CVE-2025-43715

Nullsoft Scriptable Install System NSIS before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition...

CVE-2025-29456

CVE-2025-29456 affects Personal Management System 1.4.65. The issue is described as an information-disclosure vulnerability via the Create Notes function that could allow a remote attacker to obtain sensitive data. The available sources consistently identify the affected component as the Create N...

CVE-2025-29454

CVE-2025-29454 concerns Personal Management System (PMS) version 1.4.65 . The issue, described as a mishandling of the Upload function, allows a remote attacker to obtain sensitive information. The CVSS details in the initial record indicate network access with high attack complexity and no privi...

CVE-2025-29451

CVE-2025-29451 affects Seo Panel 4.11.0; a vulnerability in the Mail Setting component allows a remote attacker to obtain sensitive information. Core details provided across multiple sources: impact is high (CVSS v3.1: 7.6), attack vector network, low privileges required, no user interaction. Roo...

CVE-2025-29451

An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component...

CVE-2025-29457

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...

CVE-2025-29181

FOXCMS = V1.25 is vulnerable to SQL Injection via $param'title' in /admin/util/Field.php...

CVE-2025-29039

The CVE-2025-29039 issue affects D-Link DIR-832x devices (firmware version 240802). The root cause is a 0x41dda8 function that fails to properly filter constructed command characters, enabling a remote attacker to execute arbitrary code. Documented impact is remote code execution with high impact...

CVE-2025-24909

Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x...

CVE-2025-2073

Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS 6.1, 5.15, 5.10, 5.4, 4.19 allows a local attacker with low privileges to trigger an out-of-bounds read, potentially leading to information disclosure...

CVE-2025-24907

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi...

CVE-2025-24908

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi...

CVE-2025-32791

creationtimestamp| type| source ---|---|--- 2025-04-16 22:44:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmxo5byhz22i...

CVE-2025-29710

creationtimestamp| type| source ---|---|--- 2025-04-16 22:43:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmxo3l3qg52q 2025-04-17 00:25:48+00:00| seen| https://t.me/cvedetector/23174 2025-04-18 12:58:30+00:00| published-proof-of-concept|...

CVE-2025-24907 Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi...

CVE-2025-24907

CVE-2025-24907 concerns Hitachi Vantara Pentaho Data Integration & Analytics. Affected versions are before 10.2.0.2, including 9.3.x and 8.3.x. The issue arises because user input used as a file path through the CGG Draw API is not properly neutralized, allowing doubled triple-dot sequences ('......

CVE-2025-24907 Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal

Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' doubled triple dot slash sequences that can resolve to a location that is outside of that directory. CWE-35 Description Hitachi...

CVE-2025-0757 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. CWE-79 Description Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x...

CVE-2025-32789 EspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function

EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of t...

CVE-2025-32433 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in SSH protocol message handling, a malicious actor...