VulnCheck KEV: CVE-2025-34034

A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default and hardcoded user accounts that are not disclosed in public documentation. These accounts allow unauthenticated or low-privilege...

PT-2025-26515 · Unknown · Phpgurukul Art Gallery Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Art Gallery Management System version 1.1 Description: A critical issue affects some unknown functionality of the file /admin/changeimage.php. The manipulation of the editid argument leads to SQL injection. The attack can be launch...

CVE-2025-4102

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level...

Telpo MDM Information Disclosure

The vulnerability of the Telpo MDM mobile device management platform lies in the ability to disclose information through registration files. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to the system with administrative privileges and compromise the...

CVE-2025-4661

A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain access to files outside the intended directory potentially leading to the disclosure of sensitive information. Note: Admin level privilege is required on the switch in order to exploit...

CVE-2025-4661 Path transversal vulnerability potentially leading to sensitive information disclosure

A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain access to files outside the intended directory potentially leading to the disclosure of sensitive information. Note: Admin level privilege is required on the switch in order to exploit...

Exploit for SQL Injection in Vishalmathur Cloudclassroom-Php_Project

🛡️ CVE Disclosure: CVE-2025-26198 — SQL Injection in CloudClas...

CVE-2025-49216

An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations...

CVE-2025-49216

An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations...

CVE-2025-49216

The CVE-2025-49216 entry relates to Trend Micro Endpoint Encryption PolicyServer. The connected ZDI advisory (ZDI-25-373) states an authentication bypass exists in the DbAppDomain service, enabling remote attackers to bypass authentication and act with admin-level access to modify product configu...

CVE-2025-49216

An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations...

freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

CVE-2025-49216: Use of Obsolete Function

An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations...

PT-2025-25627

Name of the Vulnerable Software and Affected Versions Webkul QloApps version 1.6.1 Description A critical vulnerability was found in Webkul QloApps, affecting an unknown functionality of the file /admin/ajax products list.php. The manipulation of the packItself argument leads to SQL injection. Th...

Astra Linux – Vulnerability in freeipa

A privilege escalation from the host to the domain vulnerability was identified in the FreeIPA project. By default, the FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account, allowing users to create services with the same canonical name as the REALM admin...

Exploit for Code Injection in Ispconfig

---- CVE-2023-46818...

CVE-2025-6012 Auto Attachments <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Auto Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission...

CVE-2025-5939 Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

PT-2025-26624 · Packagist · Ibexa/Admin-Ui

Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor...