CVE-2025-5609

creationtimestamp| type| source ---|---|--- 2025-06-04 21:07:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqsplhn5so2q 2025-06-04 21:18:00+00:00| seen| https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3lqsq5nk7dyk2...

WordPress Sunshine Photo Cart plugin <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by WordFence in WordPress Plugin Sunshine Photo Cart versions = 3.4.11...

CVE-2025-31134

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain software is installed on the server...

CVE-2025-22245

creationtimestamp| type| source ---|---|--- 2025-06-04 20:06:01+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqsm3qovos42 2025-06-04 20:40:16+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114627026280664501...

CVE-2025-32015 FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, HTML is sanitized improperly inside the attribute, which leads to cross-site scripting XSS by loading an attacker's UserJS inside . In order to execute the attack, the attacker needs to control one of the victim's feeds and...

CVE-2025-20279

creationtimestamp| type| source ---|---|--- 2025-06-04 18:53:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqsi3ornjj2r...

[SECURITY] [DSA 5935-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5935-1 [email protected] https://www.debian.org/security/ Andres Salomon June 04, 2025 https://www.debian.org/security/faq -...

CVE-2025-47727

creationtimestamp| type| source ---|---|--- 2025-06-04 08:33:57+00:00| seen| Telegram/rzYr6oSh9PAauXcQEyfoiM17XavJOamHeAHzlIt-IhTrU 2025-06-04 10:59:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqrnm3oh352e 2025-06-24 10:00:00+00:00| seen|...

CVE-2025-47726

Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process...

CVE-2025-5569

creationtimestamp| type| source ---|---|--- 2025-06-04 07:24:16+00:00| seen| https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3lqrbjgjrxnb2 2025-06-18 08:45:57+00:00| confirmed|...

CVE-2025-5573

creationtimestamp| type| source ---|---|--- 2025-06-04 07:23:54+00:00| seen| https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3lqrbimhqv7h2...

CVE-2025-5482 Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation

The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for...

CVE-2025-5539

creationtimestamp| type| source ---|---|--- 2025-06-04 07:15:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqrb47rzrz2e...

CVE-2025-4580 File Provider <= 1.2.3 - Item Deletion via CSRF

The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2025-20994

Improper handling of insufficient permission in SyncClientProvider in Samsung Internet installed on non-Samsung Device prior to version 28.0.0.59 allows local attackers to access read and write arbitrary files...

CVE-2025-20993

The CVE-2025-20993 entry concerns libsecimaging.camera.samsung.so with an out-of-bounds write, enabling local attackers to write memory past bounds. Affected: libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1. Root cause described as an out-of-bounds write; impact is local memory ma...

CVE-2025-20992

Out-of-bound read in libsecimaging.camera.samsung.so prior to SMR Feb-2025 Release 1 allows local attackers to read out-of-bounds memory...

CVE-2025-20984

Incorrect default permission in Samsung Cloud for Galaxy Watch prior to SMR Jun-2025 Release 1 allows local attackers to access data in Samsung Cloud for Galaxy Watch...

CVE-2025-5557 PHPGurukul Teacher Subject Allocation Management System edit-course.php sql injection

A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit-course.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotel...

CVE-2025-5549

creationtimestamp| type| source ---|---|--- 2025-06-04 01:23:54+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqqn7sdsk2w2 2025-06-04 01:31:30+00:00| published-proof-of-concept| Telegram/zUVTgXvzkwLEqz2FR1DEMSQdpoQl8zaI1Yp9yK0vMGoKWE...