CVE-2025-0669

CVE-2025-0669 is a CSRF vulnerability in BOINC Server prior to version 1.4.3 . The flaw enables unauthorized state-changing requests over a network vector with low attack complexity and user interaction required . A PoC is referenced in advisories, and the impact is described as high for confiden...

CVE-2025-32398

creationtimestamp| type| source ---|---|--- 2025-05-07 07:22:06+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15277 2025-05-07 08:26:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokxykssts2h 2025-05-07 09:32:04+00:00| published-proof-of-concept|...

CVE-2025-32404

CVE-2025-32404 describes an out-of-bounds write in RT-Labs P-Net prior to or at 1.0.1 that can corrupt the memory of IO devices using the library when a malicious RPC packet is sent. The issue affects RT-Labs P-Net versions 1.0.1 and earlier and is exploitable over network, enabling memory corrup...

CVE-2025-32399

An Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library to enter an infinite loop by sending a malicious RPC packet...

BELL-CVE-2023-53141

Bulletin has no description...

BELL-CVE-2025-47268

Bulletin has no description...

CVE-2025-3921

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handelajaxreq function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata whic...

CVE-2025-3851

The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wit...

CVE-2025-4054 Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 Free and = 2.27.4 Premium, due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-3218

creationtimestamp| type| source ---|---|--- 2025-05-07 02:21:47+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15250 2025-05-07 04:26:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokkl3bkij22 2025-05-07 07:12:58+00:00| seen| https://t.me/cvedetector/24674 2025-05-07...

CVE-2025-4055 Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode

The Multiple Post Type Order plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-3852

CVE-2025-3852 (WPshop 2 – E-Commerce) is a privilege-escalation vulnerability affecting WPshop 2 versions 2.0.0–2.6.0. The bug arises from insufficient identity validation in the update() function, enabling authenticated users with subscriber-level access or higher to modify arbitrary users’ cred...

CVE-2025-3921

CVE-2025-3921 affects PeproDev Ultimate Profile Solutions (WordPress). The vulnerability is due to a missing capability check in handel_ajax_req(), allowing unauthenticated attackers to modify arbitrary user metadata in versions 1.9.1–7.5.2. Reported impact includes potential admin access disrupt...

CVE-2025-3853

CVE-2025-3853 affects WPshop 2 – E-Commerce for WordPress (versions 2.0.0–2.6.0). The vulnerability is an Insecure Direct Object Reference in the callback_generate_api_key() function due to missing validation on a user-controlled key. Exploitation requires authenticated access at Subscriber level...

CVE-2025-45607

An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...

CVE-2025-45237

Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information, including the encrypted password...

CVE-2025-28062

A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections...

CVE-2025-47423

CVE-2025-47423 affects Personal Weather Station Dashboard (12_lts). A directory traversal fault in /others/_test.php (test parameter) allows unauthenticated remote readers to access arbitrary files, including server private keys. Root cause: insufficient sanitization of the test parameter enablin...

CVE-2025-4372

Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-46573

creationtimestamp| type| source ---|---|--- 2025-05-06 22:26:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lojwinqaxf2h 2025-05-07 00:03:22+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lok3r36xwif2 2025-05-07...