CVE-2025-4282 SourceCodester/oretnom23 Stock Management System Users.php cross-site request forgery

A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The...

CVE-2025-43847

CVE-2025-43847 affects Retrieval-based-Voice-Conversion-WebUI (RVC) up to version 2.2.231006. The flaw is unsafe deserialization via the ckpt_path2 input passed to process_ckpt.py’s extract_small_model, which uses torch.load to load a model from a user-supplied path. This leads to remote code exe...

CVE-2025-45240

foxcms v1.2.5 was discovered to contain a SQL injection vulnerability via the executeCommand method in DataBackup.php...

CVE-2025-43915

In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics...

CVE-2025-43846

CVE-2025-43846 affects the Retrieval-based-Voice-Conversion-WebUI project (RVC-Project). Vulnerability: unsafe deserialization in the code path that uses the ckpt_path1 variable, which is passed to show_info in process_ckpt.py and used with torch.load to load a model file. This enables remote cod...

CVE-2025-43846 GHSL-2025-016_Retrieval-based-Voice-Conversion-WebUI

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckptpath1 variable takes user input e.g. a path to a model and passes it to the showinfo function in processckpt.py, which uses it to loa...

CVE-2025-43844 GHSL-2025-014_Retrieval-based-Voice-Conversion-WebUI

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables expdir1, among others, take user input and pass it to the clicktrain function, which concatenates them into a command that is run on...

CVE-2025-45322

creationtimestamp| type| source ---|---|--- 2025-05-05 16:41:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3logspx5uph2n...

CVE-2024-58100

creationtimestamp| type| source ---|---|--- 2025-05-05 16:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3logrda2vmu22 2025-05-09 08:25:24+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15704 2026-03-19 00:00:00+00:00| seen|...

CVE-2025-4281

A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an unknown part of the file /api/GylOperator/LoadData. The manipulation leads to information disclosure. It is possible to initiate the attack...

CVE-2025-46726

creationtimestamp| type| source ---|---|--- 2025-05-05 16:03:18+00:00| published-proof-of-concept| https://github.com/langroid/langroid/security/advisories/GHSA-pw95-88fg-3j6f 2025-05-05 20:20:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14979 2025-05-06...

CVE-2024-58100

In the Linux kernel, the following vulnerability has been resolved: bpf: check changespktdata property for extension programs When processing calls to global sub-programs, verifier decides whether to invalidate all packet pointers in current state depending on the changespktdata property of the...

CVE-2025-4316

creationtimestamp| type| source ---|---|--- 2025-05-05 14:20:39+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14868 2025-05-05 14:30:32+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114455703183156737 2025-05-05 16:16:30+00:00| seen|...

CVE-2025-2545

Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES 3DES cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could...

CVE-2025-2545

Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES 3DES cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could...

CVE-2025-4272

creationtimestamp| type| source ---|---|--- 2025-05-05 11:19:43+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14843 2025-05-05 14:16:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3logkmhblki24 2025-05-05 15:52:38+00:00| seen|...

CVE-2025-4271

creationtimestamp| type| source ---|---|--- 2025-05-05 10:21:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3log5hx4po32p 2025-05-05 11:41:44+00:00| seen| https://t.me/cvedetector/24446...

CVE-2025-4269

creationtimestamp| type| source ---|---|--- 2025-05-05 07:19:24+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14840 2025-05-05 10:21:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3log5hx7zgt2j 2025-05-05 11:41:45+00:00| exploited|...

CVE-2025-39363

creationtimestamp| type| source ---|---|--- 2025-05-05 06:18:38+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14836 2025-05-05 10:01:22+00:00| seen| https://t.me/cvedetector/24439 2025-05-05 10:21:08+00:00| seen|...

CVE-2025-39363

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Stored XSS.This issue affects Custom Login and Registration: from n/a through 1.0.0...