CVE-2025-49236

CVE-2025-49236 is a real Missing Authorization vulnerability affecting Raychat up to version 2.1.0, where functionality is accessible without proper ACL constraints. The CVE is documented with a CVSS v3.1 base score of 5.3 (Network attack, Low attack complexity, No privileges, No user interaction...

CVE-2025-5760

The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the appenddebuginfotocontext function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $POST and...

CVE-2025-48337

Missing Authorization vulnerability in QuickcabWP QuickCab.This issue affects QuickCab: from n/a through 1.3.3...

CVE-2025-41361

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit th...

CVE-2025-41361 Uncontrolled resource consumption vulnerability in IDF and ZLF

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit th...

CVE-2025-48329 WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daman Jeet Real Time Validation for Gravity Forms allows Reflected XSS.This issue affects Real Time Validation for Gravity Forms: from n/a through 1.7.0...

CVE-2025-47586

CVE-2025-47586 is an unauthenticated Local File Inclusion in the WordPress plugin Motors - Events (versions up to and including 1.4.7). Exploitation arises from improper filename handling in PHP Include/Require, enabling an attacker to trick the application into including local files. Public sour...

CVE-2025-5239 Domain For Sale <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter

The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘classname’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-48781

creationtimestamp| type| source ---|---|--- 2025-06-06 11:02:40+00:00| seen| Telegram/IzUnLEyll0bCDFLZZ6Gvcvh0qc-X8AIjXpNZJHup4VBEb48 2025-06-06 11:12:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqwpbxdvre2q...

CVE-2025-5758

CVE-2025-5758 affects SourceCodester Open Source Clinic Management System v1.0. The vulnerability is a SQL injection in the /doctor.php file triggered by manipulating the doctorname parameter, with remote access possible and multiple parameters potentially affected. Exploitation details are publi...

CVE-2025-48781

An external control of file name or path vulnerability in the download file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to obtain partial files by specifying arbitrary file paths...

CVE-2025-48780

creationtimestamp| type| source ---|---|--- 2025-06-06 09:31:41+00:00| published-proof-of-concept| Telegram/mYiFhS0KI41FnuJb80DPaIeUDJlgHATfKqT73V-Gr4Yn1fQ 2025-06-06 11:02:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqwoq2edic2q...

CVE-2025-48782 Soar Cloud HRD Human Resource Management System - Unrestricted Upload of File with Dangerous Type

An unrestricted upload of file with dangerous type vulnerability in the upload file function of Soar Cloud HRD Human Resource Management System through version 7.3.2025.0408 allows remote attackers to execute arbitrary system commands via a malicious file...

CVE-2025-3365

A missing protection against path traversal allows to access any file on the server...

CVE-2025-5192

Affected software: Soar Cloud HRD Human Resource Management System (client application) up to version 7.3.2025.0408. Vulnerability: Missing authentication for a critical function, allowing remote attackers to bypass authentication and access application functions. Root cause / details: Described ...

CVE-2025-5737 TOTOLINK X15 HTTP POST Request formDosCfg buffer overflow

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formDosCfg of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer...

CVE-2025-3322

CVE-2025-3322 describes improper neutralization of inputs used in an expression language that enables remote code execution with the highest privileges. Connected documents indicate the vulnerability is associated with B. Braun onlinesuite (OnlineSuite); a separate PT Security entry references Ap...

CVE-2025-47725

Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process...

CVE-2025-48905

creationtimestamp| type| source ---|---|--- 2025-06-06 07:32:25+00:00| seen| Telegram/TeB6u0cRcgm4Z57WWM6dLDMUNimVLv6dDJXV21QEae9BFw0 2025-06-07 06:10:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114640591452318736...

CVE-2025-5729

A vulnerability, which was classified as critical, was found in code-projects Health Center Patient Record Management System 1.0. Affected is an unknown function of the file /birthingrecord.php. The manipulation of the argument itrno leads to sql injection. It is possible to launch the attack...