13561 matches found
CVE-2025-9982
creationtimestamp| type| source ---|---|--- 2025-11-14 14:59:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5lwyugnfg2x 2025-11-14 15:00:44+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115548647802770700 2026-06-17 18:11:58+00:00| seen|...
VulnCheck KEV: CVE-2025-8085
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...
EUVD-2025-175319
Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...
CVE-2025-52186
Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...
CVE-2025-52186
Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...
CVE-2025-52186
Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...
CVE-2025-52186
Summary: CVE-2025-52186 affects Lichess Lila (before commit 11b4c0fb00f0ffd823246f839627005459c8f05c) with a Server-Side Request Forgery (SSRF) in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing a remote attacker to compel the ...
CVE-2025-64705
Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access the submissions made by other students The issue has been fixed in version 2.41.0 by ensuring proper roles and redirecting if accessed vi...
EUVD-2025-60981
Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...
CVE-2025-63149
Tenda AX3 V16.03.12.10CN was discovered to contain a stack overflow in the urls parameter of the getparentControllistInfo function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...
CVE-2025-62780
changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch...
PYSEC-2025-91
changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch...
EUVD-2025-50808
Tenda AX3 V16.03.12.10CN was discovered to contain a stack overflow in the urls parameter of the getparentControllistInfo function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...
CVE-2025-62780 changedetection.io vulnerable to stored XSS in Watch update via API
changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch...
CVE-2025-63149
Tenda AX3 V16.03.12.10CN was discovered to contain a stack overflow in the urls parameter of the getparentControllistInfo function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...
CVE-2025-63149
CVE-2025-63149 affects Tenda AX3 router (V16.03.12.10_CN). The vulnerability is a stack overflow in the urls parameter of the get_parentControl_list_Info function, caused by improper input length validation. This can be exploited by a crafted request to trigger a Denial of Service (DoS). Public s...
CVE-2025-63149
Tenda AX3 V16.03.12.10CN was discovered to contain a stack overflow in the urls parameter of the getparentControllistInfo function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...
Tenda AX3 安全漏洞
Tenda AX3 is a home dual-band Gigabit wireless router from Tenda Technology that supports Wi-Fi6 802.11ax standard and focuses on high-performance network coverage and stable connection. The Tenda AX3 suffers from a stack buffer overflow vulnerability that originates from the urls parameter in th...
PT-2025-46188
Name of the Vulnerable Software and Affected Versions Tenda AX3 version 16.03.12.10 CN Description The Tenda AX3 router contains a stack overflow in the urls parameter of the get parentControl list Info function. A crafted request can lead to a Denial of Service DoS. Recommendations At the moment...
CVE-2025-40109
creationtimestamp| type| source ---|---|--- 2025-11-09 06:20:26+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m56hodvykpz2 2025-11-09 07:38:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m56lzoydrz2x 2025-11-10 09:27:42+00:00| seen|...