CVE-2025-4265

creationtimestamp| type| source ---|---|--- 2025-05-05 05:18:52+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14834 2025-05-05 06:15:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lofpri6pbm2p 2025-05-05 10:01:26+00:00| exploited|...

CVE-2025-20671

creationtimestamp| type| source ---|---|--- 2025-05-05 03:19:56+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14827 2025-05-05 06:16:03+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lofpritbea2j 2025-05-05 07:18:20+00:00| seen|...

CVE-2025-20668

creationtimestamp| type| source ---|---|--- 2025-05-05 03:19:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14826 2025-05-05 06:16:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lofpriwpje24 2025-05-05 07:03:34+00:00| seen|...

CVE-2025-4259

A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be launched...

CVE-2025-20671

In thermal, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09698599; Issue ID: MSV-3228...

CVE-2025-20666

In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID...

CVE-2025-20670

CVE-2025-20670 concerns a vulnerability in a Modem where improper certificate validation enables a permission bypass, potentially causing remote information disclosure if a UE connects to a rogue base station controlled by an attacker. Exploitation requires user interaction and the attacker would...

CVE-2025-4273

creationtimestamp| type| source ---|---|--- 2025-05-05 02:18:58+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14822 2025-05-05 05:50:24+00:00| seen| https://t.me/cvedetector/24425 2025-05-05 06:16:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lofprij2s422...

CVE-2025-4257

creationtimestamp| type| source ---|---|--- 2025-05-05 01:18:26+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14819 2025-05-05 04:15:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lofj2qeb4n2e 2025-05-05 05:50:25+00:00| seen|...

CVE-2025-45607

An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...

CVE-2025-45610

PassJava-Platform v3.0.0 is affected by CVE-2025-45610. The issue is an incorrect access control in the component "/scheduleLog/info/1" that allows access to sensitive information via a crafted payload. CVSS v3.1 base score 7.5 (HIGH) with NETWORK attack vector, LOW complexity, no privileges, no ...

CVE-2025-45611

Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request...

CVE-2025-45613

Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload...

CVE-2024-57231

NETGEAR RAX5 AX1600 WiFi Router V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apclidoenrpbcwps function...

CVE-2025-45609

CVE-2025-45609 affects the Kob project (latest v1.0.0-SNAPSHOT). The root cause is improper access control in the doFilter() function, enabling an attacker to access sensitive information via a crafted payload. The NVD entry lists a CVSSv3.1 base score of 7.5 (HIGH) with Network attack vector, Lo...

CVE-2025-45614

Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload...

CVE-2025-47268

ping in iputils before 20250602 allows a denial of service application error or incorrect data collection via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication...

CVE-2025-45612

Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index...

CVE-2025-44071

SeaCMS v13.3 was discovered to contain a remote code execution RCE vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request...

CVE-2025-45615

CVE-2025-45615 affects yaoqishan v0.0.1-SNAPSHOT; the /admin/ API has improper access control that can let an attacker obtain Admin rights via a crafted request. CVSSv3.1 base score 9.8 (CRITICAL). Exploitation details are not provided in the documents beyond a PoC/Exploitation field indicating p...