23593 matches found
CVE-2025-4987
CVE-2025-4987 is a stored XSS vulnerability affecting Dassault Systèmes Project Portfolio Manager’s Opportunity Management, affecting 3DEXPERIENCE R2023x–R2025x. The issue stems from a stored Cross-site Scripting flaw that enables an attacker to execute arbitrary script code in a user’s browser s...
CVE-2025-6108
creationtimestamp| type| source ---|---|--- 2025-06-16 06:20:14+00:00| seen| https://bsky.app/profile/potato.software/post/3lrpdls2p252b 2025-06-16 06:36:13+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18419 2025-06-16 07:28:51+00:00| seen|...
CVE-2025-6170
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare...
CVE-2025-6109 javahongxi whatsmars InitializrController.java initialize path traversal
A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java. The manipulati...
CVE-2025-6102
creationtimestamp| type| source ---|---|--- 2025-06-16 04:02:17+00:00| published-proof-of-concept| Telegram/IWgL-7hijIDfZWh3thMsnAy1768rz69pWolDkfnZ1T6kfIs 2025-06-16 04:04:08+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114691057117107590 2025-06-16 07:27:51+00:00| seen|...
CVE-2025-6102
A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument macaddress leads to os command injection. The attack can be launched...
CVE-2025-6100
creationtimestamp| type| source ---|---|--- 2025-06-16 01:54:51+00:00| seen| https://bsky.app/profile/potato.software/post/3lrouraxx3k2l 2025-06-16 04:36:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18413 2025-06-16 05:27:45+00:00| seen|...
CVE-2025-6096
creationtimestamp| type| source ---|---|--- 2025-06-16 01:28:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrotcbt5fn23 2025-06-16 16:35:59+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18466...
CVE-2025-6099
A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects unknown code of the file gin-blog-server/internal/manager.go of the component PATCH Request Handler. The manipulation leads to improper...
CVE-2025-33108
IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to...
CVE-2025-6098
creationtimestamp| type| source ---|---|--- 2025-06-16 01:00:49+00:00| published-proof-of-concept| Telegram/l0B5CkKBimBSyudynmcMQcODMATzVFj9ceMO-tGD96eVAY 2025-06-16 01:06:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114690359227017800 2025-06-16 03:17:39+00:00| seen|...
CVE-2025-6097 UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change
A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 leads to unverified password change. T...
CVE-2025-49795
A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service...
Fedora: Security Advisory (FEDORA-2025-4fc3431dab)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-49597
handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This...
CVE-2025-5964
CVE-2025-5964 affects M‑Files Server pre-25.6.14925.0, where a path traversal flaw in the API endpoint lets an authenticated user read server files. Public sources describe the vulnerable component as the API handling file access, with the root cause being traversal in requests to REST endpoints....
CVE-2025-49585
XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...
CVE-2025-6091 H3C GR-3000AX aspForm UpdateIpv6Params buffer overflow
A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to launch the attack...