CVE-2025-46227 WordPress Custom Related Posts plugin <= 1.7.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brecht Custom Related Posts custom-related-posts allows Stored XSS.This issue affects Custom Related Posts: from n/a through = 1.7.4...

CVE-2025-2839 WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-46899

creationtimestamp| type| source ---|---|--- 2025-04-22 05:03:17+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12803 2025-04-22 07:04:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnf4gmbxib2t 2025-04-22 08:22:14+00:00| seen| https://t.me/cvedetector/23481 2025-08-09...

CVE-2025-2300

The CVE-2025-2300 entry concerns Hitachi Ops Center Common Services, within Hitachi Ops Center OVA. Affected software: Hitachi Ops Center Common Services versions before 11.0.4-00 (specifically 11.0.3-00 and earlier). Root cause: information exposure vulnerability in the Common Services component...

CVE-2025-3856

creationtimestamp| type| source ---|---|--- 2025-04-22 03:02:51+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12789 2025-04-22 03:04:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lneoz42c6a2d 2025-04-22 04:11:18+00:00| seen|...

CVE-2024-40446

An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script...

CVE-2024-58250

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...

CVE-2025-43946

The CVE-2025-43946 entry concerns TCPWave DDI 11.34P1C2. The issue is Remote Code Execution caused by Unrestricted File Upload combined with Path Traversal, enabling an attacker to upload files and traverse directories to execute arbitrary code. CVSSv3.1 metrics indicate a NETWORK-vector, exploit...

CVE-2024-58250

The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges...

CVE-2024-40446

An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script...

CVE-2025-28036

TOTOLINK A950RG V4.1.2cu.5161B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2024-40445

A directory traversal vulnerability in forkosh Mime TeX before version 1.77 allows attackers on Windows systems to read or append arbitrary files by manipulating crafted input paths...

CVE-2025-28026

TOTOLINK A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi...

CVE-2025-28031

CVE-2025-28031 affects TOTOLINK A810R (version 4.1.2cu.5182_B20201026). The root cause is a hardcoded password for the Telnet service stored in product.ini, enabling authentication exposure over the network. The CVSS reflects network access, high confidentiality impact, no integrity or availabili...

CVE-2025-43946

TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload combined with Path Traversal...

CVE-2025-29339

Open5GS UPF (up to v2.7.2) is affected by CVE-2025-29339. An assertion failure occurs during PFCP Session Establishment Requests when PDN Type is 0, due to improper handling of an invalid value propagated from SMF (or via direct attack), leading to a fatal assertion and daemon crash. The vulnerab...

CVE-2025-3846

The CVE-2025-3846 entry concerns markparticle WebServer (up to v1.0) with a vulnerability in the Registration component’s file code/http/httprequest.cpp. The issue arises from manipulation of the username/password arguments, leading to a SQL injection that can be exploited remotely. Multiple conn...

CVE-2025-32956

creationtimestamp| type| source ---|---|--- 2025-04-21 21:02:35+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12761 2025-04-21 23:04:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lneblktowx2t 2025-04-21 23:30:57+00:00| published-proof-of-concept|...

GHSA-MXR3-8WHJ-J74R

creationtimestamp| type| source ---|---|--- 2025-04-21 21:02:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12760...

WordPress Smart Maintenance Mode plugin <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Dogus Demirkiran in WordPress Plugin Smart Maintenance Mode versions = 1.5.1...