CVE-2025-29629: Use of Default Credentials

Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits...

CVE-2025-29628: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to interception and modification through a...

CVE-2025-29629

CVE-2025-29629 affects Gardyn Home Kit ecosystem (Firmware < master.619, Mobile App < 2.11.0, Cloud API

Towards Privacy-Preserving and Personalized Smart Homes Via Tailored Small Language Models

Large Language Models LLMs have showcased remarkable generalizability in language comprehension and hold significant potential to revolutionize human-computer interaction in smart homes. Existing LLM-based smart home assistants typically transmit user commands, along with user profiles and home...

D-Link DIR-645 注入漏洞

D-Link DIR-645 is a Gigabit wireless router for home and SMB users launched by D-Link in 2012. The D-Link DIR-645 suffers from a command injection vulnerability that stems from the failure of the file /htdocs/cgibin function ssdpcgimain in the component ssdpcgi to correctly filter constructed...

Exploit for CVE-2025-29628

Summary In February 2025 I conducted security research on a...

CVE-2025-5014

The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wpremcswidgetfiledelete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with...

Old Age Home Management System SQL Injection Vulnerability

Old Age Home Management System is a nursing home management system. Old Age Home Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter emeradd in file /admin/add-scdetails.php. An attacker can...

Malicious code in baileys-cleaner (npm)

The package communicates with a domain associated with malicious activity. It archives /home/container & exfiltrates data to catbox.moe & Firebase, including IP address. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware...

CVE-2025-5014

The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wpremcswidgetfiledelete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with...

CVE-2025-5014 Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion

The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wpremcswidgetfiledelete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with...

CVE-2025-5014 Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion

The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wpremcswidgetfiledelete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with...

WordPress plugin Home Villas 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2025-5014: Improper Limitation of a Pathname to a Restricted Directory

The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wpremcswidgetfiledelete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with...

WordPress Home Villas theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Thái An in WordPress Theme Home Villas versions = 2.8...

CVE-2025-6909

A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-scdetails.php. The manipulation of the argument emeradd leads to sql injection. The attack can be launched...

CVE-2025-6909 PHPGurukul Old Age Home Management System add-scdetails.php sql injection

A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-scdetails.php. The manipulation of the argument emeradd leads to sql injection. The attack can be launched...

CVE-2025-6909 PHPGurukul Old Age Home Management System add-scdetails.php sql injection

A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-scdetails.php. The manipulation of the argument emeradd leads to sql injection. The attack can be launched...

CVE-2025-6908

A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument sertitle leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-6908

CVE-2025-6908 affects PHPGurukul Old Age Home Management System v1.0. The vulnerability resides in the /admin/edit-services.php file where user-controlled parameter sertitle can be manipulated to perform a SQL injection. The issue is exploitable remotely and has been disclosed publicly. Several c...