CVE-2025-48953 Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Umbraco is an ASP.NET content management system CMS. Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and...

CVE-2025-30359 webpack-dev-server users' source code may be stolen when they access a malicious web site

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same...

CVE-2025-32106

In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted POST request request may result in an unauthenticated remote user's ability to execute unauthorized code...

CVE-2025-5512 quequnlong shiyi-blog Administrator Backend verifyPassword improper authentication

A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible to launch the atta...

CVE-2025-5506

creationtimestamp| type| source ---|---|--- 2025-06-03 16:37:21+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqppv4gbpjp2...

CVE-2025-5505

creationtimestamp| type| source ---|---|--- 2025-06-03 16:37:20+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqppv6zemqj2...

CVE-2025-25020

creationtimestamp| type| source ---|---|--- 2025-06-03 16:36:56+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqppupyhjsj2...

CVE-2025-25019

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system...

CVE-2024-45655

creationtimestamp| type| source ---|---|--- 2025-06-03 15:50:10+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqpneoklasy2...

CVE-2025-36564

creationtimestamp| type| source ---|---|--- 2025-06-03 15:45:48+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqpn2utfwwj2...

CVE-2025-25020

CVE-2025-25020 affects IBM QRadar Suite Software 1.10.12.0–1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0–1.10.11.0. Root cause: improper validation of API data input, allowing an authenticated user to cause a denial of service. IBM’s advisory and multiple sources confirm the vulnerability exis...

CVE-2025-5505

A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic. This issue affects some unknown processing of the file /boafrm/formPortFw of the component Virtual Server Page. The manipulation of the argument servicetype leads to cross site scripting. The attack...

CVE-2025-5506 TOTOLINK A3002RU NAT Mapping Page cross site scripting

A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as problematic. Affected is an unknown function of the component NAT Mapping Page. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The...

CVE-2025-5498

creationtimestamp| type| source ---|---|--- 2025-06-03 14:58:02+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqpkhj3uehp2...

CVE-2025-5501

creationtimestamp| type| source ---|---|--- 2025-06-03 14:58:01+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqpkhdw7pkj2 2025-06-03 15:50:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqpneyddb42m...

CVE-2025-46154

creationtimestamp| type| source ---|---|--- 2025-06-03 14:52:59+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqpk5yt7fmy2 2025-06-03 16:09:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqpohjrmsn2m...

CVE-2025-5502

creationtimestamp| type| source ---|---|--- 2025-06-03 14:52:37+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqpk5dkxwwy2...

CVE-2025-46154

Foxcms v1.25 has a SQL time injection in the $POST'dbname' parameter of installdb.php...

CVE-2025-4435

creationtimestamp| type| source ---|---|--- 2025-06-03 14:03:09+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqphcvccuqj2 2025-06-03 15:59:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqpnvmqodk2s 2025-06-09...

CVE-2025-5499 slackero phpwcms image_resized.php getimagesize deserialization

A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function isfile/getimagesize of the file imageresized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit ha...