CVE-2025-49139

creationtimestamp| type| source ---|---|--- 2025-06-09 21:31:57+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17783 2025-06-09 23:23:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr7jjqz7562e...

CVE-2025-5918

creationtimestamp| type| source ---|---|--- 2025-06-09 20:31:17+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17764 2025-06-09 23:14:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr7iyfsyb22m 2025-08-18 17:38:39+00:00| seen|...

CVE-2025-49136 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-use...

CVE-2025-48122

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows SQL Injection.This issue affects...

CVE-2025-32595

CVE-2025-32595 is a WordPress Krowd (Krowd theme) vulnerability: an unauthenticated Local File Inclusion (LFI) due to improper filtering of local file resource calls in the PHP include/require flow, affecting Krowd up to version 1.4.1. The CVE is linked to Wordfence and CNVD entries that describe...

CVE-2025-48130 WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through = 2.0.7.4...

CVE-2025-5873

creationtimestamp| type| source ---|---|--- 2025-06-09 15:13:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr6o5n5xp62e 2026-01-09 02:01:06+00:00| published-proof-of-concept| Telegram/9r3a4T582Uj-d8cAzOCMsayyXRdqw-Vs2IIS-Y7LNVntDY 2026-01-09 20:36:34+00:00| seen|...

CVE-2025-27817

creationtimestamp| type| source ---|---|--- 2025-06-09 13:00:36+00:00| seen| https://seclists.org/oss-sec/2025/q2/235 2025-06-09 15:29:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lr6ozuh2lg2c 2025-06-10 08:32:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17841...

CVE-2025-48062 Discourse vulnerable to HTML injection when inviting to topic via email

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML...

WordPress MapSVG plugin < 8.6.13 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Anhchangmutrang Patchstack Alliance in WordPress Plugin MapSVG versions 8.6.13...

CVE-2025-5912

creationtimestamp| type| source ---|---|--- 2025-06-09 08:17:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114652415438530839 2025-06-10 04:31:27+00:00| published-proof-of-concept| Telegram/SuCuNuYYG7YH6LF-PMvjYx2GIDz9A5wanFKy4pWUO100XY8 2025-06-10 05:49:07+00:00| seen|...

CVE-2025-5868 RT-Thread lwp_syscall.c sys_thread_sigprocmask array index

A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function systhreadsigprocmask of the file rt-thread/components/lwp/lwpsyscall.c. The manipulation of the argument how leads to improper validation of array index...

CVE-2025-47711

creationtimestamp| type| source ---|---|--- 2025-06-09 07:03:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr5sritivt2s 2026-01-08 05:03:39+00:00| seen| Telegram/36YuQ0XqAI4G5bdAUQmNkQIL1fMhKkwMpqpsGMiepBkvTc...

CVE-2025-5852

creationtimestamp| type| source ---|---|--- 2025-06-09 02:00:40+00:00| published-proof-of-concept| Telegram/AJN0S8YZYdVmzbOgnKAjxxpHw3CsdDBYQVeb8zgl5Lh2q4 2025-06-09 03:18:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr5g6sv7w52e...

CVE-2025-26693

creationtimestamp| type| source ---|---|--- 2025-06-08 15:03:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr453hrlaj2m...

CVE-2025-49286

Cross-Site Request Forgery CSRF vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through = 2.0.6...

CVE-2025-5737

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formDosCfg of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer...

CVE-2025-49599

Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account to disable ONT firewall functionality, e.g., to remove the default blocking of the SSH and TELNET TCP ports, aka HWNO-56Q3...

CVE-2024-9993

creationtimestamp| type| source ---|---|--- 2025-06-07 15:02:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqzmm6i6cf2o...

CVE-2025-5568

creationtimestamp| type| source ---|---|--- 2025-06-07 14:57:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqzmd7zs4b2q 2025-06-09 16:56:13+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17710...