CVE-2024-29198

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the...

CVE-2025-30145 GeoServer has an Infinite Loop Vulnerability in Jiffle process

GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This...

CVE-2025-49510 WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-woocommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from n/a through = 5.1.0...

CVE-2025-27242

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input...

CVE-2025-41657

creationtimestamp| type| source ---|---|--- 2025-06-10 10:52:34+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3lrapystmstn2 2025-06-10 11:34:19+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17872...

CVE-2025-40658

An Insecure Direct Object Reference IDOR vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/framesSelection.asp...

CVE-2025-3116

Summary: CVE-2025-3116 involves an input validation weakness in Schneider Electric Modicon Controllers (M241/M251/M258/LMC058/M262, per multiple reports) that can allow a Denial of Service when an authenticated user sends a specially crafted HTTPS request with improperly formatted body data to th...

CVE-2025-3899

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser...

CVE-2025-5945

CVE-2025-5945 is rejected/not used; this CVE ID does not represent an active vulnerability entry.

CVE-2025-4840 Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-5935

A vulnerability was found in Open5GS up to 2.7.3. It has been declared as problematic. Affected by this vulnerability is the function commonregisterstate of the file src/mme/emm-sm.c of the component AMF/MME. The manipulation of the argument ranueid leads to denial of service. The attack can be...

CVE-2025-5935

Open5GS up to version 2.7.3 is affected. The issue lies in the AMF/MME component, specifically the function common_register_state in src/mme/emm-sm.c, where manipulating the ran_ue_id argument can cause a denial of service. The vulnerability can be triggered remotely and public exploitation has b...

CVE-2025-42998

creationtimestamp| type| source ---|---|--- 2025-06-10 03:46:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr7ya456u625...

CVE-2025-42987

creationtimestamp| type| source ---|---|--- 2025-06-10 03:23:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr7wwu4hgn2m 2025-06-10 15:31:16+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17914...

CVE-2025-5910

A vulnerability has been found in TOTOLINK EX1200T up to 4.1.2cu.5232B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can b...

CVE-2025-43573

creationtimestamp| type| source ---|---|--- 2025-06-10 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-336/ 2025-06-10 19:31:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17973 2025-06-12 22:25:49+00:00| seen|...

CVE-2025-5911

PRODUCT/VULN: TOTOLINK EX1200T (firmware up to 4.1.2cu.5232_B20210713) suffers a buffer overflow in the HTTP POST Request Handler’s /boafrm/formDMZ functionality. VULNERABLE COMPONENT/FILE: /boafrm/formDMZ in HTTP POST Request Handler. ROOT CAUSE: failure to validate input length/size leading to ...

CVE-2025-5909 TOTOLINK EX1200T HTTP POST Request formReflashClientTbl buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T up to 4.1.2cu.5232B20210713. Affected is an unknown function of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. It is possible to launch th...

CVE-2025-5908

creationtimestamp| type| source ---|---|--- 2025-06-10 01:28:35+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17816 2025-06-10 01:33:54+00:00| published-proof-of-concept| Telegram/UVPTEGvNWegLT6R4iAM8IA5DDdZ7pzDRTagvDaZDKFK5Xkw 2025-06-10 03:56:55+00:00| seen|...

CVE-2025-42987

SAP Manage Processing Rules For Bank Statement allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application...