9700 matches found
CVE-2025-21582
...
CVE-2025-21582
...
CVE-2025-21581
CVE-2025-21581 affects Oracle MySQL Server (component: Server: Optimizer). Affected versions are 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0. The vulnerability is exploitable over the network with high privileges and can cause a hang or a frequently repeating crash (complete DoS) of MySQL Server. ...
CVE-2025-21579
...
CVE-2025-21578
CVE-2025-21578 affects Oracle Secure Backup (General component). Affects Oracle Secure Backup versions 12.1.0.1–12.1.0.3 and 18.1.0.0–18.1.0.2. The issue allows a high-privileged attacker with logon to the infrastructure where Oracle Secure Backup runs to compromise the product, potentially leadi...
CVE-2025-21574
...
CVE-2025-21573
...
CVE-2025-32778 Web-Check allows command Injection via Unvalidated URL in Screenshot API
Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project Lissy93/web-check. The issue stems from user-controlled input url being passed unsanitized into a shell command using exec, allowing attackers t...
CVE-2025-31949
Growatt Cloud Applications (Growatt Cloud portal) is affected by CVE-2025-31949. An authenticated attacker can obtain arbitrary plant names by supplying a plant ID, indicating an access/validation weakness in the plant-name retrieval mechanism. Public details confirm vulnerable versions include 3...
CVE-2025-31933 Growatt Cloud Applications Authorization Bypass Through User-Controlled Key
An unauthenticated attacker can check the existence of usernames in the system by querying an API...
CVE-2025-33026
In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicio...
CVE-2025-28136
creationtimestamp| type| source ---|---|--- 2025-04-15 16:38:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmujatgh4m2g 2025-04-15 17:26:32+00:00| seen| https://t.me/cvedetector/22953...
CVE-2025-24949
creationtimestamp| type| source ---|---|--- 2025-04-15 15:54:54+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11858 2025-04-15 18:43:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmuqak72xv2j 2025-04-15 19:57:03+00:00| seen| https://t.me/cvedetector/22965...
CVE-2025-3523
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...
CVE-2025-31945
creationtimestamp| type| source ---|---|--- 2025-04-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04 2025-04-15 22:44:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmv5o2sh272h 2025-04-16 01:48:53+00:00| seen| https://t.me/cvedetector/2302...
CVE-2025-32993
Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password aka index.php?/home/forgot-password visusername parameter. Authentication is not needed...
CVE-2025-24358
gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...
CVE-2025-29471
A stored Cross-Site Scripting (XSS) vulnerability exists in Nagios Log Server version 2024R1.3.1 and below. The flaw allows a low-privileged user to inject malicious JavaScript into the email field of their profile. When an administrator views the audit logs, the payload executes, enabling the at...
CVE-2025-32996
In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...
CVE-2025-33026
In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicio...