23602 matches found
CVE-2025-4198
CVE-2025-4198 – Alink Tap (WordPress) CSRF to Stored XSS . Affected: Alink Tap plugin for WordPress versions up to and including 1.3.1. Root cause: missing/incorrect nonce validation on the alink-tap page enables Cross-Site Request Forgery. Impact (per sources): unauthenticated attackers can upda...
CVE-2025-4188 Advanced Reorder Image Text Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'reorder-simple-image-text-slider-setting' page. This makes it possible for unauthenticate...
CVE-2025-46635
An issue was discovered on Tenda RX2 Pro 16.03.30.14 devices. Improper network isolation between the guest Wi-Fi network and other network interfaces on the router allows an attacker who is authenticated to the guest Wi-Fi to access resources on the router and/or resources and devices on other...
CVE-2025-46629
Lack of access controls in the 'ate' management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where 'ate' has been enabled by sending a crafted UDP packet...
CVE-2025-44846
TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-44848
TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-44836
TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
CVE-2025-32881
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. By default, the GID is the user's phone number unless they specifically opt out. A phone number is very sensitive information because it can be tied back to individuals. The app does not encrypt the GID in messages...
CVE-2025-32885
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message into existing v1 networks with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in an unencrypted...
CVE-2025-4144
PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...
CVE-2024-48905
Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint...
CVE-2024-48907
Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API...
CVE-2025-47245
In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role...
CVE-2025-47229
libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service varsetleavequiet assertion failure and application exit via crafted input data, such as data that triggers a call from src/data/dictionary.c code into src/data/variable.c code...
CVE-2025-44039
creationtimestamp| type| source ---|---|--- 2025-05-02 23:05:20+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/35320 2025-05-13 15:31:57+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lp2rmyhukdz2...
CVE-2024-55069
creationtimestamp| type| source ---|---|--- 2025-05-02 22:21:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114440568051347388 2025-05-03 01:59:27+00:00| seen| https://t.me/cvedetector/24381 2025-05-03 02:06:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loaavg5pwp...
CVE-2025-46723 OpenVM byte decomposition of pc in AUIPC chip can overflow
OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to overflow through byte decomposition of pc in AUIPC chip. A typo results in the highest limb of pc being range checked to 8-bits instead of 6-bits. This results in...
CVE-2022-21546
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITESAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sgwritesame --ndob" we...
CVE-2025-4214
creationtimestamp| type| source ---|---|--- 2025-05-02 20:44:53+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lo7nqpdpcjv2 2025-05-03 00:01:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo7zvoomwn2h 2025-05-03...
