23603 matches found
CVE-2025-5233
CVE-2025-5233 affects the WordPress Color Palette plugin. A Stored XSS vulnerability exists via the hex parameter in all versions up to 4.3.2, exploitable by authenticated attackers with Contributor-level access and above to inject scripts on pages viewed by users. The issue stems from insufficie...
CVE-2025-45985
Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bsSetSSIDHide function...
Fedora: Security Advisory (FEDORA-2025-49ae47f4ef)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-28384
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...
CVE-2025-45984
Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100AZ3 V1.0.4, BL-X10AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200AT1 V1.0.0, BL-X26AC8 V1.2.8, BLAC450MAE4 V4.0.0 and BL-X26DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub45B238 functio...
CVE-2025-28389
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...
CVE-2025-45988
Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bsSetCmd function...
CVE-2025-32717
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...
CVE-2025-44091
creationtimestamp| type| source ---|---|--- 2025-06-12 21:34:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18234 2025-06-13 01:07:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrhaph3p732p...
CVE-2025-49589
PCSX2 is a free and open-source PlayStation 2 PS2 emulator. A stack-based buffer overflow exists in the KprintfHLE function of PCSX2 versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow a remote attacker to execute arbitrary code if the user enabled IOP...
CVE-2025-49589
CVE-2025-49589 (PCSX2) affects the PCSX2 PS2 emulator. A stack-based buffer overflow exists in the Kprintf_HLE function in versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow an attacker to execute arbitrary code if IOP Console Logging is enabled (describe...
CVE-2025-36539
AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service...
CVE-2025-4418
An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow a miscreant with elevated privileges to modify PI Connector for CygNet local data files cache and buffers in a way that causes the...
CVE-2025-5485 SinoTrack GPS Receiver Weak Authentication
User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequenc...
CVE-2025-5484 SinoTrack GPS Receiver Weak Authentication
A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced duri...
CVE-2025-43200
creationtimestamp| type| source ---|---|--- 2025-06-12 18:45:37+00:00| seen| https://infosec.exchange/users/decio/statuses/114671873989460196 2025-06-13 05:03:00+00:00| seen| https://thehackernews.com/2025/06/apple-zero-click-flaw-in-messages.html 2025-06-13 07:42:35+00:00| seen|...
CVE-2025-0051
Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service...
CVE-2025-47171
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally...