CVE-2025-23988

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bruno Cavalcante Ghostwriter allows Reflected XSS.This issue affects Ghostwriter: from n/a through 1.4...

CVE-2025-23981

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Takimi Themes CarZine allows Reflected XSS.This issue affects CarZine: from n/a through 1.4.6...

CVE-2025-4876 Hardcoded Key Revealed in ConnectWise Password Encryption Utility

ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained t...

CVE-2025-48250

CVE-2025-48250 affects the WPFactory Coupons & Add to Cart by URL Links for WooCommerce plugin (versions up to and including 1.7.7). Root cause: improper neutralization of input during web page generation, enabling stored XSS. Severity: CVSS 3.1 base score 6.5 (Medium); impact: confidentiality, i...

CVE-2025-36560

CVE-2025-36560 is a server‑side request forgery affecting many versions of the a-blog cms. The Red Hat entry documents a remote unauthenticated attacker who can gain access to sensitive information by sending a crafted request. Several sources corroborate the same vulnerability description across...

CVE-2025-23167

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by...

CVE-2025-4897

creationtimestamp| type| source ---|---|--- 2025-05-18 21:37:23+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16778 2025-05-18 22:43:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpi4ylfult2p...

CVE-2025-4875

creationtimestamp| type| source ---|---|--- 2025-05-18 14:20:49+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lphawamwyee2 2025-05-18 17:12:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lphkjyslv52o...

CVE-2025-4869

The CVE-2025-4869 entry affects itsourcecode Restaurant Management System 1.0 . Affected component: the file /admin/member_update.php , where manipulating the menu parameter enables a SQL injection . This is a remote attacker risk; multiple sources note public disclosure. A patch/fixed version is...

CVE-2025-3715

creationtimestamp| type| source ---|---|--- 2025-05-18 06:25:13+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpggdri2rer2 2025-05-18 09:13:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpgpqrbxpg2o 2025-05-19...

CVE-2025-4169

The Posts per Cat Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-47916

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller file: /applications/core/modules/front/system/themeeditor.php, where a protected method named customCss can be invoked by...

CVE-2025-4839

A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /paicoding-core/src/main/java/com/github/paicoding/forum/core/util/CrossUtil.java. The manipulation leads to permissiv...

CVE-2025-4722

A vulnerability classified as critical has been found in itsourcecode Placement Management System 1.0. Affected is an unknown function of the file /editprofile.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-4918 Out-of-bounds access when resolving Promise objects

An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2...

CVE-2025-26481

Dell PowerScale OneFS, versions 9.4.0.0 through 9.9.0.0, contains an uncontrolled resource consumption vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to denial of service...

CVE-2025-4830

CVE-2025-4830 affects TOTOLINK A702R, A3002R and A3002RU running 3.0.0-B20230809.1615. The vulnerability is in the HTTP POST Request Handler, specifically the file /boafrm/formSysCmd, where manipulating the submit-url parameter leads to a buffer overflow . The issue can be exploited remotely and ...

CVE-2025-4830 TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formSysCmd buffer overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected by this issue is some unknown functionality of the file /boafrm/formSysCmd of the component HTTP POST Request Handler. The manipulation of the argument submit-url...

CVE-2025-4819

CVE-2025-4819 affects y_project Ruoyi 4.8.0, targeting the /monitor/online/batchForceLogout path in the Offline Logout component. The issue arises from manipulation of the ids argument, leading to improper authorization and enabling a remote attack. The exploit is described as high complexity, bu...

CVE-2025-3812 WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion

The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcldopenaideletetrainingfile function in all versions up to, and including, 13.6.2. This makes it possible for authenticated attackers, with Subscriber-lev...