CVE-2025-52968

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...

CVE-2023-47031

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroups, and grantRolesToOrganization SOAP API component...

Important: libarchive

Issue Overview: A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory...

CVE-2023-47029

CVE-2023-47029 affects NCR Terminal Handler v1.5.1. Multiple sources confirm a remote attacker can execute arbitrary code and access sensitive information by sending a crafted POST request to the UserService component. CVSS v3.1 base score 9.8 (Critical), with network attack vector and no privile...

CVE-2025-52921

Innoshop up to version 0.4.1 contains a server-side code execution flaw in the File Manager of the admin panel. An authenticated attacker can upload a crafted file and bypass the image-only check by renaming the file to a .php extension (renaming function), enabling a subsequent GET request to ex...

CVE-2025-6490

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmapsetwithhash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approach...

CVE-2025-6486

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can ...

CVE-2025-6485

creationtimestamp| type| source ---|---|--- 2025-06-22 17:48:43+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19170 2025-06-22 18:07:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls7nwqp5fy2v 2026-01-23 21:03:05+00:00| seen|...

CVE-2025-6483

creationtimestamp| type| source ---|---|--- 2025-06-22 16:47:39+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19168 2025-06-22 17:00:54+00:00| published-proof-of-concept| Telegram/Vnx5KCxrPRsIbvdxVRTilkI3AMzgNQPcLDF6vvBNNJ6bMY 2025-06-22 18:22:13+00:00| seen|...

CVE-2025-6481

creationtimestamp| type| source ---|---|--- 2025-06-22 15:46:00+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19166 2025-06-22 16:01:26+00:00| published-proof-of-concept| Telegram/JXdIHA4NW6c606ZHTElBxltbVcdKBOZ3nM5pnGiNcLowVzU 2025-06-22 18:37:14+00:00| seen|...

CVE-2025-6466 ageerle ruoyi-ai SseServiceImpl.java upload unrestricted upload

A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. The manipulation of the argument File...

CVE-2025-6458

creationtimestamp| type| source ---|---|--- 2025-06-22 04:43:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19149 2025-06-22 06:01:12+00:00| published-proof-of-concept| Telegram/56s6aSE0cEqYXGXE607m6A-Qk9CW0ThgSANdwVW84nL4 2025-06-22 08:13:42+00:00| seen|...

CVE-2025-6452

creationtimestamp| type| source ---|---|--- 2025-06-22 02:46:44+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19145 2025-06-22 04:20:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls67pwod5m2m...

CVE-2025-6449

creationtimestamp| type| source ---|---|--- 2025-06-22 00:44:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19142 2025-06-22 01:31:39+00:00| published-proof-of-concept| Telegram/p8F798LSCV2sUyCA6ioZ8hbl6YMhZj0eqwyIGuUlAdEidAo 2025-06-22 04:35:55+00:00| seen|...

CVE-2025-6447

creationtimestamp| type| source ---|---|--- 2025-06-21 23:43:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19134 2025-06-22 00:31:29+00:00| published-proof-of-concept| Telegram/P0ZoWuZyzgcHSriI8XLEqNA0BhqBJCacVToDJc5Op8l1c 2025-06-22 04:11:36+00:00| seen|...

CVE-2025-6422

creationtimestamp| type| source ---|---|--- 2025-06-21 22:42:57+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19132 2025-06-22 02:20:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls5yz7bifh2a...

CVE-2025-6420

creationtimestamp| type| source ---|---|--- 2025-06-21 21:47:03+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19130 2025-06-21 22:31:34+00:00| published-proof-of-concept| Telegram/PyJlSwi8jdNUrP0ZQH6ZpEvRZ26d84GFio1rTwIcDtG0Kjo 2025-06-22 02:30:50+00:00| seen|...

CVE-2025-6415

creationtimestamp| type| source ---|---|--- 2025-06-21 19:43:39+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19126 2025-06-21 20:03:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls5dwd3cwp2p...

CVE-2025-6416 PHPGurukul Art Gallery Management System changeimage4.php sql injection

A vulnerability, which was classified as critical, was found in PHPGurukul Art Gallery Management System 1.1. Affected is an unknown function of the file /admin/changeimage4.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-6406

creationtimestamp| type| source ---|---|--- 2025-06-21 14:46:30+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19117 2025-06-21 15:32:09+00:00| published-proof-of-concept| Telegram/Assw9VrEEJe4EVrWIRhlcCccZizPVDVnNzwWmu7SwOXbOgE 2025-06-21 18:04:00+00:00| seen|...