CVE-2025-52485

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue...

CVE-2025-6286

creationtimestamp| type| source ---|---|--- 2025-06-19 23:40:23+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18890 2025-06-20 00:13:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lryqx3knqn2r...

CVE-2025-5141

creationtimestamp| type| source ---|---|--- 2025-06-17 21:57:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrtih2lb6s2a...

CVE-2025-48866

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg - this is the same action but an alias is...

CVE-2023-27270

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain...

CVE-2021-2302

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: OPSS. Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2021-2005

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: BI Platform Security. Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT...

CVE-2021-29441

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication -Dnacos.core.auth.enabled=true Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor...

CVE-2020-15390

pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo...

A Bootiful Podcast: V Körbes on security from the platform on up

Hi, Spring fans! In today's extra special installment I talk to Broadcom's V Körbes who works on security above and below the application...

CVE-2025-4311

creationtimestamp| type| source ---|---|--- 2025-05-06 04:20:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15044 2025-05-06 06:21:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loiajoerph2h 2025-05-06 07:00:55+00:00| published-proof-of-concept|...

CVE-2025-32973 org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without programming rights and...

CVE-2025-4036

creationtimestamp| type| source ---|---|--- 2025-04-28 20:11:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13726 2025-04-28 23:45:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnvx5vaqci2h 2025-04-29 00:06:28+00:00| seen|...

CVE-2024-12706

creationtimestamp| type| source ---|---|--- 2025-04-28 18:11:00+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13719 2025-04-28 21:45:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnvqh4moq42v 2025-04-28 22:25:59+00:00| seen| https://t.me/cvedetector/23940...

CVE-2025-2903

An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform GCP using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious...

CVE-2025-3698

creationtimestamp| type| source ---|---|--- 2025-04-16 02:55:43+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11982 2025-04-16 06:48:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmvyq76czu2a 2025-04-16 07:40:00+00:00| seen| https://t.me/cvedetector/23044...

CVE-2025-31580

creationtimestamp| type| source ---|---|--- 2025-04-01 22:57:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llrxuf5ojr2s 2025-04-01 23:56:03+00:00| seen| https://t.me/cvedetector/21809...

The vulnerability of the org.xwiki.platform:xwiki-platform-security-authorization-api component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to gain unauthorized access to protected information.

The vulnerability of the org.xwiki.platform:xwiki-platform-security-authorization-api component of the XWiki Platform lies in the insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2025-29925

XWiki Platform REST API vulnerability CVE-2025-29925: the /rest/wikis/[wikiName]/pages endpoint could disclose information about protected/private pages to unauthenticated users before fixes. The issue occurs because the endpoint listed pages even when the user had no view rights, notably when th...

CVE-2025-26707

creationtimestamp| type| source ---|---|--- 2025-03-11 07:35:35+00:00| seen| https://t.me/cvedetector/20032 2025-03-11 08:00:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lk3lxtq7qd2l...