CVE-2025-46617

Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and...

CVE-2025-43861

creationtimestamp| type| source ---|---|--- 2025-04-24 21:07:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13346 2025-04-24 23:52:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnlvo2d27t2v 2025-04-25 00:47:40+00:00| seen|...

GHSA-VQFR-H8MV-GHFJ

creationtimestamp| type| source ---|---|--- 2025-04-24 19:09:03+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114394512917622666...

CVE-2025-39377

creationtimestamp| type| source ---|---|--- 2025-04-24 17:48:12+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114394194942049906 2025-04-24 18:14:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnlcsewgoz2d 2025-04-25 14:07:25+00:00| seen|...

CVE-2025-46489 WordPress Bulk Assign Linked Products For WooCommerce plugin <= 2.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk Assign Linked Products For WooCommerce: from n/a through = 2.1...

CVE-2025-46525 WordPress WP Cookie Consent plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in msmitley WP Cookie Consent wp-cookie-consent allows Stored XSS.This issue affects WP Cookie Consent: from n/a through = 1.0...

CVE-2025-46504 WordPress Vasaio QR Code plugin <= 1.2.5 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Olar Marius Vasaio QR Code allows Stored XSS. This issue affects Vasaio QR Code: from n/a through 1.2.5...

CVE-2025-46264 WordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue affects PowerPress Podcasting: from n/a through = 11.12.5...

CVE-2025-27820

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release...

CVE-2025-46272

creationtimestamp| type| source ---|---|--- 2025-04-24 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06 2025-04-25 00:19:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnlx7ktjya2r 2025-04-25 01:30:05+00:00| seen|...

CVE-2025-1284

creationtimestamp| type| source ---|---|--- 2025-04-24 09:12:24+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13207 2025-04-24 13:03:56+00:00| seen| https://t.me/cvedetector/23668 2025-04-24 14:19:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnkvntudhh24...

CVE-2025-3280

creationtimestamp| type| source ---|---|--- 2025-04-24 09:12:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13199 2025-04-24 13:03:42+00:00| seen| https://t.me/cvedetector/23657 2025-04-24 14:19:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnkvntqegp2d...

CVE-2025-3065 Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion

The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote co...

Threat Replay Testing: Turning Attackers into Pen Testers

API security is no longer just a concern; it’s a critical priority for businesses. With APIs serving as the backbone of modern applications, they’ve become a primary target for attackers. While automated security testing tools help detect vulnerabilities, their limitations leave organizations...

CVE-2025-41423

Mattermost CVE-2025-41423 affects Mattermost versions 10.4.x up to 10.4.2, 10.5.x up to 10.5.0, and 9.11.x up to 9.11.10. The issue is improper permission validation on the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, which could allow any user or attacker to delete posts...

CVE-2025-27581

creationtimestamp| type| source ---|---|--- 2025-04-24 00:05:21+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13164 2025-04-24 01:14:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnjjst5wtw2s 2025-04-24 04:42:07+00:00| seen|...

CVE-2025-44135

CVE-2025-44135 affects the code-projects Online Class and Exam Scheduling System 1.0, with a SQL injection vulnerability in the /Scheduling/pages/profile_update.php endpoint. The issue stems from manipulating the username parameter without proper validation, enabling an attacker to inject SQL com...

CVE-2025-46400

In xfig diagramming tool, a segmentation fault while running fig2dev allows an attacker to availability via local input manipulation via readarcobject function...

CVE-2022-23143

creationtimestamp| type| source ---|---|--- 2025-04-23 21:05:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13157...

CVE-2025-46397

creationtimestamp| type| source ---|---|--- 2025-04-23 21:05:02+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13154 2025-04-24 00:02:03+00:00| published-proof-of-concept| Telegram/nLLiU9XeUeMIp5jrXJDhah4Wv5btJb4tJwgKYZU-gIMEuU0 2025-04-24 00:31:13+00:00| seen| https://t.me/cvedetector/23620...