The vulnerability of the SCADA system Pult.online, related to inconsistencies in responses to incoming requests, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the SCADA system Pult.online is related to inconsistencies in responses to incoming requests. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information by sending a specially crafted POST request...

Malware Masquerades as Legitimate, Hidden WordPress Plugin with Remote Code Execution Capabilities

📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. The Wordfence Threat Intelligence team recently discovered an interestin...

CVE-2025-5444

CVE-2025-5444 affects Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 (firmware 1.0.013.001–1.2.07.001). The vulnerability is in the function RP_UpgradeFWByBBS in /goform/RP_UpgradeFWByBBS, where manipulation of the argument type/ch/ssidhex/security/extch/pwd/mode/ip/nm/gw leads to OS command i...

CVE-2025-5442

A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RPpingGatewayByBBS of the file /goform/RPpingGatewayByBBS. The manipulation of th...

CVE-2025-5442 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 RP_pingGatewayByBBS os command injection

A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function RPpingGatewayByBBS of the file /goform/RPpingGatewayByBBS. The manipulation of th...

CVE-2025-5441

Affected devices: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 with firmware versions 1.0.013.001 through 1.2.07.001. Root cause: the function setDeviceURL in /goform/setDeviceURL accepts a DeviceURL argument whose manipulation enables OS command injection. Impact: remote exploitati...

CVE-2025-5440 Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 NTP os command injection

A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function NTP of the file /goform/NTP. The manipulation of the argument...

CVE-2025-5438

A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. Affected by this vulnerability is the function WPS of the file /goform/WPS. The manipulation of the argument PIN leads ...

CVE-2025-5438

CVE-2025-5438 affects Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 devices with firmware versions 1.0.013.001, 1.0.04.001/1.0.04.002, 1.1.05.003, and 1.2.07.001. The WPS function at /goform/WPS is vulnerable to command injection through manipulation of the PIN argument, and the attack can be...

CVE-2025-5437 Multilaser Sirius RE016 Password Change cstecgi.cgi improper authentication

A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The...

CVE-2025-5437 Multilaser Sirius RE016 Password Change cstecgi.cgi improper authentication

A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The...

CVE-2025-5435 Marwal Infotech CMS page.php sql injection

A vulnerability was found in Marwal Infotech CMS 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /page.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and...

CVE-2025-5433 Fengoffice Feng Office index.php sql injection

A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account&a=settimezone. The manipulation of the argument tzoffset leads to sql injection. The attack may be launched remotely. The...

CVE-2025-5432

A vulnerability has been found in AssamLook CMS 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /viewtender.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed t...

CVE-2025-5427

Juzaweb CMS contains a vulnerability in the Permalinks Page (file /admin-cp/permalinks) up to version 3.4.2. Root cause: improper access controls on that functionality. Impact: potential unauthorized access, with network-based remote exploitation. Exploit has been disclosed publicly. As of provid...

CVE-2025-5423

A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/system/general of the component General Setting Page. The manipulation leads to improper access controls. The attack can be initiated remotel...

CVE-2025-5422 juzaweb CMS Email Logs Page email access control

A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of the component Email Logs Page. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The explo...

CVE-2025-5422 juzaweb CMS Email Logs Page email access control

A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of the component Email Logs Page. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The explo...

CVE-2025-5420

A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/file-manager/upload of the component Profile Page. The manipulation of the argument Upload leads to cross site scripting. The attack can...

The vulnerability of the `ioctl_send_response()` function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the ioctlsendresponse function in the Linux operating system is related to the lack of memory release. Exploiting this vulnerability could allow an attacker to trigger a service failure...