CVE-2025-7240 IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the...

CVE-2025-7250

CVE-2025-7250 affects IrfanView CADImage Plugin (DWG parsing). The bug is a lack of validation during DWG file parsing, causing a read past the end of an allocated buffer (out-of-bounds read) that enables remote code execution in the plugin’s process. Attack requires user interaction (visiting a ...

CVE-2025-24937 Access to local file system and its content

File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the network stack and the set of possible...

Exploit for Deserialization of Untrusted Data in Microsoft

ZeroPoint.ps1 ⚠ A defensive PowerShell utility to detect an...

CVE-2025-24936 Insufficient Validation of Input in the URL

The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to th...

CVE-2025-7897

creationtimestamp| type| source ---|---|--- 2025-07-20 17:01:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lufxcd3cfq27 2025-07-22 03:54:24+00:00| seen| MISP/a3c5beab-b790-4171-8b4c-02c8a9678071 2025-09-09 11:53:41+00:00| seen| MISP/a3c5beab-b790-4171-8b4c-02c8a9678071...

CVE-2025-7889 CallApp Caller ID App caller.id.phone.number.block AndroidManifest.xml improper export of android application components

A vulnerability was found in CallApp Caller ID App up to 2.0.4 on Android. It has been classified as problematic. Affected is an unknown function of the file AndroidManifest.xml of the component caller.id.phone.number.block. The manipulation leads to improper export of android application...

CVE-2025-7875 Metasoft 美特软件 MetaCRM debug.jsp improper authentication

A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may ...

CVE-2025-7871

CVE-2025-7871 affects Portabilis i-Diario 1.5.0. The vulnerability is in the unknown code path of the file /conteudos, where manipulating the parameter filter[by_description] leads to cross-site scripting. The attack can be initiated remotely, and the exploit has been disclosed publicly. Vendor r...

CVE-2025-7865

A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Filter. The manipulation of the argument text leads to cross...

CVE-2025-50708

An issue in Perplexity AI GPT-4 v.2.51.0 allows a remote attacker to obtain sensitive information via the token component in the shared chat URL...

CVE-2025-54314

Removed by vendor...

CVE-2025-7824

creationtimestamp| type| source ---|---|--- 2025-07-19 15:17:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ludazfsi2q2j...

CVE-2025-7800 cgpandey hotelmis HTTP GET Request admin.php cross site scripting

A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown code of the file admin.php of the component HTTP GET Request Handler. The manipulation of the argument Search leads to cross site scripting...

CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53888 RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c

RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with assert can lead to buffer overflow in versions up to and including 2025.04. Assertions are usually compiled out in production builds. If assertions are the only defense against...

CVE-2025-46732 OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL NotificationLineNotificationMarkReadMutation and NotificationLineNotificationDeleteMutation mutations of OpenCTI allows an authenticated...

CVE-2025-50126

CVE-2025-50126 describes a stored XSS vulnerability in RSBlog! for Joomla, affecting versions 1.11.6–1.14.5. The issue arises from improper handling of the jform[tags_text] parameter, allowing remote authenticated users to inject arbitrary web script or HTML. Multiple connected sources corroborat...

CVE-2025-5800

creationtimestamp| type| source ---|---|--- 2025-07-18 08:58:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lua3eaibq72w...

CVE-2025-6023

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01,...