CVE-2025-25758

CVE-2025-25758 affects KukuFM Android app v1.12.7 (11207). The root cause is android:allowBackup="true" in AndroidManifest.xml, which can let an attacker access sensitive plaintext data. According to the provided data, this yields a high confidentiality impact (C:H) with no impact on integrity or...

PT-2025-12043 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm versions prior to 1.2.2 Description: A path traversal vulnerability exists in the 'document uploads manager' feature, allowing users with the 'manager' role to access and manipulate the 'anythingllm.db' database fil...

CVE-2025-25758

An issue in KukuFM Android v1.12.7 11207 allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml...

Exploit for Improper Access Control in Tastyigniter

Exploit 🛠️ Estudo de Caso: CVE-2024-44313 e o EPSS na Prioritiza...

USN-7358-1: PostgreSQL vulnerabilities

Wolfgang Walther discovered that PostgreSQL incorrectly tracked tables with row security. A remote attacker could possibly use this issue to perform forbidden reads and modifications. CVE-2024-10976 Jacob Champion discovered that PostgreSQL clients used untrusted server error messages. An attacke...

CVE-2024-12920

CVE-2024-12920 affects FoodBakery | Delivery Restaurant WordPress Theme (

CVE-2025-26816

The CVE-2025-26816 affects Intrexx Portal Server 12.0.2 and earlier. Affected component is the portal server logic that, under certain conditions and for users with specific permissions, can disclose potentially sensitive data from another user context. The impact is confidentiality exposure (C=H...

The vulnerability of the i2c_imx_xfer() function in the drivers/i2c/busses/i2c-imx.c module of the Linux kernel allows a hacker to gain access to protected information.

The vulnerability of the i2cimxxfer function in the drivers/i2c/busses/i2c-imx.c file of the Linux kernel is related to security configuration errors. Exploiting this vulnerability could allow an attacker to access protected information...

Advisory ROSA-SA-2025-2778

Software: xmlrpc 3.1.3 OS: ROSA Virtualization 2.1 packageevrstring: xmlrpc-3.1.3-1.0.1.1.rv3 CVE-ID: CVE-2019-17570 BDU-ID: 2020-01960 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of the Apache XML-RPC library is related to ...

CVE-2024-54559

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to access sensitive user data...

CVE-2024-54027

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access t...

CVE-2024-54027

CVE-2024-54027 describes a Use of Hard-coded Cryptographic Key (CWE-321) in Fortinet FortiSandbox. Affected versions include 4.4.6 and below, 4.2.7 and below, 4.0.5 and below, 3.2.4 and below, 3.1.5 and below, and 3.0.7 to 3.0.5. A privileged attacker with a super-admin profile and CLI access can...

CVE-2025-2025

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the givereportsearnings function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to...

PHPGurukul Pre-School Enrollment System 注入漏洞

PHPGurukul Pre-School Enrollment System is a web-based preschool enrollment system from PHPGurukul, Inc. An injection vulnerability exists in version 1.0 of the PHPGurukul Pre-School Enrollment System, which stems from SQL injection, and could allow a remote attacker to obtain, update, and delete...

The vulnerability of the corporate messaging system ROSSAT, related to insufficient protection of operational data, allows a perpetrator to gain unauthorized access to read, modify, or delete data.

The vulnerability of the corporate messaging system ROSSAT is related to insufficient protection of operational data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to read, modify, or delete data by sending a specially crafted GET request...

The vulnerability of the MoTw mechanism in Windows operating systems allows attackers to circumvent existing security restrictions and gain access to encrypted data.

The vulnerability of the MoTe-Web mechanism in Windows operating systems is related to a breach of data protection mechanisms. Exploiting this vulnerability allows attackers to circumvent existing security restrictions and gain access to encrypted data...

CVE-2024-12810

The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 7.1. This makes it possible for authenticated attackers, wit...

CVE-2024-13824

The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deserialization of untrusted input in the 'addciyashopwishlist' and 'ciyashopgetcompare' functions. This makes it possible for unauthenticated...

CVE-2025-2025 Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the givereportsearnings function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to...

CVE-2024-12336

The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'exportalldata' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with...