera Station Pro, especially in critical infrastructure and surveillance sectors, should prioritize patching or applying mitigations to prevent unauthorized data exposure. Countries with high adoption of Axis products and strategic security interests are at greater risk. Mitigations include strict access control reviews, network segmentation, and monitoring for unusual file access patterns.
CVE-2025-13064 is a medium severity vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It involves a server-side injection caused by an uncaught exception (CWE-248) that allows a malicious administrator, using a tampered client, to inject and execute malicious scripts on the server. The vulnerability requires high privileges (admin access) and no user interaction. Exploitation impacts availability but not confidentiality or integrity, and no known exploits are currently in the wild. The attack vector is remote and requires an authenticated attacker using a compromised client. European organizations using AXIS Camera Station Pro for video surveillance could face service disruptions if exploited. Mitigation involves ensuring client integrity, restricting admin client usage, and monitoring for anomalous server behavior. Countries with high adoption of Axis surveillance products and critical infrastructure reliance on video monitoring, such as Germany, France, the UK, and the Netherlands, are most likely affected. Given the limited impact scope and exploitation complexity, the severity is medium.
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Karel Electronics Industry and Trade Inc. ViPort allows Stored XSS.
This issue affects ViPort: through 23012026.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. DIGITA Efficiency Management System allows SQL Injection.
This issue affects DIGITA Efficiency Management System: through 03022026.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.
HTML injection vulnerability in NICE Chat. This vulnerability allows an attacker to inject and render arbitrary HTML content in email transcripts by modifying the 'firstName' and 'lastName' parameters during a chat session. The injected HTML is included in the body of the email sent by the system, which could enable phishing attacks, impersonation, or credential theft.
The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1.
An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server.
This issue affects MagicINFO 9 Server: less than 21.1090.1.
A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover
This issue affects MagicINFO 9 Server: less than 21.1090.1.
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.
The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs.
CVE-2026-1361 is a high-severity stack-based buffer overflow vulnerability in Delta Electronics' ASDA-Soft software. It allows a local attacker with limited privileges to execute arbitrary code or cause denial of service by triggering a buffer overflow. Exploitation requires user interaction but no prior authentication. The vulnerability affects confidentiality, integrity, and availability, with a CVSS score of 7.8. No patches have been released yet, and no known exploits are in the wild. European organizations using ASDA-Soft in industrial automation and manufacturing sectors are particularly at risk. Mitigation currently involves restricting local access and monitoring for suspicious activity until a vendor patch is available.
The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Missing Authorization vulnerability in Harmonic Design HD Quiz hd-quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz: from n/a through <= 2.0.9.
