CVE-2025-20272

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPNM could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied...

PT-2025-29544 · Samsung · Samsung Wlan Ap Wea453E

Name of the Vulnerable Software and Affected Versions: Samsung WLAN AP WEA453e versions prior to 5.2.4.T1 Description: An unauthenticated remote command execution issue exists due to improper input validation in the “Tech Support” diagnostic functionality. The command1 and command2 POST or GET...

PT-2025-28858 · Asustor · Asustor Adm

Name of the Vulnerable Software and Affected Versions: ASUSTOR ADM versions 4.1 through 4.3.1.R5A0 Description: The issue is related to improper input validation, allowing arbitrary values to be injected into the NAS configuration file. This could lead to system misconfiguration, breaking the...

The vulnerability of the Device Admin App operating system ctrlX OS allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Device Admin App on the ctrlX OS platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending specially crafted HTTP requests...

PT-2025-28517 · Microsoft · Windows Storage Vsp Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Storage VSP Driver affected versions not specified Description: The issue is related to improper input validation in the Windows Storage VSP Driver, which allows an authorized attacker to elevate privileges locally. This means an...

CVE-2025-5314 Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-53075

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2...

Signature Spoofing

pbkdf2 is vulnerable to Signature Spoofing. The vulnerability is due to improper input validation in the lib/to-buffer.js file, which allows an attacker to bypass signature verification and spoof cryptographic signatures, making malicious data appear authentic...

PT-2025-26838 · Unknown · Gitforge.Jl

Name of the Vulnerable Software and Affected Versions: GitForge.jl versions prior to 0.4.3 Description: The issue is related to a lack of input validation for user-provided values in certain functions. Specifically, in the GitForge.get repo function for GitHub, the owner and repo fields can be...

CVE-2025-6547 On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: =3.1.2...

CVE-2025-6545 pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2...

NETGEAR EX3700 Stack Buffer Overflow Vulnerability

The NETGEAR EX3700 is a dual-band wireless accessor with a maximum transmission rate of 750Mbps. The NETGEAR EX3700 suffers from a stack buffer overflow vulnerability that stems from the lack of proper validation of user-supplied data in the function sub41619C in file/mtd, which can be exploited ...

CVE-2025-25034

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the restdata parameter before passing it to the...

PT-2025-26394 · Unknown · Jordy Meow Code Engine

Name of the Vulnerable Software and Affected Versions: Jordy Meow Code Engine versions 0.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

Remote Code Execution (RCE)

Salt is vulnerable to Remote command execution. The vulnerability is due to improper input validation in the 'on demand' pillar functionality, allowing a specially crafted git URL to trigger arbitrary command execution on the master with elevated privileges...

The vulnerability of the bs_SetDNSInfo() function in the libshare-0.0.26.so library of the LB-LINK router software allows a attacker to execute arbitrary commands.

The vulnerability of the bsSetDNSInfo function in the libshare-0.0.26.so library of the LB-LINK router software is related to the lack of data cleaning measures at the management level when processing the parameters dns1 and dns2. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2025-49180

CVE-2025-49180 is a concrete issue in the RandR extension of the X11 server where RRChangeProviderProperty may overflow when computing the total allocation size. The vulnerability affects xorg-x11-server (and related components such as Xwayland/Xorg) as listed in multiple advisories; affected rel...

CVE-2025-5777 NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway VPN virtual server, ICA Proxy, CVPN, RDP Proxy OR AAA virtual server...

BIT-GITLAB-2025-5996 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service...

Microsoft Office Code Execution Vulnerability (CNVD-2025-13270)

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, etc.. A code execution vulnerability exists in Microsoft Office, which is caused due to improper input validation...