CVE-2025-48988

creationtimestamp| type| source ---|---|--- 2025-06-16 14:38:10+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18455 2025-06-16 15:16:27+00:00| seen| https://seclists.org/oss-sec/2025/q2/252 2025-06-16 15:40:25+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114693794996406990...

CVE-2025-5689 Improper Permission Management in SSH Session Handling

A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session...

CVE-2025-6119

A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking...

CVE-2025-40916 Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text

Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand function for generating the captcha text as well as image noise, which is insecure...

CVE-2025-4748

CVE-2025-4748 – Erlang/OTP path traversal in stdlib zip handling : The issue arises from path restriction flaws in lib/stdlib/src/zip.erl, affecting OTP 17.0 up to 28.0.1 (including OTP 27.3.4.1 and 26.2.5.13) and corresponding stdlib 2.0–7.0.1, 6.2.2.1, 5.2.3.4. It enables absolute path traversa...

CVE-2025-47869 Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In this example application device stats structure that stored remotely provided parameters had hardcoded buffer size which could lead to...

CVE-2025-47869

CVE-2025-47869 affects Apache NuttX RTOS, specifically the apps/examples/xmlrpc component. A device stats structure stored remotely provided parameters using hardcoded buffers can lead to a buffer overflow. The buffers were corrected to CONFIG_XMLRPC_STRINGSIZE+1 in the release 12.9.0 example, af...

CVE-2025-47868

The CVE concerns Apache NuttX’s optional tools/bdf-converter in the repository, which suffers an out-of-bounds write that can cause a heap-based buffer overflow. Affected versions are 6.9 through 12.9.0; the issue arises when the tool is exposed to externally provided data. The advisory recommend...

CVE-2025-6117 Das Parking Management System 停车场管理系统 API Search sql injection

A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been declared as critical. This vulnerability affects unknown code of the file /Reservations/Search of the component API. The manipulation of the argument Value leads to sql injection. The attack can be initiated...

CVE-2025-6115 D-Link DIR-619L form_macfilter stack-based overflow

A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function formmacfilter. The manipulation of the argument machostname%d/schedname%d leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclos...

CVE-2025-4987

CVE-2025-4987 is a stored XSS vulnerability affecting Dassault Systèmes Project Portfolio Manager’s Opportunity Management, affecting 3DEXPERIENCE R2023x–R2025x. The issue stems from a stored Cross-site Scripting flaw that enables an attacker to execute arbitrary script code in a user’s browser s...

CVE-2025-6108

creationtimestamp| type| source ---|---|--- 2025-06-16 06:20:14+00:00| seen| https://bsky.app/profile/potato.software/post/3lrpdls2p252b 2025-06-16 06:36:13+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18419 2025-06-16 07:28:51+00:00| seen|...

CVE-2025-6170

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare...

CVE-2025-6109 javahongxi whatsmars InitializrController.java initialize path traversal

A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java. The manipulati...

CVE-2025-6102

creationtimestamp| type| source ---|---|--- 2025-06-16 04:02:17+00:00| published-proof-of-concept| Telegram/IWgL-7hijIDfZWh3thMsnAy1768rz69pWolDkfnZ1T6kfIs 2025-06-16 04:04:08+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114691057117107590 2025-06-16 07:27:51+00:00| seen|...

CVE-2025-6102

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument macaddress leads to os command injection. The attack can be launched...

CVE-2025-6100

creationtimestamp| type| source ---|---|--- 2025-06-16 01:54:51+00:00| seen| https://bsky.app/profile/potato.software/post/3lrouraxx3k2l 2025-06-16 04:36:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18413 2025-06-16 05:27:45+00:00| seen|...

CVE-2025-6096

creationtimestamp| type| source ---|---|--- 2025-06-16 01:28:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrotcbt5fn23 2025-06-16 16:35:59+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18466...

CVE-2025-6099

A vulnerability was found in szluyu99 gin-vue-blog up to 61dd11ccd296e8642a318ada3ef7b3f7776d2410. It has been declared as critical. This vulnerability affects unknown code of the file gin-blog-server/internal/manager.go of the component PATCH Request Handler. The manipulation leads to improper...

CVE-2025-33108

IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to...