31156 matches found
PT-2025-20393 · Totolink · Totolink Nr1800X
Name of the Vulnerable Software and Affected Versions: TOTOLINK NR1800X version 9.1.0u.6681 B20230703 Description: The issue is an authenticated stack overflow that occurs via the ssid parameter in the setWiFiBasicCfg function. This allows for potential exploitation. No information is provided...
PT-2025-20450 · D Link · D-Link Dir-619L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.04B04 Description: A critical issue was found in the function formSetEasy Wizard, where the manipulation of the argument curTime leads to a buffer overflow. This issue can be exploited remotely. The vendor was notifi...
Multiple vulnerabilities in SonicWall SMA 100 series (FIXED)
Overview In April of 2025, Rapid7 discovered and disclosed three new vulnerabilities affecting SonicWall Secure Mobile Access “SMA” 100 series appliances SMA 200, 210, 400, 410, 500v. These vulnerabilities are tracked as CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821. An attacker with access ...
CVE-2025-46720
Keystone is a content management system for Node.js. Prior to version 6.5.0, field.isFilterable access control can be bypassed in update and delete mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields...
curl bug fix and enhancement update
An update is available for curl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8.10...
CVE-2025-30147 ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve
Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum client Hyperledger Besu. Besu 24.7.1 through 25.2.2, corresponding to besu-native versions 0.9.0 through 1.2.1, have a potential consensus bug for the precompiles ALTBN128ADD 0x06,...
CVE-2025-46824
The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin...
CVE-2025-46824
The CVE-2025-46824 entry concerns the Discourse Code Review Plugin. Before commit eed3a80, an attacker could cause arbitrary JavaScript execution in a user’s browser by clicking links to malicious GitHub commits, effectively enabling an XSS vector in Discourse code review workflows. The issue is ...
CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization
Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...
WordPress Easy PayPal Events plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Easy PayPal Events versions = 1.2.2...
WordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Custom Checkout Fields for WooCommerce versions = 1.8.3...
WordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Michael in WordPress Plugin Cost Calculator for Elementor versions = 1.3.3...
WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by luckybuddy in WordPress Plugin WP Hotel Booking versions = 2.1.9...
PT-2025-20039 · Unknown · Enrichedcall
Name of the Vulnerable Software and Affected Versions: EnrichedCall versions prior to SMR May-2025 Release 1 Description: The issue concerns the use of implicit intent for sensitive communication in EnrichedCall, allowing local attackers to access sensitive information. User interaction is requir...
PT-2025-20117 · Unknown · Contact Form Widget
Name of the Vulnerable Software and Affected Versions: Contact Form Widget versions 1.4.6 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Contact Form Widget, allowing unauthorized requests. Recommendations: For versions 1.4.6 and earlier, update to a version that...
PT-2025-20828
Name of the Vulnerable Software and Affected Versions Samsung MagicINFO 9 versions prior to 21.1052 Description An improper limitation of a pathname to a restricted directory issue exists in Samsung MagicINFO 9 Server. This allows attackers to write arbitrary files with system authority. The...
PT-2025-20162 · Unknown · Themefic Beaf
Name of the Vulnerable Software and Affected Versions: Themefic BEAF versions through 4.6.10 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized access to the server...
CVE-2025-2784 affecting package libsoup for versions less than 3.4.4-5
CVE-2025-2784 affecting package libsoup for versions less than 3.4.4-5. A patched version of the package is available...