23602 matches found
CVE-2025-3993
creationtimestamp| type| source ---|---|--- 2025-04-26 19:18:33+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114405874926408355 2025-04-28 01:10:07+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13650 2025-04-28 02:48:23+00:00| seen|...
CVE-2025-46652
creationtimestamp| type| source ---|---|--- 2025-04-26 18:08:56+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13580 2025-04-26 18:41:30+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lnqfa6ttpim2 2025-04-26...
CVE-2025-46484
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nasir179125 Image Hover Effects For WPBakery Page Builder image-hover-effects-for-visual-composer allows DOM-Based XSS.This issue affects Image Hover Effects For WPBakery Page Builder: from n/a...
CVE-2025-46512
Cross-Site Request Forgery CSRF vulnerability in Shamim Hasan Custom Functions Plugin custom-functions allows Stored XSS.This issue affects Custom Functions Plugin: from n/a through = 1.1...
CVE-2025-46452
Cross-Site Request Forgery CSRF vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1...
CVE-2025-31324
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...
CVE-2024-53636
creationtimestamp| type| source ---|---|--- 2025-04-26 15:08:03+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13578 2025-04-26 15:34:13+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lnq2r6mzenm2 2025-04-26...
CVE-2025-3904
Vulnerability in Drupal Sportsleague.This issue affects Sportsleague:...
CVE-2024-13812
CVE-2024-13812 : The Anps Theme plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 1.1.1. The root cause is improper validation before running do_shortcode, enabling attackers to execute arbitrary shortcodes. The vulnerability i...
CVE-2025-2811
creationtimestamp| type| source ---|---|--- 2025-04-26 07:08:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13573 2025-04-26 07:25:43+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lnp7eozrama2 2025-04-26...
CVE-2025-29461
An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path...
CVE-2025-2907
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modi...
CVE-2025-2105
creationtimestamp| type| source ---|---|--- 2025-04-26 06:08:50+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13572 2025-04-26 06:13:03+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lnp3etdzqxa2 2025-04-26 07:48:22+00:00| seen|...
CVE-2025-29040
An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the targetaddr key value and the function 0x41737c...
CVE-2025-3914 Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload
The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropagemediadownloader' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access a...
CVE-2025-28019
TOTOLINK A800R V4.1.2cu.5137B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component...
CVE-2025-28029
TOTOLINK A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi...
CVE-2025-28232
Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication...
CVE-2025-31363
Mattermost versions 10.4.x = 10.4.2, 10.5.x = 10.5.0, 9.11.x = 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira...