CVE-2025-3324 godcheese/code-projects Nimrod FileRestController.java unrestricted upload

A vulnerability, which was classified as critical, has been found in godcheese/code-projects Nimrod 0.8. Affected by this issue is some unknown functionality of the file FileRestController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotel...

CVE-2025-31492 mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a modauthopenidc results in disclosure of protected content to unauthenticated users. The...

CVE-2025-32200

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Nikita Advanced WordPress Backgrounds allows Code Injection. This issue affects Advanced WordPress Backgrounds: from n/a through 1.12.4...

CVE-2025-32370

creationtimestamp| type| source ---|---|--- 2025-04-06 07:38:01+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10632 2025-04-06 09:12:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lm544lc5jd26 2025-04-06 10:00:59+00:00| published-proof-of-concept|...

CVE-2025-25001

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-32257

CVE-2025-32257 affects the WordPress plugin 1 Click WordPress Migration (1-click-migration). The connected documents describe an information-disclosure vulnerability caused by uncleared debug information, allowing retrieval of embedded sensitive data. Exploitation is unauthenticated and requires ...

CVE-2025-32152 WordPress Slider a SlidersPack Plugin <= 2.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Essential Plugin Slider a SlidersPack sliderspack-all-in-one-image-sliders allows PHP Local File Inclusion.This issue affects Slider a SlidersPack: from n/a through = 2.3...

CVE-2025-3237

creationtimestamp| type| source ---|---|--- 2025-04-04 13:07:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llyicieqdo2o 2025-04-04 14:40:22+00:00| seen| https://t.me/cvedetector/22114...

CVE-2025-2245

CVE-2025-2245 describes an SSRF in Bitdefender GravityZone Update Server when in Relay Mode. The HTTP proxy on port 7074 uses a domain allowlist but fails to sanitize hostnames containing null-byte sequences (e.g., evil.com%00.bitdefender.com), allowing an attacker to bypass the allowlist and for...

CVE-2025-3236

creationtimestamp| type| source ---|---|--- 2025-04-04 09:35:52+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10420 2025-04-04 13:07:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llyichoty62r 2025-04-04 14:40:21+00:00| seen|...

CVE-2025-29063

An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/sethidessidcfg is not handled properly...

CVE-2025-31489

Affected product: MinIO object storage server. Vulnerability: incomplete/signature validation for unsigned-trailer uploads allows a client with an existing bucket WRITE permission and knowledge of an access-key and bucket name to upload arbitrary objects by using any secret. Impact (as stated): p...

CVE-2025-31486 Vite allows server.fs.deny to be bypassed with .svg or relative paths

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

CVE-2025-31126 Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call

Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability ...

CVE-2025-31787

Missing Authorization vulnerability in AudioTheme Cue cue allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cue: from n/a through = 2.4.4...

CVE-2025-31852

Cross-Site Request Forgery CSRF vulnerability in N-Media Bulk Product Sync sync-wc-google allows Cross Site Request Forgery.This issue affects Bulk Product Sync: from n/a through = 8.6...

CVE-2025-31907

creationtimestamp| type| source ---|---|--- 2025-04-03 14:35:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10225 2025-04-03 15:07:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llw6jvwy462x 2025-04-03 17:44:45+00:00| seen|...

CVE-2025-3155

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment...

CVE-2025-3158

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation...

CVE-2025-3155

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment...