CVE-2025-54879

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

CVE-2025-54879

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

CVE-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

CVE-2025-54879

CVE-2025-54879 affects Mastodon when using the email-based confirmation throttle. The root cause is a misconfiguration in Mastodon’s rate-limiting: the email throttle checks the password-reset path instead of the confirmation path, effectively disabling per-email limits for confirmation requests....

CVE-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

CVE-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

PT-2025-32007 · Mastodon · Mastodon

Name of the Vulnerable Software and Affected Versions: Mastodon versions 3.1.5 through 4.2.24 Mastodon versions 4.3.0 through 4.3.11 Mastodon versions 4.4.0 through 4.4.3 Description: Mastodon’s rate-limiting system contains a configuration error where the email-based throttle for confirmation...

PT-2025-31835

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.20 Claude Code versions prior to 1.0.24 Description Claude Code is an agentic coding tool. An error in command parsing allows bypassing the confirmation prompt, leading to the execution of untrusted commands...

PT-2025-93: Local Privilege Escalation in RemotePC

The vulnerability was identified in RemotePC, version 7.7.38. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 30.07.2025 Recommendations: Update to version 7.7.38 or...

Watch out: Instagram users targeted in novel phishing campaign

A phishing campaign targeting Instagram users is doing the rounds. There are plenty of those around, but when we took a look at this particular email, it seemed a bit different to the normal phishing emails that point to scammy websites. The email looked like this, which is very similar to the on...

NCSC-2025-0233

creationtimestamp| type| source ---|---|--- 2025-07-21 13:16:31+00:00| confirmed| https://advisories.ncsc.nl/advisory?id=NCSC-2025-0233...

User-To-PC Authentication through Confirmation on Mobile Devices: on Usability and Performance

Protecting personal computers PCs from unauthorized access typically relies on password authentication, which is know to suffer from cognitive burden and weak credentials. As many users nowadays carry mobile devices with advanced security features throughout their day, there is an opportunity to...

CVE-2025-3626

creationtimestamp| type| source ---|---|--- 2025-07-07 10:00:22+00:00| seen| https://infosec.exchange/users/certvde/statuses/114811366375846832 2025-07-07 10:01:38+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3ltejp326l5t2 2025-07-07 11:50:30+00:00| seen|...

CVE-2025-6890

A vulnerability was found in code-projects Movie Ticketing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ticketConfirmation.php. The manipulation of the argument Date leads to sql injection. The attack may be initiated remotely. The exploit has...

Code-Projects Movie Ticketing System 注入漏洞

Code-Projects Movie Ticketing System is an open source movie ticketing system from Code-Projects. An injection vulnerability exists in code-projects Movie Ticketing System version 1.0, which originates from SQL injection due to incorrect manipulation of the parameter Date in the file...

CVE-2025-6091

A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to launch the attack...

CVE-2025-6091

CVE-2025-6091 affects H3C GR-3000AX v100R007L50. The vulnerability exists in the functions UpdateWanParamsMulti/UpdateIpv6Params in /routing/goform/aspForm, where improper handling of the parameter param causes a buffer overflow. It can be exploited remotely and exploitation details have been pub...

CVE-2025-4973

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an accoun...

CVE-2025-4973 Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an accoun...

PT-2025-25236 · Cursor · Cursor

Name of the Vulnerable Software and Affected Versions: Cursor versions prior to 0.51.0 Description: The issue allows an attacker to trigger an arbitrary HTTP GET request without user confirmation by writing a JSON file. This could potentially be used to exfiltrate data if a malicious agent gains...