1938 matches found
CVE-2025-31929
A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions, IEC 1Ph 7.4kW Parent cable 7m incl. SIM 8EM1310-2EJ04-3GA2 All...
CVE-2025-46717 sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no or very limited sudo privileges can determine whether files exists in folders that they otherwise cannot access using sudo --list . Users with local access to a machine can discover the...
CVE-2025-22247
creationtimestamp| type| source ---|---|--- 2025-05-12 14:26:24+00:00| seen| https://t.me/cvedetector/25077 2025-05-12 14:32:13+00:00| seen| https://seclists.org/oss-sec/2025/q2/118 2025-05-12 14:42:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loy7duk66y2p 2025-05-12...
CVE-2025-45846
ALFA AIP-W512 v3.2.2.2.3 is affected by CVE-2025-45846 due to an authenticated stack overflow in the torrentsindex parameter of the formBTClinetSetting function. The vulnerability target is the ALFA AIP-W512 router; the root cause is an input handling flaw in the torrentsindex parameter, enabling...
CVE-2025-2821
creationtimestamp| type| source ---|---|--- 2025-05-07 02:21:41+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15248 2025-05-07 04:26:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lokkl454wm2h 2025-05-07 07:12:52+00:00| seen| https://t.me/cvedetector/24670...
Drupal Enterprise MFA - TFA for Drupal module < 4.7.0,5.0.0-5.1.0 - Unauthenticated Broken Access Control vulnerability
Drupal Enterprise MFA - TFA for Drupal module 4.7.0,5.0.0-5.1.0 - Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module Enterprise MFA - TFA for Drupal versions 4.7.0,5.0.0-5.1.0...
CVE-2025-23156
In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: refactor hfi packet parsing logic wordscount denotes the number of words in total payload, while data points to payload of various property within it. When wordscount reaches last word, data can access...
DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing
Transient execution vulnerabilities have emerged as a critical threat to modern processors. Hardware fuzzing testing techniques have recently shown promising results in discovering transient execution bugs in large-scale out-of-order processor designs. However, their poor microarchitectural...
CVE-2025-3644
A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify...
UJCMS 9.6.3 - User Enumeration via IDOR
Exploit Title: UJCMS 9.6.3 User Enumeration via IDOR Exploit Author: Cyd Tseng Date: 11 Dec 2024 Category: Web application Vendor Homepage: https://dromara.org/ Software Link: https://github.com/dromara/ujcms Version: UJCMS 9.6.3 Tested on: Linux CVE: CVE-2024-12483 Advisory:...
Informatica: [███] Cross-Site Scripting (XSS) via /ssl-vpn/getconfig.esp at GlobalProtect VPN Portal
A Cross-Site Scripting XSS vulnerability was discovered in the GlobalProtect VPN portal's getconfig.esp endpoint. The vulnerability existed because the application reflected user input from the user parameter in an XML response without proper sanitization. This allowed an attacker to inject SVG...
📄 Langflow AI Remote Code Execution
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...
pizzapit.com.au Cross Site Scripting vulnerability OBB-4042818
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2025-3408
A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stbdupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product...
📄 UNA CMS 14.0.0-RC4 PHP Object Injection
UNA CMS versions 14.0.0-RC4 and below suffer from a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php. ------------------------------------------------------------------------------------ UNA CMS = 14.0.0-RC4 BxBaseMenuSetAclLevel.php PHP Object Injection Vulnerability...
Appsmith RCE
An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. Module Options msf use exploit/linux/http/appsmithrcecve202455964 msf exploitappsmithrcecve202455964 show targets ...targets... msf...
📄 Microchip TimeProvider 4100 Grandmaster 2.4.6 Command Injection
Microchip TimeProvider 4100 Grandmaster version 2.4.6 suffers from a remote command injection vulnerability. Exploit Title: Microchip TimeProvider 4100 Grandmaster Config File - Remote Code Execution RCE Exploit Author: Armando Huesca Prida Discovered By: Armando Huesca Prida, Marco Negro, Antoni...
CVE-2025-21978
In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: Fix address space leak when Hyper-V DRM device is removed When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device removed, or in the error path for devic...
WordPress Pesapal Gateway for Woocommerce plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Pesapal Gateway for Woocommerce versions = 2.1.0...