CVE-2025-55179

WhatsApp family apps (iOS and Mac) are affected by incomplete validation of rich response messages that could allow processing of media content from an arbitrary URL on another user’s device. Affected versions: iOS WhatsApp pre-2.25.23.73, iOS WhatsApp Business pre-2.25.23.82, and Mac WhatsApp pr...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-56603)

net: afcan: do not leave a dangling sk pointer in cancreate. On error cancreate frees the allocated sk object, but sockinitdata has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later. This plugin only works...

D-Link DIR-823G 安全漏洞

The D-Link DIR-823G is a wireless router from China's AUO D-Link. The D-Link DIR-823G suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the device...

PT-2025-46853

Name of the Vulnerable Software and Affected Versions Cisco Catalyst Center affected versions not specified Description A flaw exists in the REST API of Cisco Catalyst Center that could allow a remote attacker with valid credentials at least Observer role to execute arbitrary commands within a...

Cross-site Request Forgery (CSRF)

Apollo Studio Embeddable Explorer & Embeddable Sandbox are vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing origin validation in the client-side handling of window.postMessage events, which allows an attacker to send forged messages that trigger arbitrary GraphQL...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a failure to check thread pointer validity, which could result in a null pointer dereference...

Responsive Hotel Site roomdel.php File SQL Injection Vulnerability

Responsive Hotel Site is a responsive hotel website. Responsive Hotel Site suffers from a SQL injection vulnerability that stems from the /admin/roomdel.php file mishandling the ID parameter and failing to properly validate and filter user input. An attacker can exploit this vulnerability to obta...

CVE-2025-40744

Summary: CVE-2025-40744 affects Solid Edge SE2025 prior to V225.0 Update 11, where the License Service endpoint fails to properly validate client certificates, enabling a potential man-in-the-middle for unauthenticated attackers. Both Red Hat and PT security sources confirm the issue and the affe...

CVE-2025-41104

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'customfield1' in '/estimaterequests/saveestimaterequest'...

EUVD-2025-84357

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/events/save'...

CVE-2025-41101 Multiple vulnerabilities in Fairsketch's RISE CRM Framework

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in'/projects/save'...

PT-2025-46299

Name of the Vulnerable Software and Affected Versions Make Email Customizer for WooCommerce WordPress plugin versions through 1.0.6 Description The software does not properly verify user permissions or validate input data in its AJAX operations. This allows any authenticated user, even those with...

CVE-2025-41107

Stored Cross Site Scripting XSS vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/onlineadmission', wich affects the parameters 'firstname', 'lastname', 'guardianname' and others. This vulnerability could allow a remote user to send ...

CVE-2025-56232

The game client GOG Galaxy version 2.0.0.2 is vulnerable to a Missing SSL Certificate Validation issue. This security flaw allows an attacker who controls the local network, DNS, or a proxy to perform a man-in-the-middle (MitM) attack. By intercepting update requests, the attacker can replace leg...

Tenda CH22 fromP2pListFilter function buffer overflow vulnerability

Tenda CH22 is a network device from Tenda, China. Tenda CH22 version 1.0.0.1 suffers from a buffer overflow vulnerability, which originates from the parameter page of the function fromP2pListFilter in the file /goform/P2pListFilter fails to correctly validate the length of the input data, and can...

EUVD-2025-36703

Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the targe...

HP ThinPro 安全漏洞

HP ThinPro is a Linux-based operating system from Hewlett-Packard HP in the United States. A security vulnerability exists in HP ThinPro version 8.1, which stems from a failure to validate a user's true identity...

WordPress Clanora plugin file upload vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A file upload vulnerability exists in the WordPress Clanora plugin that stems from the application's lack of effective validation of uploaded files. The vulnerability can be...

PT-2025-43460

Name of the Vulnerable Software and Affected Versions versions prior to 2025 Description There is a potential bypass of user profile boundaries through improperly validated forwarded intents. This could allow for local privilege escalation without requiring additional execution privileges or user...

CVE-2025-60790

ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service...