CVE-2025-67418

ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative...

Hackers Abuse Popular Monitoring Tool Nezha as a Stealth Trojan

Cybersecurity firm Ontinue reveals how the open-source tool Nezha is being used as a Remote Access Trojan RAT to bypass security and control servers globally...

CVE-2025-15011 code-projects Simple Stock System logout.php sql injection

A vulnerability was found in code-projects Simple Stock System 1.0. Impacted is an unknown function of the file /logout.php. The manipulation of the argument uname results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser...

Xiongmai XM530 安全漏洞

Xiongmai XM530 is a video surveillance camera from the Chinese company Xiongmai. A security vulnerability exists in the Xiongmai XM530 IP cameras Firmware version V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06, which stems from an authentication bypass, and could lead to unauthorized, remote...

The vulnerability of the N8n automation platform, related to insufficient control over resources with dynamic management, allows a perpetrator to gain unauthorized access to the platform.

The vulnerability of the N8n automation platform lies in the insufficient control over resources with dynamic management. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to the platform...

CVE-2025-14952

A vulnerability was detected in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/addcategory.php. Performing a manipulation of the argument txtCategoryName results in sql injection. The attack is possible to be carried out remotely. The exploit is now...

CVE-2025-14908 JeecgBoot Multi-Tenant Management SysTenantController.java improper authentication

A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the component Multi-Tenant Management Module...

VulnCheck KEV: CVE-2025-32778

Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project Lissy93/web-check. The issue stems from user-controlled input url being passed unsanitized into a shell command using exec, allowing attackers t...

CVE-2025-14896

due to insufficient sanitazation in Vega’s convert function when safeMode is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including local file system paths, leading to exposure of sensitiv...

Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App

The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics formerly CJ Korea Express. "The threat actor leveraged QR codes...

Inductive Automation Ignition (Update A)

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to be granted direct SYSTEM-level code execution on the host operating system running the Ignition Gateway service on Windows systems. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

📄 Xiongmai XM530 IP Camera ONVIF Complete Authentication Bypass

There is a complete authentication bypass in the ONVIF implementation of Xiongmai XM530-series IP cameras that allows unauthenticated remote access to sensitive device information, configuration, and video streams. CVE-2025-65856 Xiongmai XM530 IP Camera ONVIF Complete Authentication Bypass ---...

PT-2025-53511

Уязвимость платформы для совместной разработки Forgejo связана с недостатками механизма обработки символьных ссылок. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к платформе путем отправки специально сформированного файла...

PT-2025-52323

Name of the Vulnerable Software and Affected Versions EasyPHP Webserver version 14.1 Description A path traversal flaw exists in EasyPHP Webserver that permits unauthenticated remote users with limited privileges to access files beyond the intended document root. This is achieved by circumventing...

CVE-2025-14097 Remote Code Execution Vulnerability in Radiometer Products

A vulnerability in the application software of multiple Radiometer products may allow remote code execution and unauthorized device management when specific internal conditions are met. Exploitation requires that a remote connection is established with additional information obtained through othe...

PT-2025-51972

Name of the Vulnerable Software and Affected Versions code-projects Online Appointment Booking System version 1.0 Description A security flaw exists in code-projects Online Appointment Booking System 1.0. The issue involves SQL injection resulting from manipulation of the clinic argument within t...

PT-2025-53583

IBM API Connect and Affected Versions IBM API Connect versions 10.0.8.0 through 10.0.8.5 IBM API Connect version 10.0.11.0 Description A critical authentication bypass vulnerability exists in IBM API Connect, allowing remote attackers to gain unauthorized access to applications without credential...

The vulnerability of the Endpoint Manager web interface for managing IP telephony systems, FreePBX, allows a intruder to gain unauthorized access to the system.

The vulnerability of the Endpoint Manager web interface for managing IP telephony systems like FreePBX is related to authentication mechanisms’ deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the system remotely...

CVE-2023-53895

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account,...