CVE-2025-48237

CVE-2025-48237 is a Stored Cross-Site Scripting (XSS) vulnerability in the Wishlist for WooCommerce plugin for WordPress, affecting versions up to 3.2.2 (and possibly earlier). The issue arises from improper input neutralization during web page generation, enabling stored XSS. CVSS v3.1 base scor...

CVE-2024-6718 PVN Auth Popup <= 1.0.0 - Contributor+ XSS via Shortcode

The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-28954

CVE-2024-28954 involves Intel graphics installers with incorrect default permissions that may allow an authenticated user to escalate privileges locally. Affected software spans Intel® 7th–10th Gen Windows Graphics drivers, Intel® Arc™ & Iris® Xe Windows drivers, and the Intel® Data Center GPU Fl...

CVE-2025-4535

creationtimestamp| type| source ---|---|--- 2025-05-11 08:27:49+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15924 2025-05-11 08:37:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lov2hgcj6g2o 2025-05-11 10:13:33+00:00| seen|...

CVE-2025-37864

In the Linux kernel, the following vulnerability has been resolved: net: dsa: clean up FDB, MDB, VLAN entries on unbind As explained in many places such as commit b117e1e8a86d "net: dsa: delete dsalegacyfdbadd and dsalegacyfdbdel", DSA is written given the assumption that higher layers have...

CVE-2025-4441

creationtimestamp| type| source ---|---|--- 2025-05-08 23:24:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15640 2025-05-08 23:28:17+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lop2slhdho42 2025-05-09...

CVE-2025-33093

creationtimestamp| type| source ---|---|--- 2025-05-07 11:22:08+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15290 2025-05-07 12:21:47+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114466521491649706 2025-05-07 12:26:34+00:00| seen|...

CVE-2025-20954

Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...

CVE-2025-26262

creationtimestamp| type| source ---|---|--- 2025-05-06 18:21:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lojis5wt6a2h 2025-05-06 20:20:18+00:00| seen| https://t.me/cvedetector/24626...

CVE-2024-58134

Mojolicious versions from 0.999922 through 9.40 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be exploited to forge session cookies. An attacker who knows or guesses the secret could compute valid HMA...

CVE-2025-4262

creationtimestamp| type| source ---|---|--- 2025-05-05 04:18:40+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14832 2025-05-05 06:16:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lofprjedkj2w 2025-05-05 07:30:45+00:00| exploited|...

CVE-2023-53039

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtpdev. If ishprobe...

CVE-2022-49848

In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp-combo: fix NULL-deref on runtime resume Commit fc64623637da "phy: qcom-qmp-combo,usb: add support for separate PCSUSB region" started treating the PCSUSB registers as potentially separate from the PCS registers but...

CVE-2025-4131

creationtimestamp| type| source ---|---|--- 2025-05-02 06:07:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo65rumphs2h 2025-05-02 07:34:52+00:00| seen| https://t.me/cvedetector/24325 2025-05-02 17:16:45+00:00| published-proof-of-concept|...

CVE-2024-9771

creationtimestamp| type| source ---|---|--- 2025-04-28 09:40:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnuhxi3rc62h 2025-04-28 09:52:50+00:00| seen| https://t.me/cvedetector/23886 2025-04-28 17:10:38+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13707...

CVE-2025-3973

creationtimestamp| type| source ---|---|--- 2025-04-27 15:11:00+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13622 2025-04-27 15:34:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnslbpylhh2u 2025-04-27 17:01:02+00:00| published-proof-of-concept|...

CVE-2025-32986

creationtimestamp| type| source ---|---|--- 2025-04-25 21:08:10+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13532 2025-04-25 23:20:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnoedg2hzl2b 2025-04-26 01:52:34+00:00| seen| https://t.me/cvedetector/23787 2025-04-28...

CVE-2025-43859

creationtimestamp| type| source ---|---|--- 2025-04-24 19:09:03+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114394512917622666 2025-04-24 21:48:32+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114395140063306383 2025-04-24 22:24:48+00:00| seen|...

CVE-2025-3840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

CVE-2025-3818

A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB.processinsertquery of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been...