CVE-2025-14530

CVE-2025-14530 affects SourceCodester Real Estate Property Listing App 1.0. The vulnerability is in /admin/property.php where the image parameter can be manipulated to achieve unrestricted file uploads. This allows remote exploitation; the exploit has been publicly disclosed. Root cause is descri...

CVE-2025-55309

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change...

EUVD-2025-202688

A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity of the file AndroidManifest.xml. Executing manipulation can lead to improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed...

CVE-2025-12687

A vulnerability in TeamViewer DEX Client former 1E Client - Content Distribution Service NomadBranch.exe prior version 25.11 for Windows allows malicious actors to cause a denial of service application crash via a crafted command, resulting in service termination...

CVE-2025-13953

Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory LDAP login method. Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data...

The Year in Review 2025: AI, APIs, and a Whole Lot of Audacity

...

CVE-2025-61075

Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileged users to carry out administrative functions and manipulate data of other users via unauthorized API calls...

CVE-2025-13978

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to discover the names of private projects they do not have access through API requests...

CVE-2025-67718

Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling which could allow an attacker to access protected API endpoints by sending a crafted request path. An unauthenticated or unauthorized...

EUVD-2025-202610

Aqara Hub devices including Hub M2 4.3.60027, Hub M3 4.3.60025, Camera Hub G3 4.1.90027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring...

CVE-2025-67501

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain an SQL Injection vulnerability in the /html/matPat/editarcategoria.php endpoint. The application fails to properly validate and sanitize user inputs in the idcategoria...

Foxit PDF Editor 安全漏洞

Foxit PDF Editor is a PDF editor from the Chinese company Foxit Foxit. A security vulnerability exists in Foxit PDF Editor versions prior to 13.2 and prior to 2025 2025.2, which stems from an OnBlur action that results in post-release reuse, which may result in memory corruption or application...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the escapebytestring function. An attacker can cause a heap buffer overflow and application crash by supplying specially crafted file or remote filesystem attribute values. Remediation Upgrade glib to...

EUVD-2025-202710

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change...

Adobe Experience Manager (AEM) Forms Login Panel Detected

This plugin detects the presence of the Adobe Experience Manager AEM Forms Login panel on a web application. No source data...

CVE-2025-55314

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing...

Foxit PDF Editor 安全漏洞

Foxit PDF Editor is a PDF editor from Foxit, a Chinese company. A security vulnerability exists in Foxit PDF Editor versions prior to 13.2 and prior to 2025 2025.2, which originates from a failure to properly update the internal state after deleting a page, which may result in memory corruption o...

PT-2025-50748

Name of the Vulnerable Software and Affected Versions FreePBX version 16 Description FreePBX version 16 contains an authenticated remote code execution issue in the API module. An attacker with valid session credentials can execute arbitrary commands. The issue is exploitable through the...

CVE-2025-55312

CVE-2025-55312 affects Foxit PDF Editor for Windows prior to 13.2 and prior to 2025.2. When pages are deleted via JavaScript, the software may fail to update internal states, leading to dereference of invalid memory during subsequent annotation management. This memory corruption can cause crashes...

PT-2025-50701

In aoc service read message of aoc ipc core.c, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...