2025-10-08 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2023-6215	HP, Inc. - HP Sure Start IFD Protection	A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in certain HP PC products, which might allow security bypass, arbitrary code execution, loss of integrity or confidentiality, or denial of service. HP is releasing BIOS updates to mitigate the potential vulnerability.	CVSS4.0: 7.2 - HIGH	0	Exploitation: noneAutomatable: noTechnical Impact: total	HP Sure Start IFD Protection - BIOS Security Update	github
CVE-2025-0603	Callvision Healthcare - Callvision Emergency Code	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection.This issue affects Callvision Emergency Code: before V3.0.	CVSS3.1: 9.8 - CRITICAL	0	Exploitation: noneAutomatable: yesTechnical Impact: total	SQLi in Callvision Healthcare’s Callvision Emergency Code	github
CVE-2021-22291	ABB - EIBPORT V3 KNXABB - EIBPORT V3 KNX GSM	Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This issue affects EIBPORT V3 KNX: before 3.9.2; EIBPORT V3 KNX GSM: before 3.9.2.	CVSS4.0: 8.5 - HIGH CVSS3.1: 8 - HIGH	0	Exploitation: noneAutomatable: noTechnical Impact: total	EIBPORT Reflected XSS	github
CVE-2025-11292	Belkin - F9K1015	A weakness has been identified in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/formBSSetSitesurvey. Executing manipulation of the argument wan_ipaddr can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.Es wurde eine Schwachstelle in Belkin F9K1015 1.00.10 entdeckt. Davon betroffen ist unbekannter Code der Datei /goform/formBSSetSitesurvey. Durch das Manipulieren des Arguments wan_ipaddr mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.	CVSS4.0: 5.3 - MEDIUM CVSS3.1: 6.3 - MEDIUM	0 1 2 3 4	Exploitation: pocAutomatable: noTechnical Impact: partial	Belkin F9K1015 formBSSetSitesurvey command injection	github