CVE-2025-26244

CVE-2025-26244 affects the DeimosC2 project (graph functionality) in version v1.1.0-Beta , with a Stored XSS vulnerability that can lead to session cookie theft and unauthorized access to the C2 server. A PoC exploit exists (GitHub: JaRm222/CVE-2025-26244) and a writeup is linked; the PoCSpoof.go...

CVE-2025-29277

CVE-2025-29277 applies to a router where the Diagnostics Ping6 tool on the administration page is vulnerable to a command-injection flaw. The PoC shows entering a host address like path;command in the Ping6 input, which causes the appended command to execute on the system. The PoC output示例 uid=0(...

CVE-2025-29275

CVE-2025-29275 is demonstrated by a stored Cross-Site Scripting (XSS) vulnerability in a router’s web UI. The PoC targets the Fire wall → Port Forwarding page: removing the front-end maxlength via Inspect Element allows injecting a script in the Comment field, which is stored and executed when th...

CVE-2025-29276

CVE-2025-29276 : A reflected Cross-Site Scripting (XSS) vulnerability exists in the router’s administration interface (Diagnostics → Ping). The issue arises from unsanitized input in the Host Address field which is echoed in the server response, allowing arbitrary script execution in the user’s b...

CVE-2025-42813

Technical details for CVE-2025-42813 are not publicly available in the provided documents. Monitor for updates when the candidate is publicized.

CVE-2025-32101

The UNA CMS vulnerability CVE-2025-32101 impacts UNA CMS versions up to 14.0.0-RC4, in the file /template/scripts/BxBaseMenuSetAclLevel.php within BxBaseMenuSetAclLevel::getCode(). User input through the POST parameter profile_id is not properly sanitized before being fed to unserialize(), allowi...

CVE-2025-44228

Technical details for CVE-2025-44228 are not publicly available in the provided documents; monitor for updates.

CVE-2025-666666

CVE-2025-666666 is a reserved entry with later PoC sightings listed in CIRCL (Telegram proofs-of-concept) and a GitHub exploit repository claiming a successful exploit for DD4Shell. The provided documents do not specify affected product/vendor/component, versions, root cause, impact, or remediati...

CVE-2023-12345

CVE-2023-12345 is referenced in connected material with concrete example content: a Nuclei2Snort workflow shows an input YAML for CVE-2023-12345 (including id, info, and an HTTP path with a payload) and an example Snort rule output that embeds cve:CVE-2023-12345. This demonstrates a concrete work...

CVE-2025-25599

CVE-2025-25599 affects Bolt CMS (open-source) with a vulnerable avatar-upload flow that allows an arbitrary file read. Details from the exploit repository describe Bolt CMS 2.3.20 and an insecure temporary file disclosure when users with EDITOR/CHIEF_EDITOR/ADMIN/DEVELOPER roles upload avatars vi...

CVE-2525-25748

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2525-25748; no affected products, impact, or remediation can be determined from the supplied data.

CVE-2020-1612

CVE-2020-1612 is referenced in an exploit GitHub repository titled “Ubuntu-Gnome-privilege-escalation,” which claims to leverage an improper privilege management issue in Freedesktop accountsservice to achieve local privilege escalation in GNOME on Ubuntu. The repository provides a bash-based exp...

CVE-2021-458439

Summary (CVE-2021-458439) : Multiple sources indicate that TerraMaster TOS 4.2.15 and older are affected by a chain of CVEs enabling unauthenticated to root access. CVE-2021-45839 is used to obtain the first administrator’s hash and other data (e.g., MAC address) via a vulnerable endpoint, enabli...

CVE-2015-0965

Affected product: Arris/Motorola Surfboard SBG6580. Vulnerabilities in the web interface allow an arbitrary website to take control of the modem, even without user login. Root cause includes a hardcoded backdoor account (credentials technician/yZgO8Bvj) and lack of CSRF in the login form, enablin...

CVE-2015-0966

CVE-2015-0966 is connected to concrete details in public PoCs: the Arris/Motorola Surfboard SBG6580 web interface contains a multi-faceted vulnerability chain that can enable a remote attacker to take control of the modem through the web UI. The flaws include: Hardcoded credentials (technician/yZ...

CVE-2015-0964

CVE-2015-0964 maps to the Arris/Motorola Surfboard SBG6580 Web Interface Takeover. The connected documents describe multiple interacting vulnerabilities: a hardcoded backdoor account (technician/yZgO8Bvj) and a default/admin login pathway, lack of CSRF protection, and a persistent XSS in the fire...

CVE-2015-0975

CVE-2015-0975 is not a reserved entry with details in the initial doc, but connected documents show concrete references: OpenNMS is vulnerable to an authenticated XML External Entity (XXE) injection in the Real-Time Console (RTC) interface. An authenticated attacker can exploit specially crafted ...

CVE-2013-1625

Titan FTP Administrative Password Disclosure (CVE-2013-1625): Titan FTP servers prior to 9.14.1628 are vulnerable wherein the administrative XML-RPC interface (listening by default on TCP 31001) can leak the legitimate admin username and password when an XML request with bogus credentials is sent...

CVE-2024-49746

CVE-2024-49746 is discussed in connected documents as a complex Android Parcel/Binder deserialization issue that can enable local privilege escalation via a take-ownership path in Parcel data flow. The exploit chain leverages RemoteViews deserialization, nested Parcel/Bundle structures, and a cra...

CVE-2025-0088

CVE-2025-0088 is an Elevation of Privilege in the upstream kernel mremap/Speculative Page Fault path. Public details from connected sources indicate an SPF-related mremap optimization in Android 5.10/5.15 kernels can misdirect TLB flushes, creating a race with memory remapping that can trigger a ...