20290 matches found
CVE-2025-32415
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. Mitigation...
PT-2025-20914 · Totolink · Totolink A3002Ru
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 4.0.0-B20230531.1404 Description: A buffer overflow issue was discovered via the addrPoolStart parameter in the "formDhcpv6s" interface. Recommendations: For TOTOLINK A3002R version 4.0.0-B20230531.1404, consider...
CVE-2025-29459
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation...
Qrator Labs Reports Mitigating Year’s Largest DDoS Attack to Date
Qrator Labs reports it mitigated a massive record 965 Gbps DDoS attack in April 2025, the largest incident…...
WordPress Avatar plugin <= 0.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability
Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by theviper17y in WordPress Plugin Avatar versions = 0.1.4...
CVE-2025-1688
Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional protection that is enabled on the...
WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability
Arbitrary File Upload Vulnerability discovered by johska Patchstack Alliance in WordPress Plugin I Draw versions = 1.0...
WordPress Taskbuilder plugin <= 4.0.1 - SQL Injection Vulnerability
SQL Injection Vulnerability discovered by astra.r3verii in WordPress Plugin Taskbuilder versions = 4.0.1...
WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Le Ngoc Anh in WordPress Plugin Rating by BestWebSoft versions = 1.7...
Exploit for SQL Injection in Appventure Dietiqa
CVE-2025-28009 - SQL Injection in Dietiqa App v1.0.20 Di...
WordPress Ivy School Theme <= 1.6.0 is vulnerable to Local File Inclusion
Software Ivy School Type Theme Vulnerable versions = 1.6.0 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39470 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 2982cc652634 Credits Bonds Required privilege Unauthenticated...
Adversary-Augmented Simulation for Fairness Evaluation and Defense in Hyperledger Fabric
This paper presents an adversary model and a simulation framework specifically tailored for analyzing attacks on distributed systems composed of multiple distributed protocols, with a focus on assessing the security of blockchain networks. Our model classifies and constrains adversarial actions...
WordPress Modal Survey plugin <= 2.0.2.0.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Modal Survey versions = 2.0.2.0.1...
CVE-2011-2501 affecting package syslinux for versions less than 6.04-11
CVE-2011-2501 affecting package syslinux for versions less than 6.04-11. A patched version of the package is available...
InjectLab: a Tactical Framework for Adversarial Threat Modeling against Large Language Models
Large Language Models LLMs are changing the way people interact with technology. Tools like ChatGPT and Claude AI are now common in business, research, and everyday life. But with that growth comes new risks, especially prompt-based attacks that exploit how these models process language. InjectLa...
Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035
Stage File Proxy is a general solution for getting production files on a development server on demand. The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them. An attacker could send many requests and exhaust disk resources. This...
CVE-2025-30731
...
CVE-2025-30726
...