CVE-2025-6497

A vulnerability was found in HTACG tidy-html5 5.8.0. It has been rated as problematic. This issue affects the function prvTidyParseNamespace of the file src/parser.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public an...

CVE-2025-6493

A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has bee...

CVE-2025-6490

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmapsetwithhash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approach...

CVE-2025-6477

creationtimestamp| type| source ---|---|--- 2025-06-22 13:47:58+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19162 2025-06-22 16:19:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls7hu6ex3e2r...

CVE-2025-6451

The CVE-2025-6451 entry concerns code-projects’ Simple Online Hotel Reservation System 1.0. Multiple connected sources confirm a SQL injection in the file /admin/delete_pending.php via the transaction_id parameter, allowing remote exploitation. The issue stems from lack of validation/sanitization...

CVE-2025-6375

creationtimestamp| type| source ---|---|--- 2025-06-21 00:45:09+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19087 2025-06-21 01:56:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls3h6jizrc2v...

CVE-2025-49997

CVE-2025-49997 (Giveaways and Contests by RafflePress) is a Missing Authorization issue in the WordPress plugin Giveaways and Contests by RafflePress, affecting version 1.12.17 and earlier. The advisory notes that access to functionality is not properly constrained by ACLs. Related feeds indicate...

CVE-2025-50046

CVE-2025-50046 concerns StellarWP WPComplete. Affected: WPComplete versions n/a through 2.9.5. Issue: Improper neutralization of input during web page generation, enabling Stored XSS. Consequence: stored script execution in user contexts (per CVSS metrics: Medium severity, 6.5/10). Status: patch/...

CVE-2025-32878

creationtimestamp| type| source ---|---|--- 2025-06-20 13:42:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18941 2025-06-20 17:18:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls2k7uvbtx2o...

CVE-2025-6337 TOTOLINK A3002R/A3002RU HTTP POST Request formTmultiAP buffer overflow

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615/4.0.0-B20230531.1404. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the...

CVE-2022-49977

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in isftracetrampoline when ftrace is dead ftracestartup does not remove ops from ftraceopslist when ftracestartupenable fails: registerftracefunction ftracestartup registerftracefunction...

CVE-2025-6321 PHPGurukul Pre-School Enrollment System add-subadmin.php sql injection

A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-subadmin.php. The manipulation of the argument sadminusername leads to sql injection. The attack can be...

CVE-2025-6284

The CVE-2025-6284 entry concerns PHPGurukul Car Rental Portal 3.0, where a Cross-Site Request Forgery (CSRF) vulnerability affects unknown code. Public disclosures indicate the attack can be initiated remotely and that exploitation is possible with user interaction, depending on the vector detail...

CVE-2025-6275

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

CVE-2025-6275

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

CVE-2022-49970

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix kernel BUG in purgeeffectiveprogs Syzkaller reported a triggered kernel BUG as follows: ------------ cut here ------------ kernel BUG at kernel/bpf/cgroup.c:925! invalid opcode: 0000 1 PREEMPT SMP NOPTI CPU: 1...

CVE-2025-6275

CVE-2025-6275 concerns WebAssembly wabt up to 1.0.37. The vulnerability affects the function GetFuncOffset in src/interp/binary-reader-interp.cc, where manipulation can lead to a use-after-free. It permits a local attack, with at least one public disclosure of an exploit. Connected sources consis...

CVE-2025-6271

A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2. This affects the function wavconvert2mono in the library lib/wav.c of the component wav2swf. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been...

CVE-2025-33117

CVE-2025-33117 affects IBM QRadar SIEM versions 7.5 through 7.5.0 Update Package 12. A privileged user could modify critical configuration files, enabling the upload of a malicious autoupdate file to execute arbitrary commands. This aligns with IBM’s bulletin noting high-severity impact and a fix...

CVE-2025-6270

A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5FSsectfindnode of the file H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has...