9695 matches found
CVE-2025-4731 TOTOLINK A3002R/A3002RU HTTP POST Request formPortFw buffer overflow
A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument servicetype/ipsubnet leads to buffer overflow. It is...
CVE-2025-48174
In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream-offset+size...
CVE-2025-47275
Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in...
CVE-2025-20041
Uncontrolled search path for some IntelR Graphics software for IntelR Arc™ graphics and IntelR IrisR Xe graphics before version 32.0.101.6325/32.0.101.6252 may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2024-13357
creationtimestamp| type| source ---|---|--- 2025-05-15 20:46:07+00:00| seen| https://bsky.app/profile/potato.software/post/3lpaf2lnear2f...
CVE-2024-6335
creationtimestamp| type| source ---|---|--- 2025-05-15 20:37:15+00:00| seen| https://bsky.app/profile/potato.software/post/3lpaekssgag2f...
CVE-2025-46834
Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249afcaeaf76ab95517d0359fde883b0, owners of Modular Accounts can grant session keys scoped external keys to external parties and would use the...
CVE-2025-0688
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin versions 0.9.10 and earlier is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is a failure to properly sanitize and escape a parameter before it is output back onto the page. This vulnerabilit...
CVE-2024-9662 CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-8082 Widgets Reset <= 0.1 - Settings Update via CSRF
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-8032 Smooth Gallery Replacement <= 1.0 - CSRF to Stored XSS
The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
CVE-2024-13621 The GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSS
The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-30475
creationtimestamp| type| source ---|---|--- 2025-05-15 19:19:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114513460850440442 2025-05-15 22:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpalbvcgu32h...
CVE-2025-30419
creationtimestamp| type| source ---|---|--- 2025-05-15 19:02:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7b7ipks2p 2025-05-20 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-02...
CVE-2025-47279
creationtimestamp| type| source ---|---|--- 2025-05-15 17:34:33+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16542 2025-05-15 19:02:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7b7wpv52p...
CVE-2025-47580
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through = 3.2.35...
CVE-2025-29836
Out-of-bounds read in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to disclose information over a network...
CVE-2025-30385
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...
CVE-2025-4698
A vulnerability classified as critical has been found in PHPGurukul Directory Management System 2.0. This affects an unknown part of the file /admin/forget-password.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has...