CVE-2025-25217

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference...

CVE-2025-20063

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion...

CVE-2025-27247 Pasteboard has an improper preservation of permissions vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through get permission...

CVE-2025-23235 arkcompiler_ets_runtime has an out-of-bounds write vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through out-of-bounds read...

CVE-2025-38004

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcmop runtime updates The CAN broadcast manager CAN BCM can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the...

CVE-2025-38003 can: bcm: add missing rcu read protection for procfs content

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcmop which is in the process to be removed the procfs output might show unreliable data UAF. As the removal of bcmop's is...

CVE-2025-48783

An external control of file name or path vulnerability in the delete file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to delete partial files by specifying arbitrary file paths...

CVE-2025-5734

A vulnerability has been found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWlanRedirect of the component HTTP POST Request Handler. The manipulation of the argument redirect-url leads to buffer overflow. The atta...

CVE-2025-2935

The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ssoptionmaint.php' and 'ssuserfilterlist' files. This make...

CVE-2025-5724

A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /script/academic/subjects of the component Subjects Page. The manipulation of the argument Subject leads to cross site scripting. It...

CVE-2025-5723

A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /script/academic/classes of the component Classes Page. The manipulation of the argument Class Name leads to cross site scripting...

CVE-2025-5097

creationtimestamp| type| source ---|---|--- 2025-06-08 01:03:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr2o5ww3fu2s...

CVE-2025-5706

A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /new-user-testing.php. The manipulation of the argument state leads to sql injection. The attack ca...

CVE-2025-5796

creationtimestamp| type| source ---|---|--- 2025-06-07 17:18:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqzu5qhcla2q...

CVE-2025-5528

CVE-2025-5528 affects the WordPress plugin “Social Sharing Plugin – Sassy Social Share” (versions ≤ 3.3.75). The issue is a reflected Cross‑Site Scripting vulnerability via the heateor_mastodon_share parameter caused by insufficient input sanitization and output escaping. It can be exploited by u...

CVE-2025-5568

CVE-2025-5568 concerns the WordPress plugin WpEvently (versions

CVE-2025-4568

Improper neutralization of input provided by an unauthorized user into changesreferenceid parameter in URL allows for boolean-based Blind SQL Injection attacks...

CVE-2025-5806

creationtimestamp| type| source ---|---|--- 2025-06-07 08:44:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lqyxibmcfb2d...

CVE-2025-5814

creationtimestamp| type| source ---|---|--- 2025-06-07 06:53:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqyrb2y6jh2e...

CVE-2025-5814

The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...