CVE-2025-56709

CVE-2025-56709 affects the rtty project. The connected exploit repository documents a savepath buffer overflow in the download/file handling logic, where total_size checks against available space (ramfs or statvfs) and path construction prior to file creation can lead to a crash and potential exp...

CVE-2025-56708

CVE-2025-56708 affects rtty up to v9.0.0 with a directory-traversal/unauthorized file upload issue via the WebSocket fileInfo method. The connected exploit repository shows a buffer-length/space-check vulnerability path and an unauthenticated upload to arbitrary paths, including saving to user-sp...

CVE-2025-55817

CVE-2025-55817 has a concrete exploit entry: a Stored Cross Site Scripting (XSS) in ChilliCream Nitro GraphQL v28.0.13. The PoC exploit targets the GraphQL schema’s query field, likely via exploit.py, requiring a vulnerable Nitro GraphQL version. Impact stated: execution of arbitrary JavaScript c...

CVE-2025-67890

Open Journal Systems path traversal (NativeXmlIssueGalleyFilter.php) affects OJS

CVE-2021-6789

Technical details for CVE-2021-6789 are not publicly available in the provided documents. Monitor for updates from CIRCL and connected sources for affected products, impact, and remediation.

CVE-2025-27890

PT-2025-35594 documents CVE-2025-27890 as affecting WhatsApp for iOS with an Incomplete Authorization issue (severity: Medium). The connected document confirms the vulnerability type but provides no technical details about the root cause, affected versions, exploitability, or remediation. No expl...

CVE-2025-52413

CVE-2025-52413 affects Particle Device OS (v5.6.0 vulnerable; v5.7.0+ patched). A buffer overflow in ble_control_request_channel.cpp causes an unbounded memcpy into a 64-byte buffer, adjacent to a function pointer (ThreadRunner::eventHandler_). Overwriting the pointer enables control-flow hijacki...

CVE-2025-55349

The CVE applies to Unitech PM2, specifically the lib/API/Modules/NPM.js component, where PM2 v5.4.2 and earlier is vulnerable to arbitrary code execution via crafted postinstall scripts during module installations (including Git-based or local file installations). The flaw stems from PM2 treating...

CVE-2025-55616

CVE-2025-55616 has a connected exploit module (DC1E571F-0A31-5CD6-AF19-CF3299EADB59) describing a web application remote code execution vulnerability. The module notes a probable exploit entry point (exploit.py) and that the attacker requires a vulnerable version of the web application; dependenc...

CVE-2025-51820

CVE-2025-51820 is evidenced by connected data describing a Remote Code Execution in the Online Shopping Portal Project v1.0. The affected component is /shopping/admin/insert-product.php, with the root cause being insufficient validation/sanitization of user input (and insecure handling of file up...

CVE-2025-30108

CVE-2025-30126 (and related CVE-2025-30108 entry) affects Vite with the local development server’s @fs mechanism. The issue arises in transformMiddleware handling of special query strings, enabling a remote attacker to bypass file access controls and read arbitrary files via crafted GET requests ...

CVE-2025-48932

This CVE concerns Invision Community versions prior to 4.7.21 (i.e., 4.x before 4.7.21). The vulnerability is in /applications/calendar/modules/front/calendar/view.php, in IPS\calendar\modules\front\calendar\view::search(), where the location parameter from the request is not properly sanitized b...

CVE-2025-48933

CVE-2025-48933 is a reflected Cross-Site Scripting (XSS) vulnerability in Invision Community (oauth/callback endpoint). The issue occurs when user input is passed via the state POST parameter and echoed in HTML output, allowing an attacker to inject malicious scripts in affected users’ browsers. ...

CVE-2025-50716

CVE-2025-50716 is tied to RealEstate-PHP v1.0 (CodeAstro). A Stored XSS in admin panel was disclosed for the component userlist.php, where an attacker can inject JavaScript by registering with a crafted Name/Email (e.g., alert(1)); the payload executes when an admin views the user list, enabling ...

CVE-2025-50721

CVE-2025-50721 affects RealEstate-PHP (register.php). A file upload flaw allows uploading a PHP file disguised as a PNG, which is saved as /admin/user/shell.php and can enable remote PHP/OS command execution. Exploit details are linked to Exploit-DB (exploit #51840).

CVE-2025-31337

PT-2025-29935 (connected document) describes a critical DoS scenario driven by remote social engineering via a memetic payload, which purportedly converts an entire source file to Rust-encryption-like code. The affected product name and versions are not determinable, and there is no information o...

CVE-2025-52097

CVE-2025-52097 affects InstantForum.NET v4.1.4 (InstantASP Ltd). The vulnerability is a reflected XSS caused by unsanitized input in the hbhxg query string parameter that is reflected into HTML without output encoding, enabling arbitrary JavaScript execution in the victim’s browser. A GitHubExplo...

CVE-2025-51046

CVE-2025-51046 affects SourceCodeste Online Student Clearance System v1.0. The vulnerability is an unrestricted file upload in edit-photo.php and the /uploads/ directory, enabling remote code execution via uploaded PHP scripts due to lack of file-type validation and sanitization. Root cause: impr...

CVE-2025-46181

CVE-2025-46181 is evidenced by a concrete PoC of a Reflected Cross-Site Scripting (XSS) in a public online appointment booking system (v1.0). The vulnerability is in the page handling appointment confirmation, where a GET parameter (slotdt) is not properly sanitized, enabling JavaScript execution...

CVE-2025-99999

Technical details for CVE-2025-99999 are not publicly available in the provided documents. Monitoring for updates is advised, as the candidate remains reserved with no disclosed impact, affected products, or remediation information.