CVE-2025-23176

CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...

CVE-2025-23175

creationtimestamp| type| source ---|---|--- 2025-04-22 13:03:35+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12838 2025-04-22 15:05:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnfxbp53tn2l 2025-04-22 16:43:52+00:00| seen| https://t.me/cvedetector/23511...

CVE-2025-3472 Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2025-32844

creationtimestamp| type| source ---|---|--- 2025-04-22 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01...

CVE-2025-46245 WordPress CM Ad Changer plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site Request Forgery.This issue affects CM Ad Changer: from n/a through = 2.0.5...

CVE-2025-28030

TOTOLINK A810R V4.1.2cu.5182B20201026 was discovered to contain a stack overflow via the startTime and endTime parameters in setParentalRules function...

CVE-2024-40445

The vulnerability CVE-2024-40445 affects forkosh Mime TeX prior to version 1.77 on Windows, due to a directory traversal flaw in crafted input paths. An attacker can read or append arbitrary files by manipulating input paths, enabling local file access and potential data tampering. The provided d...

CVE-2025-3847

A vulnerability classified as critical has been found in markparticle WebServer up to 1.0. This affects an unknown part of the file code/http/httprequest.cpp of the component Login. The manipulation of the argument username/password leads to sql injection. It is possible to initiate the attack...

CVE-2025-28104

creationtimestamp| type| source ---|---|--- 2025-04-21 18:02:37+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12717 2025-04-21 20:59:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lne2luqwlp2b 2025-04-21 22:20:11+00:00| seen|...

CVE-2025-43973

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...

CVE-2025-43971

creationtimestamp| type| source ---|---|--- 2025-04-21 01:02:23+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12629 2025-04-21 01:23:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114373334403320705 2025-04-21 01:51:05+00:00| seen|...

CVE-2025-43961

In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser...

CVE-2025-43929

openactions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document e.g., a document opened in KDE ghostwriter...

CVE-2025-43920

GNU Mailman 2.1.39, as bundled in cPanel and WHM, in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardles...

CVE-2025-43961

Summary (CVE-2025-43961 family) LibRaw before 0.21.4 has multiple memory-safety issues. The Mageia advisory confirms CVE-2025-43961 affects the Fujifilm 0xf00c tag parser in metadata/tiff.cpp, causing an out-of-bounds read. Additional CVEs in the same LibRaw series are described in the advisory: ...

CVE-2025-43955

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression. Convertigo 8.3.11 fixes the issue by assigning an empty FunctionLibrary to JXPath...

CVE-2022-47111

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected...

BELL-CVE-2025-37925

Bulletin has no description...

CVE-2025-2111 WP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update

The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custompluginsetoption' function. This makes it possible for unauthenticated attackers to update...

CVE-2025-43900

creationtimestamp| type| source ---|---|--- 2025-04-19 04:00:00+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12571 2025-04-19 06:39:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ln5jm5lfjy2j...