CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

371 matches found

RedhatCVE•added 2025/12/18 8:37 p.m.•4 views

CVE-2025-34442

AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains...

7.5CVSS6.8AI score0.00731EPSS

Exploits2References1

Vulnrichment•added 2025/12/12 3:20 a.m.•3 views

CVE-2025-14132 Category Dropdown List <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' variable in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

6.1CVSS5.3AI score0.00204EPSS

Exploits0References3

Packet Storm•added 2025/12/12 12:0 a.m.•152 views

📄 Drupal 11.x-dev Information Disclosure

Proof of concept script demonstrating a full path disclosure issue in Drupal version 11.x-dev. ============================================================================================================================================= | Title : Drupal 11.x-dev full Information Disclosure | |...

5.3CVSS6.9AI score0.09269EPSS

Exploits4

Vulnrichment•added 2025/10/23 4:30 p.m.•2 views

CVE-2025-34156 Tibbo AggreGate Network Manager < 6.40.05 System Information Exposure

Tibbo AggreGate Network Manager 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses Java system properties, server path details, and version information to unauthorized users, resulting in information disclosure that could ai...

6.9CVSS6AI score0.00338EPSS

Exploits0References3