CVE-2025-6102

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument macaddress leads to os command injection. The attack can be launched...

CVE-2025-6100

creationtimestamp| type| source ---|---|--- 2025-06-16 01:54:51+00:00| seen| https://bsky.app/profile/potato.software/post/3lrouraxx3k2l 2025-06-16 04:36:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18413 2025-06-16 05:27:45+00:00| seen|...

CVE-2025-6096

creationtimestamp| type| source ---|---|--- 2025-06-16 01:28:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrotcbt5fn23 2025-06-16 16:35:59+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18466...

CVE-2025-6099

A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects unknown code of the file gin-blog-server/internal/manager.go of the component PATCH Request Handler. The manipulation leads to improper...

CVE-2025-33108

IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to...

CVE-2025-6098

creationtimestamp| type| source ---|---|--- 2025-06-16 01:00:49+00:00| published-proof-of-concept| Telegram/l0B5CkKBimBSyudynmcMQcODMATzVFj9ceMO-tGD96eVAY 2025-06-16 01:06:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114690359227017800 2025-06-16 03:17:39+00:00| seen|...

CVE-2025-6097 UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change

A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 leads to unverified password change. T...

CVE-2025-49795

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service...

Fedora: Security Advisory (FEDORA-2025-4fc3431dab)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-49597

handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This...

CVE-2025-5964

CVE-2025-5964 affects M‑Files Server pre-25.6.14925.0, where a path traversal flaw in the API endpoint lets an authenticated user read server files. Public sources describe the vulnerable component as the API handling file access, with the root cause being traversal in requests to REST endpoints....

CVE-2025-49585

XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...

CVE-2025-6091 H3C GR-3000AX aspForm UpdateIpv6Params buffer overflow

A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to launch the attack...

CVE-2025-22854

Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions...

CVE-2025-21085

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization...

CVE-2025-6090

creationtimestamp| type| source ---|---|--- 2025-06-15 15:01:05+00:00| published-proof-of-concept| Telegram/TsLN5vHLIfKrKMRd5r9uUcmCPeQ2tSHQaEnOQUJbKYy86yg 2025-06-15 15:39:36+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18381 2025-06-15 16:58:09+00:00| seen|...

CVE-2025-21085 PingFederate OAuth Grant attribute duplication may use excessive memory

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization...

CVE-2025-6089

creationtimestamp| type| source ---|---|--- 2025-06-15 13:36:03+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18376 2025-06-15 17:28:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrnyha2pnh2u 2026-01-30 09:01:36+00:00| seen|...

CVE-2025-36506

External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted request, arbitrary files in the file system can be overwritten with log data...

CVE-2025-45986

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bsSetMacBlack function...