NVD disclosure day
CVE-2025-57631
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability exists in TDuckCloud's file upload module, potentially allowing unauthenticated remote attackers to execute arbitrary code. This could compromise system integrity and availability.
CVE-2025-34186
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
An external attacker can bypass authentication on Ilevia EVE X1/X5 Server to gain full system access, potentially modifying or stealing sensitive data. This matters to the business as it could lead to unauthorized access and control over critical systems.
CVE-2025-56557
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical vulnerability in the Tuya Smart Life App allows unprivileged control of Matter devices via the Matter protocol, potentially enabling unauthorized actions or access. Organizations using this app may face risks related to the integrity and availability of connected smart home devices.
CVE-2025-57119
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A privilege escalation vulnerability exists in the Online Library Management System's `adminlogin.php` component. An unauthenticated attacker could exploit this flaw to gain administrative privileges, potentially leading to unauthorized access and modification of library data if the system is network-accessible.
CVE-2025-7744
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability in Dolusoft Omaspot allows attackers to execute arbitrary SQL commands by sending crafted data. This could potentially lead to unauthorized access, modification, or deletion of sensitive information stored in the application's database. It is important to determine if this software is in u
CVE-2025-4688
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability exists in the SINAV.LINK Exam Result Module, allowing network-accessible manipulation of database queries. This could lead to unauthorized access, modification, or deletion of sensitive data. The relevance of this module within the environment needs confirmation.