Spring Framework 6.0.5 < 6.0.29 / 6.1.x < 6.1.21 / 6.2.x < 6.2.8 Reflected File Download (CVE-2025-41234)

The version of Spring Framework installed on the remote host is 6.0.5 prior to 6.0.29, 6.1.x prior to 6.1.21, or 6.2.x prior to 6.2.8. It is, therefore, affected by a reflected file download vulnerability: - In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application...

Discourse < 3.4.6 Information Disclosure Vulnerability

Discourse is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Amazon Linux 2 : aws-kinesis-agent (ALAS-2025-2898)

The version of aws-kinesis-agent installed on the remote host is prior to 2.0.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2898 advisory. Jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data...

CVE-2025-34039 Yonyou NC BeanShell Command Injection

A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet bsh.servlet.BshServlet without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This...

CVE-2025-25038

creationtimestamp| type| source ---|---|--- 2025-06-20 22:10:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls32l37jep23 2025-06-21 21:02:19+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3ls5h7njjy22u 2025-06-23 20:47:20+00:00| published-proof-of-concept|...

PT-2025-26417 · Unknown · Lewe Chordpress

Name of the Vulnerable Software and Affected Versions: Lewe ChordPress versions 3.9.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

Dotnetnuke < 10.0.1 Possibly bypass of IP Filters (GHSA-fjhg-3mrh-mm7h)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.0.1. It is, therefore, affected by a vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

CVE-2025-6282

creationtimestamp| type| source ---|---|--- 2025-06-19 22:40:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18888 2025-06-19 23:46:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrypgjk75x2u...

WordPress Civi Framework plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Civi Framework plugin that stems from the WEB application not adequately verifying that a request is from a...

CVE-2025-3602

CVE-2025-3602 affects Liferay Portal and Liferay DXP (7.4.0–7.4.3.97; 7.3/7.2 lines) where an unrestricted GraphQL query depth allows remote attackers to cause DoS by executing deeply nested queries. The root cause is failure to cap GraphQL query depth, per multiple vendors/advisories in the conn...

CVE-2025-25265 Unauthenticated File Read via Web Interface

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure...

CVE-2025-49200

The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files...

CVE-2025-49192

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-15746)

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

FlatPress <= 1.3 Multiple Vulnerabilities

FlatPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:flatpress:flatpress"; ifdescripti...

CVE-2025-49192

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of...

CVE-2025-49193

The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame Clickjacking attacks or not executing injected malicious JavaScript code XSS attacks...

CVE-2025-49199 Backup files can be modified and uploaded

The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to run, making the application unusable...

CVE-2025-49193

Technical details (affected product/versions/root cause/fix) are not publicly provided in the supplied documents; monitor for updates.

CVE-2025-49192 Clickjacking

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of...