CVE-2025-4632

Samsung MagicINFO 9 Server is affected by a path traversal vulnerability (CVE-2025-4632) in versions prior to 21.1052. An improper limitation of a pathname to a restricted directory issue allows unauthenticated attackers to write arbitrary files with system authority, potentially enabling remote ...

CVE-2025-4396

The CVE-2025-4396 entry documents an unauthenticated, time-based SQL Injection in the Relevanssi – A Better Search WordPress plugin via the cats and tags parameters. Affected versions include all up to 4.24.4 (Free) and up to 2.27.5 (Premium); the root cause is insufficient escaping/processing of...

CVE-2025-42999

CVE-2025-42999 affects SAP NetWeaver Visual Composer Metadata Uploader. It is a deserialization vulnerability that can allow a privileged attacker to compromise confidentiality, integrity, and availability of the host system. Connected documents corroborate a broader context: CVE-2025-31324 (unre...

CVE-2025-47204

Bootstrap Multiselect

CVE-2024-48766

NetAlertX vulnerability CVE-2024-48766 affects versions 24.7.18–24.9.12. A directory traversal flaw allows unauthenticated file reads because an HTTP client can ignore redirects and due to path handling related to logs.php; exploitation observed in the wild (May 2025). Affected components include...

CVE-2025-3605

Summary: CVE-2025-3605 affects the WordPress plugin “Frontend Login and Registration Blocks”. The vulnerability allows unauthenticated privilege escalation by abusing the AJAX handler flr_blocks_user_settings_handle_ajax_callback() to update sensitive user details (notably administrator email). T...

CVE-2024-6648

AP Page Builder (ApolloTheme) is a PrestaShop plugin affected by an absolute path traversal vulnerability in versions prior to 4.0.0 . An unauthenticated remote attacker can modify the product_item_path field within the plugin's config JSON file, enabling arbitrary file read on the underlying sys...

CVE-2025-47729

CVE-2025-47729 relates to TeleMessage’s archiving backend (TM SGNL/Archive Signal). The public records state that the archiving backend stores cleartext copies of user messages, contrary to the stated end-to-end encryption claim, and this exposure has been exploited in the wild as of May 2025. Th...

CVE-2025-35939

Craft CMS is affected by CVE-2025-35939 in versions prior to 5.7.5 and 4.15.3, where unauthenticated users can place arbitrary content (including PHP code) in server session files (sess_[value]) via unsanitized return URLs, potentially enabling local file manipulation or code execution. Remedies:...

CVE-2025-2777

Summary: CVE-2025-2777 affects SysAid On-Prem versions ≤ 23.3.40, with an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing endpoint. This can enable administrator account takeover and arbitrary file read primitives, per multiple sources in the connected documents. Wh...

CVE-2025-2776

CVE-2025-2776 (SysAid On-Prem) : Versions

CVE-2025-2775

CVE-2025-2775 affects SysAid On-Prem versions

CVE-2025-27533

CVE-2025-27533 in Apache ActiveMQ stems from unchecked buffer length during OpenWire unmarshalling, allowing excessive memory allocation and DoS. Affected versions include 6.0.0–6.1.5, 5.18.0–5.18.6, 5.17.0–5.17.6, 5.16.0–5.16.7; 5.19.0 is not affected. If not using mutual TLS, brokers may be vul...

CVE-2025-4283

CVE-2025-4283 affects SourceCodester/oretnom23 Stock Management System v1.0. The vulnerability resides in /classes/Login.php?f=login, where manipulating the Username parameter enables SQL injection. A remote attacker can exploit this, and public disclosures exist (examples include PoCs/exploits l...

CVE-2025-4281

CVE-2025-4281 affects Shenzhen Sixun Software’s Sixun Shanghui Group Business Management System 7, with the vulnerability located in the endpoint at /api/GylOperator/LoadData. The issue allows manipulation leading to information disclosure and can be triggered remotely. Public exploit information...

CVE-2025-4270

The CVE-2025-4270 entry concerns TOTOLINK A720R (firmware 4.1.5cu.374) in the Config Handler’s /cgi-bin/cstecgi.cgi. Affects an unknown function where manipulating the topicurl parameter with inputs such as getInitCfg or getSysStatusCfg leads to information disclosure. The vulnerability can be ex...

CVE-2025-27920

CVE-2025-27920 affects Output Messenger prior to version 2.0.63 (Windows) with a directory traversal vulnerability in the Output Messenger Server Manager that allows an authenticated user to use ../../.. sequences in file-path parameters to access files outside the intended directory, potentially...

CVE-2025-4210

Casdoor SCIM User Creation Endpoint (controller: SCIM.go HandleScim) up to version 1.811.0 contains an authorization bypass caused by manipulation in HandleScim. This allows remote attackers to bypass authorization. A fix is available in version 1.812.0, with patch hash 3d12ac8dc2282369296c338681...

CVE-2025-44846

The CVE-2025-44846 entry concerns TOTOLINK CA600-PoE vulnerable in the recvUpgradeNewFw function where the fwUrl parameter is not properly sanitized. Exploitation would allow remote command execution via a crafted request. Affected software/version: TOTOLINK CA600-PoE 5.3c.6665_B20180820. Documen...

CVE-2025-46554

The CVE-2025-46554 issue affects XWiki platforms starting from 1.8.1 up to just before several patched versions (14.10.22, 15.10.12, 16.4.3, 16.7.0) where the wiki attachment REST endpoint exposes attachment metadata without regard to current user rights. An unauthenticated user could access the ...