CVE-2025-30196

Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step...

GHSA-CG4P-5QFM-PJJJ HyperLPR Denial of Service vulnerability

A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service DoS attack. The server fails to handle excessive characters appended to the end of multipart boundaries, regardless of the character used. This flaw can be exploited by sending malformed multipart requests with arbitrary...

CVE-2025-0188

A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...

CVE-2024-11033

A Denial of Service DoS vulnerability exists in the file upload feature of binary-husky/gptacademic version 3.83. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a payload with an...

CVE-2024-10955

A Regular Expression Denial of Service ReDoS vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern r'+' to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An attacker c...

CVE-2024-12063

CVE-2024-12063 affects imartinez/privategpt v0.6.2. The vulnerability is a DoS in the file upload feature caused by improper handling of form-data with an excessively large filename, which can overwhelm the server and render it unavailable to legitimate users. The exploitation details are not pro...

Santesoft Sante DICOM Viewer Pro

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause memory corruption that would result in execution of arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability,...

Hackers Exploit Severe PHP Flaw to Deploy Quasar RAT and XMRig Miners

Threat actors are exploiting a severe security flaw in PHP to deliver cryptocurrency miners and remote access trojans RATs like Quasar RAT. The vulnerability, assigned the CVE identifier CVE-2024-4577, refers to an argument injection vulnerability in PHP affecting Windows-based systems running in...

CVE-2025-2491

A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component Edit Template File Page. The manipulation leads to cross site scripting. It is...

Linux kernel null pointer dereference vulnerability (CNVD-2025-05382)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a null pointer dereference vulnerability that stems from not properly handling unconnected sockets, which could lead to a null pointer dereference. An...

(0Day) Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Hackers Exploit ChatGPT with CVE-2024-27564, 10,000+ Attacks in a Week

In its latest research report, cybersecurity firm Veriti has spotted active exploitation of a vulnerability within "OpenAI's ChatGPT…...

CVE-2025-2347 IROAD Dash Cam FX2 Device Registration default password

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Device Registration. The manipulation of the argument Password with the input qwertyuiop leads to use of default password. The attack needs to ...

Exploit for Observable Discrepancy in Netadmin Netadmin_Iam

Exploit Title: CVE-2024-9513 - NetAdmin IAM Allows User Enumer...

CVE-2024-12019 Arbitrary File Read via Document API

The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to...

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

Impact An attacker may be able to exploit this vulnerability to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature...

ZTE GoldenDB Unauthorized Access Vulnerability (CNVD-2025-10902)

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. An unauthorized access vulnerability exists in ZTE GoldenDB, which stems...

Art Gallery Management System Cross-Site Scripting Vulnerability

Art Gallery Management System is an art gallery management system. Art Gallery Management System version 1.0 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by parameter search, which can be exploited by an...

IBM EntireX Information Disclosure Vulnerability (CNVD-2025-05562)

IBM EntireX is a versatile middleware solution from International Business Machines IBM designed to facilitate seamless integration between core enterprise applications and modern applications. An information disclosure vulnerability exists in IBM EntireX version 11.1 that originates from the...

CVE-2025-0900

PDF-XChange Editor is affected by CVE-2025-0900, a PDF file parsing out-of-bounds read information disclosure vulnerability. The flaw stems from inadequate validation of user-supplied data during PDF parsing, which can cause a read past the end of an allocated object. Exploitation requires user i...