CVE-2025-6162 TOTOLINK EX1200T HTTP POST Request formMultiAP buffer overflow

A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer...

CVE-2025-5673

creationtimestamp| type| source ---|---|--- 2025-06-17 03:43:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrrlbvjiuy2m...

CVE-2025-4775

creationtimestamp| type| source ---|---|--- 2025-06-17 03:38:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrrl27wv6725...

CVE-2025-6152

A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modules/files/files.routes.ts. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotel...

CVE-2025-6153 PHPGurukul Hostel Management System students.php sql injection

A vulnerability has been found in PHPGurukul Hostel Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/students.php. The manipulation of the argument searchbox leads to sql injection. The attack can be initiated remotely. The exploit has...

CVE-2025-3774 Wise Chat <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header

The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2025-6151

creationtimestamp| type| source ---|---|--- 2025-06-17 01:33:05+00:00| published-proof-of-concept| Telegram/d-twWttKC0mQrQUlNsP4vonXsAmc-g0KZPifeTLb24S9Y 2025-06-17 03:31:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrrknjxezk23...

CVE-2025-45525

CVE-2025-45525 documents a NULL pointer dereference in microlight.js 0.0.7, a lightweight syntax highlighting library. When processing elements with non-standard CSS color values, the library may fail to validate the result of a regex match before accessing properties, causing an uncaught TypeErr...

CVE-2025-49176

A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check...

CVE-2025-45526

The CVE-2025-45526 entry concerns microlight v0.0.7, where the reset function in microlight.js can consume excessive memory/CPU when processing extremely large content in elements with the microlight class. This can lead to browser crashes or unresponsiveness, effectively a DoS, with exploitation...

CVE-2025-45525

A NULL pointer dereference vulnerability has been identified in the JavaScript library microlight version 0.0.7, a lightweight syntax highlighting library. When processing elements with non-standard CSS color values, the library fails to validate the result of a regular expression match before...

CVE-2025-45526

A denial of service DoS vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content e.g., 100...

CVE-2025-43200

This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed...

CVE-2025-6142 Intera InHire server-side request forgery

A vulnerability was found in Intera InHire up to 20250530. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument 29chcotoo9 leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

CVE-2025-49134 Weblate exposes personal IP address via e-mail

Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12...

CVE-2025-6137 TOTOLINK T10 HTTP POST Request cstecgi.cgi setWiFiScheduleCfg buffer overflow

A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the...

CVE-2025-6120

A vulnerability has been discovered in the Open Asset Import Library Assimp, specifically within the readmeshes functionality of the assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp file related to Half-Life 1 MDL file loading. This flaw can lead to a heap-based buffer overflow. Under specific...

CVE-2025-49796

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined...

CVE-2025-6129

CVE-2025-6129 affects TOTOLINK EX1200T (version 4.1.2cu.5232_B20210713). The HTTP POST Request Handler’s /boafrm/formSaveConfig endpoint accepts a submit-url parameter and, when manipulated, can cause a buffer overflow. This allows remote exploitation, and public disclosure is noted. Connected so...

CVE-2025-49796

creationtimestamp| type| source ---|---|--- 2025-06-16 15:39:56+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18461 2025-06-16 16:24:04+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114693966654084445 2025-06-16 16:33:33+00:00| seen|...