CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

CVE-2025-33026

In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2025-33027

In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Bandizip. User interaction is required to exploit this vulnerability in that the target must vis...

CVE-2025-24949

In JotUrl 2.0, is possible to bypass security requirements during the password change process...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

CVE-2025-27980

cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=...

CVE-2025-28399

CVE-2025-28399 affects Erick xmall v1.1 and earlier. The vulnerability enables a remote attacker to escalate privileges via the updateAddress method in the Address Controller class. Public metrics indicate a CVSS v3.1 base score of 9.8 (CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected pro...

CVE-2025-29705

The CVE-2025-29705 entry concerns code-gen versions 2.0.6 and earlier, with an underlying flaw of Incorrect Access Control due to missing permission controls. This allows anyone to access such projects (impact described as unauthenticated access to projects). Public references corroborate the vul...

📄 Adapt Authoring Tool 0.11.3 Remote Command Execution

Adapt Authoring Tool version 0.11.3 suffers from a remote command execution vulnerability. Exploit Title: Adapt Authoring Tool 0.11.3 - Remote Command Execution RCE Date: 2024-11-24 Exploit Author: Eui Chul Chung Vendor Homepage: https://www.adaptlearning.org/ Software Link:...

CVE-2025-33028

WinZip

CVE-2025-32987

Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher...

CVE-2025-27980

The set of connected records confirm CVE-2025-27980 affects CashBook v4.0.3, where an arbitrary file read is possible through the API endpoint /api/entry/flow/invoice/show?invoice=. The vulnerability exposes confidential data (CVE metrics indicate Confidentiality Impact: High, Integrity: Low, Ava...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

CVE-2025-28144

Edimax BR-6478AC BR-6478AC V3 (1.0.15) is affected by a stack overflow in the peerPin parameter of the formWsc function. The vulnerability is documented across NVD, CVE records, and vendor-derived sources, with no public exploitation details provided in the materials. The root cause, as described...

CVE-2025-22911

CVE-2025-22911 affects RE11S v1.11. A stack overflow is triggered in the formiNICbasicREP function via the rootAPmac parameter. Public documents (NVD, Red Hat, CNNVD, PT Security, CVE list) describe a likely impact range; CNNVD notes potential arbitrary code execution. PT Security provides guidan...

CVE-2025-32997

In CVE-2025-32997, the http-proxy-middleware has a flaw where fixRequestBody proceeds even if bodyParser has failed, affecting versions: 2.0.7/2.0.8 (before 2.0.9) and 3.x before 3.0.5. The Connected IBM bulletin confirms the root cause and lists remediation: upgrade to http-proxy-middleware v2.0...

CVE-2025-32428 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended

Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still...

CVE-2025-3593

creationtimestamp| type| source ---|---|--- 2025-04-14 22:48:34+00:00| seen| https://bsky.app/profile/potato.software/post/3lmsnh2zzce2c 2025-04-15 02:38:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmt2bk6tu42l 2025-04-15 03:13:14+00:00| seen| https://t.me/cvedetector/22901...

CVE-2025-3590

creationtimestamp| type| source ---|---|--- 2025-04-14 21:54:20+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11707 2025-04-14 22:39:03+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmsmvv72gv2u 2025-04-15 01:32:40+00:00| seen|...