PT-2025-25243 · Autel · Autel Maxicharger Ac Wallbox

Name of the Vulnerable Software and Affected Versions: Autel MaxiCharger AC Wallbox affected versions not specified Description: The issue concerns a dangerous method information disclosure vulnerability where the commercial serial number is exposed. This vulnerability was discovered by Sina...

CVE-2025-5975 PHPGurukul Rail Pass Management System download-pass.php cross site scripting

A vulnerability, which was classified as problematic, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of the file /rpms/download-pass.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotel...

CVE-2025-49142

creationtimestamp| type| source ---|---|--- 2025-06-10 17:28:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrbg5cpqiv23 2025-06-10 17:32:32+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17940...

CVE-2024-57189

In Erxes 1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler...

CVE-2025-33070

CVE-2025-33070 is reported in EU/NCSC context as affecting Windows Netlogon, caused by use of an uninitialized resource, enabling an unauthenticated attacker to obtain elevated privileges. The CVSS vector indicates network access is required with high impact on confidentiality, integrity, and ava...

CVE-2025-29828 Windows Schannel Remote Code Execution Vulnerability

...

CVE-2025-471648

creationtimestamp| type| source ---|---|--- 2025-06-10 16:45:25+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2025-0189...

CVE-2025-49142 Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...

CVE-2025-30220 GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity XXE exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in...

CVE-2024-29198

CVE-2024-29198 affects GeoServer via an unauthenticated SSRF vulnerability in the Demo Request endpoint when Proxy Base URL is not set. The root cause is insufficient validation/controls in the TestWfsPost path, allowing the server to issue requests on behalf of an attacker to internal networks o...

Google bug allowed phone number of almost any user to be discovered

Google has fixed vulnerabilities that made it possible to retrieve the phone numbers of almost any Google user. The flaw was found in the flow that allows users to recover their Google account using a phone number. A cybersecurity researcher called Brutecat was able to figure out the phone number...

Researcher Found Flaw to Discover Phone Numbers Linked to Any Google Account

Google has stepped in to address a security flaw that could have made it possible to brute-force an account's recovery phone number, potentially exposing them to privacy and security risks. The issue, according to Singaporean security researcher "brutecat," leverages an issue in the company's...

CVE-2025-40660 Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS

An Insecure Direct Object Reference IDOR vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/select node/data.asp?mode=catalogue&id1=1&id2=1session=&cod=1&networks=0...

CVE-2025-4840

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-4601

The "RH - Real Estate WordPress Theme" theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.0. This is due to the theme not properly restricting user roles that can be updated as part of the inspiryupdateprofile function. This makes it possible for...

CVE-2025-5910

TOTOLINK EX1200T (up to version 4.1.2cu.5232_B20210713) is affected by a buffer overflow in the HTTP POST Request Handler’s /boafrm/formWsc functionality. The vulnerability enables remote exploitation leading to potential arbitrary code execution or disruption, as described across multiple source...

CVE-2025-42995

creationtimestamp| type| source ---|---|--- 2025-06-10 01:33:53+00:00| seen| Telegram/VjI6o5iinQgIrx0kweQ6vZ4ijUEDsimPFeQ2gUe4Yzczac 2025-06-10 03:07:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr7w256lgb2p...

CVE-2025-5906

creationtimestamp| type| source ---|---|--- 2025-06-10 01:28:37+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17818 2025-06-10 01:33:54+00:00| published-proof-of-concept| Telegram/UVPTEGvNWegLT6R4iAM8IA5DDdZ7pzDRTagvDaZDKFK5Xkw 2025-06-10 03:27:36+00:00| seen|...

CVE-2025-0037

In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow access to isolated or protected memory spaces, resulting in the loss of integrity and confidentiality...

CVE-2025-46041

creationtimestamp| type| source ---|---|--- 2025-06-09 19:40:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr752khs342p 2025-06-09 20:31:31+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17773 2025-06-16 21:02:29+00:00| seen|...