CVE-2025-26326

A vulnerability was identified in the NVDA Remote version 2.6.4 and Tele NVDA Remote version 2025.3.3 remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered ...

CVE-2025-1570 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directoristgeneratepasswordresetpincode and resetuserpassword functions...

CVE-2025-1570

CVE-2025-1570 : Directorist – AI-Powered Business Directory Plugin for WordPress suffers privilege escalation via account takeover in all versions up to and including 8.1. The root cause is inadequate controls in directorist_generate_password_reset_pin_code() and reset_user_password() that permit...

CVE-2025-1570 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directoristgeneratepasswordresetpincode and resetuserpassword functions...

CVE-2025-26326

A vulnerability was identified in the NVDA Remote version 2.6.4 and Tele NVDA Remote version 2025.3.3 remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered ...

CVE-2025-26326

A vulnerability was identified in the NVDA Remote version 2.6.4 and Tele NVDA Remote version 2025.3.3 remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered ...

PT-2025-9107 · Nvda · Nvda

Name of the Vulnerable Software and Affected Versions: NVDA versions 2024.4.1 through 2024.4.2 Description: A vulnerability in the remote connection complements of NVDA allows an attacker to obtain total control of the remote system when guessing a weak password. The problem occurs because the...

NVDA 安全漏洞

NVDA Nonvisual Desktop Access is a non-visual desktop access system open-sourced by NV Access. A security vulnerability exists in NVDA versions 2024.4.1 and 2024.4.2, which stems from the acceptance of weak passwords by the Remote Connect component, which could lead to full control of the system...

CVE-2025-26326

CVE-2025-26326 affects the NVDA Remote (v2.6.4) and Tele NVDA Remote (v2025.3.3) remote connection add-ons. The root cause is that the components accept any entered password without additional authentication or device verification, enabling brute-force/guess attacks. Reports indicate over 1,000 s...

Dell Client BIOS Weak Authentication (DSA-2025-021)

Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. Note that Nessus has not tested for this issue but has instead relied only on the application's...

The vulnerability of the software implementation of the TLS protocol for managing the SAN network by Brocade SANnav allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the software implementation of the TLS protocol for managing SAN networks in Brocade SANnav systems is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized...

VulnCheck KEV: CVE-2024-8425

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.9.2. This makes it possible for...

The vulnerability of software solutions that support the closing, consolidation, and reporting processes of IBM Cognos Controller and IBM Controller, related to the use of cryptographic algorithms containing vulnerabilities, allows attackers to gain unauthorized access to protected information.

The vulnerabilities of software solutions that support the closing, consolidation, and reporting processes of IBM Cognos Controller and IBM Controller are related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting these vulnerabilities can allow unauthorized actors to...

The vulnerability of the software products of the LLC “NPO ‘MIR’, related to the use of weak protection for database data, allows attackers to disclose the protected information.

The vulnerability of the software products developed by LLC “NPO ‘MIR’ lies in the use of weak protection for database credentials. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose the protected information...

WordPress plugin Subscriptions & Memberships for PayPal 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists i...

The vulnerability of the software products of the LLC “NPO ‘MIR’, related to weak password requirements, allows attackers to execute a brute-force attack.

The vulnerability of the software products developed by LLC “NPO ‘MIR’ is related to weak password requirements. Exploiting this vulnerability allows a malicious actor to carry out an attack using brute-force methods...

USN-7297-1 ProFTPD vulnerabilities

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that the transport protocol implementation in ProFTPD had weak integrity checks. An attacker could use this vulnerability to bypass security features like encryption and integrity checks. CVE-2023-48795 Martin Mirchev discovered that...

USN-7292-1 Several security issues were fixed in Dropbear

Manfred Kaiser discovered that Dropbear through 2020.81 does not properly check the available authentication methods in the client-side SSH code. An attacker could use this vulnerability to gain unauthorized access to remote systems. CVE-2021-36369 Fabian Bäumer, Marcus Brinkmann, and Jörg Schwen...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Dropbear vulnerabilities (USN-7292-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7292-1 advisory. Manfred Kaiser discovered that Dropbear through 2020.81 does not properly check the available authentication methods in the...

Under The Hoodie: The Pen Test Diaries

Breaking In So You Don’t Have To Each year, Rapid7 penetration testers conduct over 1,000 security assessments, pushing boundaries to expose vulnerabilities before the bad guys do. The mission? Get in, escalate privileges, and own the environment—physically, digitally, or sometimes just by...