CVE-2025-13954

Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to the admin UI...

CVE-2025-13954 Hard-coded cryptographic keys in EZCast Pro II Dongle

Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to the admin UI...

CVE-2025-13954 Hard-coded cryptographic keys in EZCast Pro II Dongle

Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to the admin UI...

CVE-2025-13954

Summary: EZCast Pro II Admin UI (version 1.17478.146) exposes hard-coded cryptographic keys, allowing bypass of authorization checks and granting full admin UI access. Affected product/component: EZCast Pro II Admin UI. Root cause: hard-coded cryptographic keys in the Admin UI. Impact: unauthoriz...

EUVD-2025-202398

The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-13613 Elated Membership <= 1.2 - Authentication Bypass via Social Login

The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdfmembershipcheckfacebookuser' and the...

CVE-2025-13613

CVE-2025-13613 affects the WordPress plugin Elated Membership (eltdf-membership) up to version 1.2. The vulnerability enables an unauthenticated attacker to bypass authentication and log in as an administrative user by exploiting login flows tied to social login handling (eltdf_membership_check_f...

Emby Server Improper Authentication Vulnerability (GHSA-95fv-5gfj-2r84)

Emby Server is prone to an improper authentication vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-50528

Name of the Vulnerable Software and Affected Versions appRain CMF version 4.0.5 Description The application allows authenticated administrative users to execute arbitrary code remotely. This is possible because of a flaw that permits the upload of malicious PHP files through the filemanager uploa...

CVE-2025-52493

PagerDuty Runbook versions through 2025-06-12 contain a vulnerability that exposes stored secrets directly in the webpage DOM on the configuration page. Although secrets appear masked as password fields, the actual values remain in the page source and can be revealed by an administrative user wit...

CVE-2025-52493

PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from...

CVE-2025-52493

PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from...

CVE-2025-64113

Emby Server vulnerability CVE-2025-64113 allows an attacker to gain full administrative access to the Emby Server (admin interface, not OS level) via network access. Affected are Emby Server versions prior to 4.9.1.81; no additional preconditions beyond network access. The issue is fixed in versi...

CVE-2025-64113 Emby Server allows attackers to gain administrative server access without preconditions

Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server for Emby Server administration, not at the OS level. Other than network access, no specific preconditions need to be fulfilled for a server to be...

CVE-2025-64113 Emby Server allows attackers to gain administrative server access without preconditions

Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server for Emby Server administration, not at the OS level. Other than network access, no specific preconditions need to be fulfilled for a server to be...

Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments

Impact CVE-2025-13877 is an authentication bypass vulnerability caused by insecure default JWT key usage in NocoBase Docker deployments. Because the official one-click Docker deployment configuration historically provided a public default JWT key, attackers can forge valid JWT tokens without...

PT-2025-50221

Name of the Vulnerable Software and Affected Versions Emby Server versions prior to 4.9.1.81 Description Emby Server is a home media server application. Versions prior to 4.9.1.81 allow an attacker to gain full administrative access to the Emby Server. Network access is the only requirement for...

TOTOLINK's X5000R's (AX1800 router) lacks authentication for telnet

Overview An unauthenticated HTTP request can enable telnet which may lead to remote code execution with root-level privileges. Description TOTOLINK manufactures routers and other networking equipment designed for small businesses and home implementations. The AX1800 routers are popular with users...

Insufficient Entropy

Overview Affected versions of this package are vulnerable to Insufficient Entropy in the JWT signing secret. A user can obtain unauthorized administrative access by brute-forcing valid tokens. Remediation Upgrade github.com/litmuschaos/litmus/chaoscenter/authentication/api/handlers to version...

CVE-2025-14261

CVE-2025-14261 affects the Litmus platform where JWT signing uses a 6-byte secret. The root cause is extremely low entropy in the signing key, enabling brute-force access to valid tokens and potential elevation of privileges (e.g., registered users gaining admin capabilities) as described across ...