14990 matches found
CVE-2025-41674
The CVE-2025-41674 entry matches an OS command injection in MB CONNECT LINE mbNET.mini (industrial router) and Helmholz REX100/mbNET.mini family where improper neutralization of special elements in OS commands enables remote execution of commands via POST to a diagnostic action. Connected sources...
CVE-2025-41674 Remote Command Injection in diagnostic Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...
CVE-2025-41674 Remote Command Injection in diagnostic Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...
CVE-2025-41673 Remote Command Injection in send_sms Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...
CVE-2025-41673
CVE-2025-41673 affects MB CONNECT LINE mbNET.mini (industrial router). The vulnerability is an OS command-injection in the send_sms operation caused by improper neutralization of special elements, enabling remote execution of system commands via POST requests. Vulnerable versions are prior to 2.3...
PiMRef: Detecting and Explaining Ever-Evolving Spear Phishing Emails with Knowledge Base Invariants
Phishing emails are a critical component of the cybercrime kill chain due to their wide reach and low cost. Their ever-evolving nature renders traditional rule-based and feature-engineered detectors ineffective in the ongoing arms race between attackers and defenders. The rise of large language...
MAL-2025-6137 Malicious code in yarn-test-git-repo (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edc9cafea25a24afd9f19a9a4ba2af18e06bd436e07baa0c8cb4250ab522228c Any computer that has this package installed or running should be considered...
CVE-2015-10139 WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation
The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wpajaximportdata' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account...
CVE-2015-10139
CVE-2015-10139 affects the WPLMS WordPress theme and allows privilege escalation via the wp_ajax_import_data AJAX action in versions 1.5.2–1.8.4.1. Authenticated attackers could modify restricted settings and potentially create a new admin account. The issue is tied to an API/endpoint exposed to ...
CVE-2015-10139 WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation
The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wpajaximportdata' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account...
Modern Bag action.php file SQL injection vulnerability
Modern Bag is an online management system. Modern Bag suffers from a SQL injection vulnerability that stems from an error in the parameter proId in file /action.php that lacks validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL comman...
MAL-2025-6004 Malicious code in winston-compose (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 981347a4b88ce00ab42b1a3f93b56d89cf28282070c617325e304221c6ce4882 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in codex-action (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3768693d4c833924ee984473a49391e5c0e5778d627f2f7e16f1b565ac38104a The OpenSSF Package Analysis project identified 'codex-action' @ 99.3...
MAL-2025-6082 Malicious code in codex-action (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3768693d4c833924ee984473a49391e5c0e5778d627f2f7e16f1b565ac38104a The OpenSSF Package Analysis project identified 'codex-action' @ 99.3...
PT-2025-29763 · WordPress · Wp Hide Post
Name of the Vulnerable Software and Affected Versions: xfinitysoft WP Post Hide versions n/a through 1.0.9 Description: A Cross-Site Request Forgery CSRF issue exists in xfinitysoft WP Post Hide, allowing attackers to perform actions on behalf of an authenticated user. Recommendations: Update...
MAL-2025-5883 Malicious code in @web-kit-package/grab-login (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b40f792f041cb54fd538d312324aefe4be963bdebc3734132184a9c3b4c875fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-53031
CVE-2025-53031 — mode: normal (detailed) Affected product: Oracle Financial Services Analytical Applications Infrastructure (in Oracle Financial Services Applications). Vulnerability details: An easily exploitable issue exists in the Platform component. An unauthenticated attacker with network ac...
CVE-2025-53025
The CVE-2025-53025 entry refers to Oracle VM VirtualBox (Core) with affected version 7.1.10. The vulnerability permits a high-privileges attacker who can log on to the infrastructure running VirtualBox to compromise the product, with potential impact including unauthorized access to critical data...