CVE-2025-41701: Deserialization of Untrusted Data

An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context...

CVE-2025-47694: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through = 3.4.7...

CVE-2025-32689: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through = 2.8.2...

CVE-2025-9166: NULL Pointer Dereference

A denial-of-service security issue exists in the affected product and version. The security issue stems from the controller repeatedly attempting to forward messages. The issue could result in a major nonrecoverable fault on the controller...

CVE-2025-10198: Uncontrolled Search Path Element

Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories...

CVE-2025-54236: Improper Input Validation

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high...

CVE-2025-10095: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been identified in the SMPP server component of the SMSEagle firmware, specifically affecting the handling of certain parameters within the server's database interactions. The vulnerability is isolated to the SMPP server, which operates with its own dedicated...

CVE-2025-55316: External Control of File Name or Path

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-58215: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in gavias Ziston ziston allows PHP Local File Inclusion.This issue affects Ziston: from n/a through 1.4.5...

CVE-2025-54103: Use After Free

Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally...

CVE-2025-54894: Heap-based Buffer Overflow

Local Security Authority Subsystem Service Elevation of Privilege Vulnerability...

CVE-2025-47695: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through = 3.4.7...

CVE-2025-47437: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through = 7.0.1...

CVE-2025-54261: Improper Limitation of a Pathname to a Restricted Directory

ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution by an attacker. The victim must have optional configurations enabled. Scope is changed...

CVE-2025-58982: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pixeline Pixeline's Email Protector pixelines-email-protector allows Stored XSS.This issue affects Pixeline's Email Protector: from n/a through = 1.3.8...

CVE-2025-52277: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field...

Exploit for CVE-2017-0144

🔥 AKUMA'S ADVANCED LOW-HANGING FRUIT SCANNER v2.0 "Your i...

Web-Application-Vulnerability-scanner

Web-Application-Vulnerability-scanner A Python...

Web-Vulnerability-Scanner

This is a PoC exploit for a web vulnerability scanner created us...

CVE-2025-57141: Improper Control of Generation of Code

rsbi-os 4.7 is vulnerable to Remote Code Execution RCE in sqlite-jdbc...