CVE-2026-10652 Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)

Zephyr's DNS resolver subsys/net/lib/dns parses resource records from DNS responses in dnsunpackanswer, which validated only the fixed RR header type, class, TTL, rdlength and accepted any attacker-declared rdlength, including one extending past the end of the received datagram. The TXT and SRV...

CVE-2025-10652

creationtimestamp| type| source ---|---|--- 2025-09-20 03:23:34+00:00| seen| https://bsky.app/profile/potato.software/post/3lzagibbegs2j 2025-09-20 04:02:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lzaio7bueh2c...

WordPress Robcore Netatmo plugin <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode vulnerability

Authenticated Contributor+ SQL Injection via robcore-netatmo Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Robcore Netatmo versions = 1.7...

CVE-2019-10652

An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature...

CVE-2019-10652

creationtimestamp| type| source ---|---|--- 2025-04-11 21:02:18+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lmkw4beyob2x...

📄 flatCore 1.5.5 Shell Upload

flatCore version 1.5.5 suffers from a remote shell upload vulnerability. Exploit Title: flatCore Arbitrary .php File Upload via acp/acp.php Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/flatCore/flatCore-CMS Software Link: https://github.com/flatCore/flatCore-CMS...

CVE-2024-10652

creationtimestamp| type| source ---|---|--- 2024-11-01 12:10:17+00:00| seen| https://t.me/cvedetector/9573...

CVE-2024-10652 CHANGING Information Technology IDExpert - Reflected XSS

IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to inject JavsScript code and perform Reflected Cross-site scripting attacks...

CVE-2024-10652 CHANGING Information Technology IDExpert - Reflected XSS

IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to inject JavsScript code and perform Reflected Cross-site scripting attacks...

CVE-2019-10652

An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature...

CVE-2019-10652

FlatCore vulnerable component: acp/acp.php in version 1.4.7. The issue allows remote authenticated administrators to upload arbitrary PHP files via the addons/upload mechanism, enabling potential remote code execution as indicated by described exploit activity in multiple sources (e.g., exploit-d...

CVE-2017-10652

...

CVE-2017-10652

CVE-2017-10652 is rejected/not used as it has no associated vulnerability.

CVE-2016-10652

prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks...

CVE-2018-10652

There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3...

CVE-2018-10652

CVE-2018-10652 affects Citrix XenMobile Server 10.7 before RP3, causing Sensitive Data Leakage. The issue is a network-exploitable vulnerability with potential partial confidentiality impact per CVSS vector data. Citrix states that this and other issues have been addressed in newer builds, recomm...