CVE-2025-32635

Insertion of Sensitive Information Into Sent Data vulnerability in Hive Support Hive Support hive-support allows Retrieve Embedded Sensitive Data.This issue affects Hive Support: from n/a through = 1.2.6...

CVE-2025-32958

Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact@v4 to upload the mac-standalone artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file...

CVE-2025-25775

creationtimestamp| type| source ---|---|--- 2025-04-25 17:07:48+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13468 2025-04-25 19:48:22+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114400329847987378 2025-04-25 21:19:55+00:00| seen|...

CVE-2025-32514

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cscode WooCommerce Estimate and Quote wc-estimate-and-quote allows Reflected XSS.This issue affects WooCommerce Estimate and Quote: from n/a through = 1.0.2.5...

CVE-2025-24670

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dhanendran Rajagopal Term Taxonomy Converter term-taxonomy-converter allows Reflected XSS.This issue affects Term Taxonomy Converter: from n/a through = 1.2...

CVE-2025-31340

A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to perform arbitrary system commands by running a malicious file...

CVE-2025-31030

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows PHP Local File Inclusion.This issue affects Ray Enterprise Translation: from n/a through = 1.7.0...

CVE-2025-39464

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rtowebsites AdminQuickbar adminquickbar allows Reflected XSS.This issue affects AdminQuickbar: from n/a through = 1.9.1...

CVE-2025-39414

Cross-Site Request Forgery CSRF vulnerability in Mike spam-stopper spam-stopper allows Stored XSS.This issue affects spam-stopper: from n/a through = 3.1.3...

CVE-2025-39418

Cross-Site Request Forgery CSRF vulnerability in ajayver RSS Manager rss-manager allows Stored XSS.This issue affects RSS Manager: from n/a through = 0.06...

CVE-2025-46618

In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab...

CVE-2025-43016

In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session...

CVE-2025-3636

A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks...

CVE-2025-3635

A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery CSRF attacks...

CVE-2025-3625

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication 2FA...

CVE-2025-3642

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled...

CVE-2025-32045

A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades...

CVE-2025-3644

creationtimestamp| type| source ---|---|--- 2025-04-25 15:07:51+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13451 2025-04-25 17:19:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnnq76gfz22u 2025-04-25 19:11:17+00:00| seen| https://t.me/cvedetector/23770...

CVE-2025-3645

creationtimestamp| type| source ---|---|--- 2025-04-25 15:07:50+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13450 2025-04-25 17:19:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnnq76jvas2b 2025-04-25 19:11:22+00:00| seen| https://t.me/cvedetector/23773...

CVE-2025-43862 Dify Allows Unauthorized Access and Modification of APP Orchestration

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...