安全史上的今天（2025-10-11）安全事件列表。
【中文导读】modem 存在拒绝服务、输入验证风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
【中文导读】modem 存在输入验证风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed.
【中文导读】该 CVE 涉及SQL 注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
【中文导读】WP Freeio 存在权限提升风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
【中文导读】office service 存在内存破坏、释放后使用风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.
【中文导读】package management module 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability.
【中文导读】storage management module 存在内存破坏、释放后使用风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability.
【中文导读】Ovatheme Events Manager 存在远程代码执行、任意文件上传风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
【中文导读】该 CVE 涉及SQL 注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability was determined in code-projects E-Commerce Website 1.0. The affected element is an unknown function of the file /pages/delete_order_details.php. Executing manipulation of the argument order_id can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
【中文导读】WooCommerce Designer Pro 存在远程代码执行风险（严重风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to delete all files in an arbitrary directory on the server, which can lead to remote code execution, data loss, or site unavailability.
【中文导读】GSheetConnector For Gravity Forms 存在远程代码执行、访问控制风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a missing capability check on the 'install_plugin' function. This makes it possible for authenticated attackers, with subscriber-level access and above to install plugins on the target site and potentially achieve arbitrary code execution on the server under certain conditions.
【中文导读】该 CVE 涉及SQL 注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A weakness has been identified in Campcodes Online Apartment Visitor Management System 1.0. This impacts an unknown function of the file /forgot-password.php. This manipulation of the argument email causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
【中文导读】该 CVE 涉及SQL 注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability was detected in SourceCodester Online Student Result System 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
【中文导读】该 CVE 涉及SQL 注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A security vulnerability has been detected in code-projects E-Banking System 1.0. This affects an unknown function of the file /register.php of the component POST Parameter Handler. The manipulation of the argument username/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
【中文导读】该 CVE 涉及SQL 注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/edit-appointment.php. Such manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
【中文导读】该 CVE 涉及SQL 注入（高危风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Performing manipulation of the argument ServiceId results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.