CVE-2025-40630

Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com///%2e%2e” https://icewarp.domain.com///%2e%2e” . This...

CVE-2025-40630 Open redirection vulnerability in IceWarp Mail Server

Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com///%2e%2e” https://icewarp.domain.com///%2e%2e” . This...

CVE-2025-40630 Open redirection vulnerability in IceWarp Mail Server

Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com///%2e%2e” https://icewarp.domain.com///%2e%2e” . This...

CVE-2025-40630

IceWarp Mail Server ≤11.4.0 suffers an open redirect vulnerability. The issue is triggered by crafting malicious URLs that redirect users to arbitrary external domains (examples show vulnerable URL formats). Root cause is improper handling of target URLs leading to redirects. Affected product/ver...

Casdoor 1.901.0 - Cross-Site Request Forgery (CSRF)

Exploit Title: Casdoor 1.901.0 - Cross-Site Request Forgery CSRF Application: Casdoor Version: 1.901.0 Date: 03/07/2024 Exploit Author: Van Lam Nguyen Vendor Homepage: https://casdoor.org/ Software Link: https://github.com/casdoor/casdoor/archive/refs/tags/v1.901.0.zip Tested on: Windows CVE : N/...

Microsoft Windows 11 - Kernel Privilege Escalation

Exploit Title: Microsoft Windows 11 - Kernel Privilege Escalation Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL Tested on: Win, Ubuntu CVE : CVE-2024-21338 include "pch.hpp" include "poc.hpp" // This...

[SECURITY] Fedora 42 Update: uv-0.6.14-3.fc42

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

FoxCMS 1.2.5 - Remote Code Execution (RCE)

Date: 2025-04-17 Exploit Title: Exploit Author: VeryLazyTech Vendor Homepage: https://www.foxcms.org/ Software Link: https://www.foxcms.cn/ Version: FoxCMS v.1.2.5 Tested on: Ubuntu 22.04, Windows Server 2019 CVE: CVE-2025-29306 Website: https://www.verylazytech.com !/bin/bash banner cat " exit 1...

📄 PandoraFMS 7.0NG.772 SQL Injection

PandoraFMS version 7.0NG.772 proof of concept authenticated remote SQL injection exploit. Exploit Title: PandoraFMS console v7.0NG.772 - SQL Injection Authenticated Date: 21/11/2023 Exploit Author: Osama Yousef Vendor Homepage: https://pandorafms.com/ Software Link:...

Exploit for Uncontrolled Search Path Element in Imagemagick

ImageMagick Arbitrary Code Execution CVE-2024-41817 Proof o...

OpenPanel 0.3.4 Remote Code Execution Vulnerability

Exploit Title: OpenPanel 0.3.4 - Remote Code Execution via Fix Permission Exploit Author: Punthat Siriwan, Korn Chaisuwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2025-25872 POST /fix-permissio...

Poko Arcade HTML 5 Game Portal PHP Script 1.0 SQL Injection

Poko Arcade HTML 5 Game Portal PHP Script version 1.0 suffers from a remote SQL injection vulnerability. Exploit Title: Poko Arcade HTML 5 Game Portal PHP Script v1.0 - SQL Injection Date: 05-03-2025 Exploit Author: Buğra Enis Dönmez Vendor:...

FreeBSD : electron{32,33} -- multiple vulnerabilities (f4f3e001-402b-4d6d-8efa-ab11fcf8de2b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f4f3e001-402b-4d6d-8efa-ab11fcf8de2b advisory. Electron developers report: This update fixes the following vulnerabilities: Tenable has...

Webmin 2.202 Remote Code Execution

Webmin version 2.202 suffers from a remote code execution vulnerability. Exploit Title: Webmin RCE Leading to Privilege Escalation Google Dork: N/A Date: 05-03-2025 Exploit Author: Buğra Enis Dönmez Vendor Homepage: https://webmin.com/ Software Link: https://webmin.com/ Version: 2.202 Tested on:...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : cmark-gfm vulnerabilities (USN-7319-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7319-1 advisory. It was discovered that cmark-gfm's autolink extension did not correctly handle parsing large inputs. An attacker could...

Crest Engine CMS 1.0 Cross Site Scripting

Crest Engine CMS version 1.0 suffers from a cross site scripting vulnerability. Exploit Title: Crest Engine CMS - Reflected Cross-Site Scripting XSS Exploit Author: wa-3, Telegram: @wa03 Vendor Homepage: http://e-gate.me/ Version: 1.0 Tested on: http://demo.e-gate.me/ Vulnerable path:/crest/engin...

DEBIAN-CVE-2024-58014

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: add gain range check to wlcphyiqcalgainparamsnphy In 'wlcphyiqcalgainparamsnphy', add gain range check to WARN instead of possible out-of-bounds 'tbliqcalgainparamsnphy' access. Compile tested only. Found by Linux...

CVE-2024-57995

CVE-2024-57995 affects the Linux kernel’s wifi ath12k driver. In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different radio it is later freed via ath12k_mac_unassign_link_vif(), and a subsequent check on arvif could read freed memory (read-after-free). The fix relocates the check t...

CVE-2022-49533 ath11k: Change max no of active probe SSID and BSSID to fw capability

In the Linux kernel, the following vulnerability has been resolved: ath11k: Change max no of active probe SSID and BSSID to fw capability The maximum number of SSIDs in a for active probe requests is currently reported as 16 WLANSCANPARAMSMAXSSID when registering the driver. The scanreqparams...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: vmci: Speculation leaks were prevented by sanitizing the event in eventdeliver. Coverity identified that eventmsg is controlled by user-space. eventmsg-eventdata.event is passed to eventdeliver and used as an index without proper...