CVE-2025-48370 auth-js Vulnerable to Insecure Path Routing from Malformed User Input

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the...

CVE-2025-23393 Reflected XSS in spacewalk-java

A Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x8664/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager...

K000151528: Elasticsearch vulnerability CVE-2024-43709

Security Advisory Description An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function. CVE-2024-43709 Impact There is no impact; F5 products are not affected by this...

Oracle Linux 9 : kernel (ELSA-2025-8142)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8142 advisory. - cifs: Fix integer overflow while processing acregmax mount option CKI Backport Bot RHEL-87921 CVE-2025-21964 Tenable has extracted the preceding description...

Amazon Linux AMI : ppp (ALAS-2025-1980)

The version of ppp installed on the remote host is prior to 2.4.5-11.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1980 advisory. The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges. CVE-2024-58250 Tenable has extracted the preceding...

RHEL 9 : keylime-agent-rust (RHSA-2025:7313)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7313 advisory. Rust agent for Keylime Security Fixes: rust-openssl: rust openssl ssl::selectnextproto use after free CVE-2025-24898 For more details about the...

Fedora: Security Advisory (FEDORA-2024-658aeaa7ea)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-20f63c4273)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow (CVE-2025-33104)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2025-48271

Missing Authorization vulnerability in Leadinfo Leadinfo leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadinfo: from n/a through = 1.1...

Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow

!/usr/bin/env python3 Exploit Title: Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow Google Dork: if applicable Date: 2025-05-23 Exploit Author: Pepelux user in ExploitDB Vendor Homepage: https://www.grandstream.com/ Software Link: download link if available Version: Grandstream GSD3710 -...

CVE-2025-46493

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Stored XSS.This issue affects Crossword Compiler Puzzles: from n/a through = 14.5...

CVE-2025-47637 WordPress STAGGS plugin <= 2.11.0 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in STAGGS STAGGS staggs allows Upload a Web Shell to a Web Server.This issue affects STAGGS: from n/a through = 2.11.0...

CVE-2025-22819

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Roberto Bottalico Qr Code and Barcode Scanner Reader qr-code-and-barcode-scanner-reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through = 1.0.0...

CVE-2025-22734

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intelly-posts-footer-manager allows Stored XSS.This issue affects Posts Footer Manager: from n/a through = 2.1.0...

CVE-2025-24693

Missing Authorization vulnerability in Yehi Advanced Notifications advanced-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Notifications: from n/a through = 1.2.7...

CVE-2025-22299

Missing Authorization vulnerability in Space Codes AI for SEO ai-for-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI for SEO: from n/a through = 1.2.9...

CVE-2025-22661

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vcita Online Payments – Get Paid with PayPal, Square & Stripe paypal-payment-button-by-vcita allows Stored XSS.This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a...

CVE-2025-22732

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Admiral Ad Blocking Detector ad-blocking-detector allows Stored XSS.This issue affects Ad Blocking Detector: from n/a through = 3.6.0...

CVE-2025-22549

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in seinoxygen WP Github wp-github allows Stored XSS.This issue affects WP Github: from n/a through = 1.3.3...