vBulletin 5.0.x < 6.0.4 Remote Code Execution

vBulletin versions 5.0.x prior to 6.0.4 are vulnerable to an improper authentication allowing unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later. This vulnerability can lead to remote code execution RCE. Note that this plugin requires the 'File...

PT-2025-54832

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 versions prior to build 41800 Acronis Cyber Protect 16 versions prior to build 39938 Description The software suffers from a flaw related to improper authentication, which can lead to sensitive data disclosure and...

PT-2025-54833

Name of the Vulnerable Software and Affected Versions Acronis Cyber Protect 15 versions prior to build 41800 Acronis Cyber Protect 16 versions prior to build 39938 Description The software suffers from a flaw related to improper authentication, which can lead to sensitive data disclosure and...

VMware NSX 安全漏洞

VMware NSX is a complete L2-L7 network and security virtualization platform from VMware. VMware NSX is a complete L2-L7 network and security virtualization platform from VMware. It provides virtual machines with a virtualized network, isolates virtual machines from the physical network, and makes...

PT-2025-23796 · Unknown · Airleader Master

Name of the Vulnerable Software and Affected Versions: airleader MASTER version 3.00571 Description: The issue is related to an Improper Authentication vulnerability that allows Authentication Bypass. This vulnerability affects the airleader MASTER device, potentially allowing unauthorized access...

CVE-2025-5512

A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible to launch the atta...

CVE-2025-5512 quequnlong shiyi-blog Administrator Backend verifyPassword improper authentication

A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible to launch the atta...

CVE-2025-5512 quequnlong shiyi-blog Administrator Backend verifyPassword improper authentication

A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible to launch the atta...

CVE-2025-5512

Summary (CVE-2025-5512) : quequnlong shiyi-blog, up to version 1.2.1, has an improper authentication flaw in the Administrator Backend at /api/sys/user/verifyPassword/. The vulnerability affects the Administrator Backend component and can be exploited remotely; multiple sources (NVD/NVD mirror, R...

CVE-2025-5495

A vulnerability was found in Netgear WNR614 1.1.0.281.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible to initiate the attack remotely. The...

CVE-2025-5495

A vulnerability was found in Netgear WNR614 1.1.0.281.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible to initiate the attack remotely. The...

CVE-2025-5495 Netgear WNR614 URL improper authentication

A vulnerability was found in Netgear WNR614 1.1.0.281.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible to initiate the attack remotely. The...

CVE-2025-5495

Affected product: Netgear WNR614 router (version 1.1.0.28 1.0.1WW). Vulnerable component: URL Handler. Root cause: manipulation of the input %00currentsetting.htm appended to a URL leads to improper authentication. Impact: remote attacker could bypass authentication, compromising confidentiality,...

CVE-2025-5495 Netgear WNR614 URL improper authentication

A vulnerability was found in Netgear WNR614 1.1.0.281.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible to initiate the attack remotely. The...

WordPress plugin Golo 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An elevation of privilege vulnerability exists in WordPress Golo plugin that stems from not properly authenticating a user and can be exploited by an attacker to cause an...

shiyi-blog 授权问题漏洞

shiyi-blog is a vue+springboot front-end and back-end separated blog system by bule individual developer. An authorization issue vulnerability exists in shiyi-blog 1.2.1 and earlier versions, which stems from improper authentication...

NETGEAR WNR614 安全漏洞

The NETGEAR WNR614 is a wireless router for home and small office environments with basic network management features and 150Mbps wireless transmission performance. The NETGEAR WNR614 suffers from an improper authentication vulnerability that originates from an input to currentsetting.htm, which...

PT-2025-23646 · Unknown · Quequnlong Shiyi-Blog

Name of the Vulnerable Software and Affected Versions: quequnlong shiyi-blog versions up to 1.2.1 Description: A critical issue was found in the Administrator Backend component, specifically in the /api/sys/user/verifyPassword/ endpoint, affecting an unknown function. This leads to improper...

CISA Adds Five Known Exploited Vulnerabilities to Catalog

CISA added five new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2021-32030link is external ASUS Routers Improper Authentication Vulnerability CVE-2023-39780link is external ASUS RT-AX55 Routers OS Command Injection Vulnerabilit...

CVE-2025-5437

A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The...