CVE-2025-40579

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0 HF0. Affected devices are vulnerable to a stack-based buffer overflow. This could allow a non-privileged local attacker to execute arbitrary code on the device or to cause a denial of service condition...

CVE-2025-31930

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m incl. SIM...

CVE-2025-30175

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SINEC NMS All versions V4.0, SINEMA Remote Connect All versions, Totally Integrated Automation Portal TIA Portal V17 All versions, Totally Integrated Automation Portal TIA Portal V18 All...

CVE-2025-30174

The CVE-2025-30174 entry applies to Siemens SIMATIC PCS neo, SINEC NMS, SINEMA Remote Connect, TIA Portal versions, and the User Management Component (UMC). Affected UMC versions contain an out-of-bounds read buffer overflow in the integrated UMC component, enabling an unauthenticated remote atta...

CVE-2025-40628

CVE-2025-40628 describes a SQL injection in DomainsPRO 1.2, exploitable via the d parameter in /article.php, enabling retrieval, creation, update, and deletion of databases. The entry is rated critical (CVSSv4 base score 9.3) with network attack vector and no privileges required. Public reference...

CVE-2025-3916

CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially execute arbitrary code while the end user opens a malicious project file SSD file provided by the attacker...

CVE-2025-3107

creationtimestamp| type| source ---|---|--- 2025-05-13 07:30:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16084 2025-05-13 11:21:40+00:00| seen| https://t.me/cvedetector/25174...

CVE-2025-4317

creationtimestamp| type| source ---|---|--- 2025-05-13 07:30:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16083 2025-05-13 08:47:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp23xqt7pl22 2025-05-13 11:21:37+00:00| seen| https://t.me/cvedetector/25170...

CVE-2025-47863

creationtimestamp| type| source ---|---|--- 2025-05-13 06:47:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lozvazpug62w 2025-05-13 07:10:49+00:00| seen| https://t.me/cvedetector/25164...

CVE-2025-4474 Frontend Dashboard 1.0 - 2.2.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via fed_admin_setting_form_function Function

The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fedadminsettingformfunction function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the...

CVE-2025-22246

creationtimestamp| type| source ---|---|--- 2025-05-13 05:30:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16078 2025-05-13 06:47:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lozvazmjnf2h 2025-05-13 09:41:17+00:00| seen|...

CVE-2025-43005

creationtimestamp| type| source ---|---|--- 2025-05-13 03:12:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lozjacmurk2w 2025-05-13 05:30:13+00:00| seen| https://t.me/cvedetector/25142...

CVE-2025-30018

creationtimestamp| type| source ---|---|--- 2025-05-13 01:32:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114497943894558300 2025-05-13 03:12:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lozjabkmls22 2025-05-13 14:30:46+00:00| seen|...

CVE-2025-42999

creationtimestamp| type| source ---|---|--- 2025-05-13 01:32:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114497943894558300 2025-05-13 02:29:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16074 2025-05-13 03:12:14+00:00| seen|...

CVE-2025-43010

creationtimestamp| type| source ---|---|--- 2025-05-13 01:32:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114497943894558300 2025-05-13 03:12:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lozjac4baw2l 2025-05-13 05:30:20+00:00| seen| https://t.me/cvedetector/251...

CVE-2025-30018

The Live Auction Cockpit in SAP Supplier Relationship Management SRM allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerability has a high impact on the...

CVE-2025-43011

The CVE-2025-43011 entry concerns SAP Landscape Transformation (PCL Basis module) lacking necessary authorization checks under certain conditions, allowing authenticated users to access restricted functionalities or data. The exploited impact is limited to confidentiality (high impact reported); ...

CVE-2025-43008

CVE-2025-43008 impacts SAP ERP HCM and SAP S/4HANA HCM Portugal disclosures due to missing authorization checks. The connected sources describe an unauthorized user able to view files from other companies, leading to potential personal data exposure of employees. The root cause is lack of authori...

CVE-2025-43006 Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)

SAP Supplier Relationship Management Master Data Management Catalogue allows an unauthenticated attacker to execute malicious scripts in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have som...

CVE-2025-43004 Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator Dashboard)

Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards PODs that enable outside users to access customer data when they access these dashboards. Since no mechanisms exist to enforce authentication, malicious unauthenticated users can view...