19111 matches found
CVE-2025-13271: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in Campcodes School Fees Payment Management System 1.0. This impacts an unknown function of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...
Linux CIFS SMB Collapse Range
The vulnerability of the smb3collapserange function in the fs/cifs/smb2ops.c module of the Linux operating system is related to the incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protect...
Linux smc_core Heap Buffer Overflow DoS
The vulnerability of the smcrlinkinit function in the net/smc/smccore.c module of the Linux kernel is related to the incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability could allow an attacker to cause a service failure...
EUVD-2025-197688
The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the cgcheckwpadminuploadv10 AJAX action for both authenticated and unauthenticated users without implementing capability checks or non...
CVES
CVES Collections of CVES I have obtained CVE-2026-39070: W...
PT-2025-47017
Name of the Vulnerable Software and Affected Versions IPCop versions up to and including 2.1.9 Description IPCop versions up to and including 2.1.9 have an issue allowing authenticated remote code execution within the web-based administration interface. The email configuration component inserts...
EUVD-2025-175368
Dell Alienware Command Center 6.x AWCC, versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution...
CVE-2025-46367
Dell Alienware Command Center 6.x AWCC, versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution...
CVE-2025-40145
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devmaddactionorreset failure When devmaddactionorreset fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup. Replace the "goto errregulatorfree" by the actu...
1 million victims, 17,500 fake sites: Google takes on toll-fee scammers
A Phishing-as-a-Service PhaaS platform based in China, known as “Lighthouse,” is the subject of a new Google lawsuit. Lighthouse enables smishing SMS phishing campaigns, and if you’re in the US there is a good chance you've seen their texts about a small amount you supposedly owe in toll fees...
EUVD-2025-150409
The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uscesexport' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials ex...
CVE-2025-12979
CVE-2025-12979 describes an unauthorized data exposure vulnerability in the WordPress plug‑in Welcart e-Commerce . A missing capability check on the usces_export action affects all versions up to and including 2.11.24 , allowing unauthenticated attackers to access sensitive data such as configure...
SUSE CVE-2025-40145
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Fix double cleanup on devmaddactionorreset failure When devmaddactionorreset fails, it calls the passed cleanup function. Hence the caller must not repeat that cleanup. Replace the "goto errregulatorfree" by the actu...
Phantom Menace: Exploring and Enhancing the Robustness of VLA Models against Physical Sensor Attacks
Vision-Language-Action VLA models revolutionize robotic systems by enabling end-to-end perception-to-action pipelines that integrate multiple sensory modalities, such as visual signals processed by cameras and auditory signals captured by microphones. This multi-modality integration allows VLA...
PT-2025-46896
Dell Alienware Command Center 6.x AWCC, versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution...
CVE-2025-46367: Detection of Error Condition Without Action
Dell Alienware Command Center 6.x AWCC, versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution...
MAL-2025-183033 Malicious code in itale-dci-rsut (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f59037123ba81021da96e44f6141e4b275f3c9a42d850dcd46dadacc05709677 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-13057
A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=savestudent. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and...
CVE-2025-61829
Illustrator on iPad versions 3.0.9 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
Malicious code in ita-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11cadd5e9eaebbb3c8a6ecd80cdc766d064fc641b1e81e54583edfbafb9a7b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...