CVE-2025-62849: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and...

CVE-2025-66129: Missing Authorization

Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through = 1.18.0...

CVE-2025-67999: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Injection.This issue affects Newsletter: from n/a through = 9.0.9...

GitHub Scanner for React2Shell (CVE-2025-55182) Turns Out to Be Malware

A GitHub repository posing as a vulnerability scanner for CVE-2025-55182, also referred to as “React2Shell,” was exposed as…...

📄 dotCMS 25.07.02-1 Security Scanner

dotCMS version 25.07.02-1 python scanning script that looks for remote SQL injection. ============================================================================================================================================= | Title : dotCMS 25.07.02-1 Security Scanner | | Author : indoushka |...

Fortra GoAnywhere MFT 7.x Vulnerability Scanner

Fortra GoAnywhere MFT version7.x vulnerability scanner that looks for systems with a deserialization vulnerability using remote fingerprinting of the system. It does not perform exploitation...

CVE-2024-44599: Unrestricted Upload of File with Dangerous Type

FNT Command 13.4.0 is vulnerable to Directory Traversal...

CVE-2025-11670: Exposure of Sensitive Information to an Unauthorized Actor

Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled...

CVE-2025-13824: Release of Invalid Pointer or Reference

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and...

CVE-2025-9122: Generation of Error Message Containing Sensitive Information

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full server stack trace when encountering an error within the GetCdfResource servlet...

CVE-2023-53893: Server-Side Request Forgery (SSRF)

Ateme TITAN File 3.9.12.4 contains an authenticated server-side request forgery vulnerability in the job callback URL parameter that allows attackers to bypass network restrictions. Attackers can exploit the unvalidated parameter to initiate file, service, and network enumeration by forcing the...

CVE-2025-37732: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 CVE-2025-25018 bypassing that fix to achieve HT...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell – Advanced Discovery & Exploitation Framework An...

Exploit for CVE-2025-61675

FreePBX CVE-2025 Vulnerability Scanner ⚠️ DISCLAIMER TH...

CVE-2025-67899: Uncontrolled Recursion

uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas...

CVE-2025-67750

Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and below allow a maliciously crafted flow metadata file to cause arbitrary JavaScript execution during scanning. The APIVersion rule uses new...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Hybrid Security Scanner !Telegramhttps://i...

Denial Of Service (DoS)

github.com/sirupsen/logrus is vulnerable to Denial of Service DoS. The vulnerability is due to limitations in the internal bufio.Scanner when Entry.Writer processes a single-line payload larger than 64KB without newline characters, which causes a "token too long" error and closes the writer pipe,...

Exploit for Deserialization of Untrusted Data in Facebook React

next88 - React Server Components RCE Scanner High-performance...

CVE-2025-14542: Trust Boundary Violation

The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially serve a benign manual e.g., one defining an HTTP tool call, earning the clients’ trust, a malicious provider can later change the manual to...