PT-2025-27289 · WordPress · Game Users Share Buttons

Name of the Vulnerable Software and Affected Versions: Game Users Share Buttons plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to insufficient file path validation in the ajaxDeleteTheme function, allowing Subscriber-level attackers to add arbitrary fi...

PT-2025-27262 · Marvell · Marvell Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: The issue is related to a directory traversal remote code execution vulnerability in the saveAsText function. This allows for potential remote code execution...

CVE-2025-49003

DataEase (H2) prior to version 2.10.11 is vulnerable to a Java character-conversion issue where certain characters (for example, ı -> I and ſ -> S) can be manipulated to trigger remote code execution. Affected component is the Java-based text/processing logic linked to the DataEase data vis...

Sitecore 10.4 - Remote Code Execution (RCE)

Exploit Title: Sitecore 10.4 - Remote Code Execution RCE Exploit Author: Yesith Alvarez Vendor Homepage: https://developers.sitecore.com/downloads Version: Sitecore 10.3 - 10.4 CVE : CVE-2025-27218 Link: https://github.com/yealvarez/CVE/blob/main/CVE-2025-27218/exploit.py from requests import...

CVE-2025-6642 PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visi...

CVE-2025-6651

CVE-2025-6651 concerns PDF-XChange Editor where the JP2 file parsing has an input validation flaw that can cause an out-of-bounds write. Exploitation enables remote code execution in the context of the affected process, with user interaction required (target must open a malicious file or page). T...

CVE-2025-6445

CVE-2025-6445 affects ServiceStack via the FindType method, where lack of validation of a user-supplied path in file operations enables remote code execution in the context of the current process. Documented by multiple connected sources (e.g., ZDI advisory ZDI-25-416; Red Hat CVE entry) with att...

CVE-2025-6445 ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability

ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ServiceStack. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2025-34040

An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directorie...

PT-2025-26780

Name of the Vulnerable Software and Affected Versions: Hikka versions all Description: The issue affects all users on all versions of Hikka, a Telegram userbot. Two scenarios are possible: 1. If the web interface does not have an authenticated session, an attacker can use their own Telegram accou...

CVE-2025-52562 Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution

Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially...

Exploit for Code Injection in Langflow

CVE-2025-3248 – Unauthenticated Remote Code Execution in Langf...

CVE-2025-5479

CVE-2025-5479 affects Sony XAV-AX8500. A heap-based buffer overflow in the Bluetooth AVCTP protocol allows remote code execution when an attacker can pair a malicious Bluetooth device with the target, exploiting improper validation of user-supplied data. The issue arises in the Bluetooth AVCTP im...

CVE-2025-45890

Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter...

CVE-2025-23121

A vulnerability allowing remote code execution RCE on the Backup Server by an authenticated domain user...

BeyondTrust Remote Support (RS) 24.2.2 < 24.3.3 Server-Side Template Injection

The version of BeyondTrust Remote Support RS running on the remote host is affected by a server-side template injection vulnerability which can lead to remote code execution. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

CVE-2025-23121

CVE-2025-23121 affects Veeam Backup & Replication (Backup Server) with remote code execution achievable by an authenticated domain user on domain-joined servers. Public details consistently cite version pre-12.3.2.3617 as vulnerable; remediation is to upgrade to 12.3.2.3617 or newer. Multiple sou...

CVE-2025-23121

A vulnerability allowing remote code execution RCE on the Backup Server by an authenticated domain user...

CVE-2025-47865

CVE-2025-47865 : A Local File Inclusion vulnerability affects Trend Micro Apex Central widget in versions below 8.0.6955. The flaw exists in the getObjWGFServiceApiByApiName function and can lead to remote code execution on affected installations. Exploitation details in public disclosures indica...

PT-2025-25630 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A remote code execution issue is mentioned, but details are scarce due to the rejection of the candidate. No information is provided about the estimated number of potentially affected device...