CVE-2025-3562

Summary (CVE-2025-3562): A path traversal vulnerability exists in Yonyou YonBIP MA2.7, specifically in the FileInputStream function of the file /mobsm/common/userfile. The manipulation of the argument path enables traversal and remote exploitation. Connected sources confirm the affected software/...

CVE-2025-3551

CVE-2025-3551 is rejected/not used; not an active vulnerability.

CVE-2025-3531

A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross site scripting. It is possible to initiate the attack remotely. The explo...

CVE-2025-3532 YouDianCMS index.html.Attackers cross site scripting

A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/index.html.Attackers. The manipulation of the argument OrderNumber leads to cross site scripting. The attack can be initiated remotely. The...

CVE-2025-3531

CVE-2025-3531 affects YouDianCMS version 9.5.21. The vulnerability resides in the file /App/Tpl/Admin/Default/Log/index.html where manipulation of the arguments UserName/LogType enables cross-site scripting. It is exploitable remotely and the exploit has been disclosed publicly; vendor response i...

CVE-2025-3489

A vulnerability was found in Nababur Simple-User-Management-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument name/username leads to cross site scripting. The attack may be launched...

CVE-2025-26335

Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

qBittorrent 5.0.1 - MITM RCE

Exploit Title: qBittorrent 5.0.1 MITM RCE Date: 01/02/2025 Exploit Author: Jordan Sharp Vendor Homepage: https://github.com/qbittorrent/qBittorrent Software Link: https://www.qbittorrent.org/download Version: 5.0.1 Tested on: Windows 10 CVE : CVE-2024-51774 Run the PoC on a MITM machine...

Langflow /api/v1/validate/code command injection

Added: 04/11/2025 CVE: CVE-2025-3248 Background Langflow is a low-code tool for building AI agents and workflows. Problem A command injection vulnerability in the /api/v1/validate/code API endpoint could allow a remote unauthenticated attacker to execute arbitrary commands by sending a specially...

CVE-2025-27079

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution RCE. Successful exploitation could allow an attacker to execute arbitrary operating system commands on the...

CVE-2025-22471

Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service...

CVE-2025-27482

Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network...

CVE-2025-26642 Microsoft Office Remote Code Execution Vulnerability

...

CVE-2025-21221 Windows Telephony Service Remote Code Execution Vulnerability

...

CVE-2025-29820 Microsoft Word Remote Code Execution Vulnerability

...

CVE-2025-27751 Microsoft Excel Remote Code Execution Vulnerability

...

CVE-2025-27747 Microsoft Word Remote Code Execution Vulnerability

...

CVE-2025-27079

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution RCE. Successful exploitation could allow an attacker to execute arbitrary operating system commands on the...

CVE-2025-22465

Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required...

CVE-2025-3402

Vulnerability CVE-2025-3402 affects Seeyon Zhiyuan Interconnect FE Collaborative Office Platform 5.5.2. The issue arises from improper handling of the Name argument in the file /sysform/042/check.js70, enabling SQL injection. A remote attacker could exploit this, with exploitation publicly disclo...