CVE-2025-4036

CVE-2025-4036 affects Novel 201206030, version 3.5.0, specifically the updateBookChapter function in Chapter Handler (AuthorController.java). The root cause is improper access controls, enabling a remote attack. Public exploit disclosure is noted across multiple feeds. Some sources (e.g., PT-2025...

CVE-2025-43862

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-2101

CVE-2025-2101 (Edumall theme for WordPress) Unauthenticated Local File Inclusion via the template parameter of the edumall_lazy_load_template AJAX action affects Edumall

CVE-2024-12244

An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1...

CVE-2025-3667

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3674

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The...

CVE-2025-3675

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been...

CVE-2025-3668

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has...

CVE-2025-32796

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes...

WordPress plugin Xpro Elementor Addons - Pro 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Conquer HIPAA Controls With Wiz

Demystifying HIPAA: How Wiz Can Be Your Compliance Ally...

CVE-2025-46535

Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login and Registration: from n/a through 1.0.0...

The vulnerability of the Cisco Secure Email Gateway security system’s operating system, Cisco AsyncOS, allows a hacker to circumvent existing security restrictions.

The vulnerability of the Cisco Secure Email Gateway security system’s operating system, Cisco AsyncOS, is related to access control errors. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

CVE-2025-43862: Improper Access Control

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-26382

Johnson Controls iSTAR Configuration Utility (ICU) Tool is affected by CVE-2025-26382 due to a buffer overflow under certain circumstances. The tool/process can lead to arbitrary code execution with high impact to confidentiality, integrity, and availability, per CVSS metrics (CRITICAL, network a...

CVE-2025-26382 Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool

Under certain circumstances the iSTAR Configuration Utility ICU tool could have a buffer overflow issue...

Exploit for OS Command Injection in Raisecom Msg2300_Firmware

This is a PoC exploit for CVE-2024-7120, a vulnerability in an u...

CISA Releases Seven Industrial Control Systems Advisories

CISA released seven Industrial Control Systems ICS advisories on April 24, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-114-01 Schneider Electric Modicon Controllers ICSA-25-114-02 ALBEDO Telecom Net.Time -...

Securing Fintech Operations Through Smarter Controls and Automation

With the rise of fintechs, accuracy alone isn’t enough, security and reliability are just as necessary. For fintech…...

CVE-2024-12244

CVE-2024-12244†Missing Authorization in GitLab . The issue is an access-control flaw in GitLab Enterprise Edition (GitLab EE) that could allow a user to view certain restricted project information even when related features are disabled. Affected versions are GitLab EE 17.7 up to 17.9.7, 17.10 up...