CVE-2025-66412

creationtimestamp| type| source ---|---|--- 2025-12-02 01:24:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6xrv4muiu2w 2025-12-03 05:20:13+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m72pixudp32h 2025-12-03 13:10:04+00:00| seen|...

CVE-2025-63533

A cross-site scripting XSS vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript...

CVE-2025-63527

A cross-site scripting XSS vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and hprofile.php components. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript...

Piwigo 13.6.0 - SQL Injection

Exploit Title: Piwigo 13.6.0 - SQL Injection Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/Piwigo/Piwigo Software Link: https://github.com/Piwigo/Piwigo Version: 13.6.0 Tested on: Windows CVE : CVE-2023-33362 Proof Of Concept: GET /admin.php?page=profile&userid='...

PT-2025-48647

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible...

PT-2025-48745

Name of the Vulnerable Software and Affected Versions ESF-IDF versions 5.5.1 through 5.1.6 Description ESF-IDF is the Espressif Internet of Things IOT Development Framework. When AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth...

CVE-2025-66382

creationtimestamp| type| source ---|---|--- 2025-12-01 23:47:38+00:00| seen| https://seclists.org/oss-sec/2025/q4/224 2025-12-02 01:09:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m6xqzozzjo2g 2026-02-12 12:30:41+00:00| seen|...

CVE-2025-57489

creationtimestamp| type| source ---|---|--- 2025-12-01 23:12:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6xkhvo7vr2b...

EUVD-2025-200092

A blind SQL Injection SQLi vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/updateprofileServer endpoint...

CVE-2025-66304

creationtimestamp| type| source ---|---|--- 2025-12-01 20:42:43+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-gq3g-666w-7h85 2025-12-01 22:29:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6xi3vr43k2j...

CVE-2025-66303

creationtimestamp| type| source ---|---|--- 2025-12-01 20:42:17+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-x62q-p736-3997 2025-12-01 22:46:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6xiz7ugc72j...

CVE-2025-51683

A blind SQL Injection SQLi vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/updateprofileServer endpoint...

CVE-2024-31084

creationtimestamp| type| source ---|---|--- 2025-12-01 17:22:42+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3m6wwwxb2rc25...

CVE-2025-13281

creationtimestamp| type| source ---|---|--- 2025-12-01 16:37:57+00:00| seen| https://seclists.org/oss-sec/2025/q4/221 2025-12-01 18:15:05+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m6wzun2hi52h 2025-12-02 13:56:03+00:00| seen|...

CVE-2025-63533

A cross-site scripting XSS vulnerability exists in the Blood Bank Management System 1.0 within the updateprofile.php and rprofile.php components. The application fails to properly sanitize or encode user-supplied input before rendering it in response. An attacker can inject malicious JavaScript...

CVE-2024-45370

An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability...

CVE-2025-66302

creationtimestamp| type| source ---|---|--- 2025-12-01 15:51:25+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-j422-qmxp-hv94 2025-12-01 22:32:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6xibutlho2w...

CVE-2024-45370

An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability...

EUVD-2024-55108

An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability...

CVE-2024-45370

Talos reports CVE-2024-45370 as an authentication bypass in Socomec Easy Config System 2.6.1.0. The flaw arises in the User profile management module, where the application stores credentials in a local sqlite database. An attacker who has system access can modify the database to set passwordActi...