CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a...

CVE-2025-34508 ZendTo < 6.15-8 Path Traversal

A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host system, or cause a denial of service...

CVE-2025-5349

creationtimestamp| type| source ---|---|--- 2025-06-17 13:39:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18589 2025-06-17 15:56:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrsuayuxxd2o 2025-06-18 03:21:53+00:00| seen|...

CVE-2025-5349

Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway...

CVE-2025-6020

A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions...

WordPress Master Slider plugin <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mastersliderpb and msslide Shortcodes vulnerability discovered by muhammad yudha in WordPress Plugin Master Slider versions = 3.10.8...

CVE-2025-3880 Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with...

CVE-2025-6020

creationtimestamp| type| source ---|---|--- 2025-06-17 11:22:14+00:00| seen| https://seclists.org/oss-sec/2025/q2/258 2025-06-17 13:36:33+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3lrsmgvbqim2g 2025-06-17 13:39:34+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18584...

WordPress YITH WooCommerce Wishlist plugin <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin YITH WooCommerce Wishlist versions = 4.5.0...

CVE-2025-40674 Reflected Cross-Site Scripting (XSS) in osCommerce

Reflected Cross-Site Scripting XSS in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user...

CVE-2025-6165

The CVE-2025-6165 entry affects TOTOLINK X15, version 1.0.0-B20230714.1105, specifically the HTTP POST Request Handler component and the /boafrm/formTmultiAP endpoint. The root cause is improper validation of the submit-url parameter, causing a buffer overflow that can be triggered remotely. Publ...

CVE-2025-5209 Ivory Search < 5.5.10 - Admin+ Stored XSS

The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2025-6163

A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The...

CVE-2025-6163 TOTOLINK A3002RU HTTP POST Request formMultiAP buffer overflow

A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The...

CVE-2025-6162

CVE-2025-6162 affects TOTOLINK EX1200T (4.1.2cu.5232_B20210713). The vulnerability exists in the HTTP POST Request Handler’s file path /boafrm/formMultiAP, where manipulating the submit-url argument causes a buffer overflow. This can be exploited remotely and is described as a high-severity issue...

CVE-2025-6162 TOTOLINK EX1200T HTTP POST Request formMultiAP buffer overflow

A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer...

CVE-2025-5673

creationtimestamp| type| source ---|---|--- 2025-06-17 03:43:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrrlbvjiuy2m...

CVE-2025-4775

creationtimestamp| type| source ---|---|--- 2025-06-17 03:38:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrrl27wv6725...

CVE-2025-6152

A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modules/files/files.routes.ts. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotel...

CVE-2025-6153 PHPGurukul Hostel Management System students.php sql injection

A vulnerability has been found in PHPGurukul Hostel Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/students.php. The manipulation of the argument searchbox leads to sql injection. The attack can be initiated remotely. The exploit has...