Introducing Wiz ASM: Context-Driven Attack Surface Management

Wiz launches Attack Surface Scanner to bring context, ownership, and prioritization to every exposure, anywhere...

CVE-2025-63453: Improper Neutralization of Special Elements used in an SQL Command

Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php...

Apple iOS < 26.1 Multiple Vulnerabilities (125632)

Binary data appleios261check.nbin...

JavaWebVulnerabilityScanner

JavaWebVulnerabilityScanner 🔒 Java Web Vulnerability Scanner...

CVE-2025-12603: Out-of-bounds Write

/etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

Photon OS 4.0: Redis PHSA-2025-4.0-0891

An update of the redis package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0891. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Exploit for HTTP Request Smuggling in Sap Content_Server

CVE-2022-22536 Batch Scanner This is a fast, socket-level bat...

CVE-2025-61121

Mobile Scanner Android App version 2.12.38 package name com.glority.everlens, developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handling of cloud service credentials may allow attackers to obtain them and carry out unauthorized actions, such as sensitiv...

CVE-2025-63467: Stack-based Buffer Overflow

Totolink LR350 v9.3.5u.6369B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub425400 function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

CVE-2025-48984: Improper Control of Generation of Code

A vulnerability allowing remote code execution RCE on the Backup Server by an authenticated domain user...

CVE-2025-30188: Uncontrolled Resource Consumption

Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is required to operate the web frontend, which leads to unavailability of the component. Please deploy the provided updates and patch releases. No publicly available...

CVE-2025-64357: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Younes JFR. Advanced Database Cleaner advanced-database-cleaner allows Cross Site Request Forgery.This issue affects Advanced Database Cleaner: from n/a through = 3.1.6...

CVE-2025-64364: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Masterstudy masterstudy allows PHP Local File Inclusion.This issue affects Masterstudy: from n/a through 4.8.126...

CVE-2025-64389: Cleartext Transmission of Sensitive Information

The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol...

CVE-2025-64388: Uncontrolled Resource Consumption

Denial of service of the web server through specific requests to this protocol...

CVE-2025-64385: Improper Input Validation

The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initi...

CVE-2025-12509: Inclusion of Functionality from Untrusted Control Sphere

On a client with an admin user, a GlobalShipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights...

CVE-2025-30189: Improper Preservation of Consistency Between Independent Representations of Shared State

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted...

CVE-2025-64365: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in colabrio Ohio Extra ohio-extra allows DOM-Based XSS.This issue affects Ohio Extra: from n/a through = 3.6.0...

CVE-2025-64387: Improper Restriction of Rendered UI Layers or Frames

The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the attacker in order to deceive the victim. This deception can range from making the victim click on a button to making them enter their login...