CVE-2024-8425

The CVE-2024-8425 entry concerns the WordPress WooCommerce Ultimate Gift Card plugin (versions up to 2.6.0). The root cause is insufficient file type validation in mwb_wgm_preview_mail and mwb_wgm_woocommerce_add_cart_item_data, allowing unauthenticated arbitrary file uploads to the server and po...

CVE-2024-9193

Summary: CVE-2024-9193 affects the WordPress WHMpress plugin (versions

CVE-2025-1743

The CVE-2025-1743 entry affects zyx0814 Pichome 2.1.0, specifically the /index.php?mod=textviewer endpoint where manipulating the src parameter enables path traversal. The Nuclei template for Pichome 2.1.0 documents an arbitrary file read via this path traversal, with remote exploit capability an...

CVE-2025-21756

CVE-2025-21756 affects the Linux kernel vsock subsystem. The issue arises from keeping socket bindings until destruction, preventing correct unbinding during transport reassignment. This leads to a use-after-free in the binding path, observed as a KASAN slab-use-after-free in __vsock_bind and rel...

CVE-2025-22952

Elestio Memos (v0.23.0) is affected by CVE-2025-22952: a Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs. The Nuclei template confirms the issue as applicable to MEMOS versions up to 0.24.0 and notes that unauthenticated attackers can exploit SSRF to access...

CVE-2024-53944

CVE-2024-53944 affects Tuoshi/Dionlink LT15D 4G and LT21B devices (M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and M7628xUSAxUIv2_v1.0.1481.15.02_P0). The issue is a command injection via /goform/formJsonAjaxReq where JSON parameters aren’t sanitized, allowing unauthenticated network‑remote attackers to ...

CVE-2024-57040

CVE-2024-57040 affects TP-Link TL-WR845N devices running TL-WR845N(UN)_V4_190219 and TL-WR845N(UN)_V4_200909, which contain a hardcoded root password. Root access can be obtained by analyzing downloaded firmware or via brute-force attempts with physical access. Supplier states the issue was fixed...

CVE-2025-27112

Navidrome ≤0.54.5 is vulnerable to an authentication bypass in certain Subsonic API endpoints. A flaw in the authentication check allows an attacker to specify any non-existent username together with a salted hash of an empty password, making the request appear authenticated and granting read-onl...

CVE-2025-24893

CVE-2025-24893 affects XWiki Platform and enables unauthenticated remote code execution via the SolrSearch macro, where user-controlled input is evaluated by the Groovy engine, leading to arbitrary command execution and impact to confidentiality, integrity, and availability of the whole installat...

CVE-2025-0868

DocsGPT (versions 0.8.1–0.12.0) contains a Remote Code Execution vulnerability caused by unsafe JSON parsing with eval() in the /api/remote endpoint. Unauthenticated, network-accessible attackers can inject arbitrary Python code, enabling full server compromise with high impact on confidentiality...

CVE-2024-55457

Affected product: MasterSAM Star Gate v11.Vulnerability type: Directory traversal / local file inclusion via the endpoint /adama/adama/downloadService (parameter file).Root cause: Insufficient validation of the file parameter allows reading arbitrary files on the server.Impact (as described): Pot...

CVE-2025-24989

CVE-2025-24989 is an elevation of privilege vulnerability in Microsoft Power Pages caused by improper access control. Public sources in the provided documents consistently describe it as allowing an unauthorized networked attacker to bypass the user registration control and escalate privileges. R...

CVE-2025-1448

CVE-2025-1448 affects Synway SMG Gateway Management Software up to 20250204. The issue is in the handling of the file 9-12ping.php, where the retry parameter can be manipulated to trigger a command-injection vulnerability. Exploitation can be remote; public PoCs exist. Remediation details are lim...

CVE-2025-1023

Summary of CVE-2025-1023 (ChurchCRM) : Affects ChurchCRM 5.13.0 and earlier. The root cause is a time-based blind SQL injection in EditEventTypes where the newCountName parameter is directly concatenated into an SQL query, enabling manipulation of queries and potential data exfiltration, modifica...

CVE-2024-13609

The CVE-2024-13609 issue affects the WordPress plugin “1 Click WordPress Migration Plugin.” All versions up to and including 2.2 are reported vulnerable to Sensitive Information Exposure via the class-ocm-backup.php, enabling unauthenticated attackers to access usernames and password hashes durin...

CVE-2024-57049

CVE-2024-57049 is associated with a TP-Link Archer C20 router vulnerability. The affected product is the Archer C20 with firmware version V6.6_230412 and earlier. Affected component/path: interfaces under the /cgi directory. Root cause: authentication bypass via a crafted Referer header (Referer:...

CVE-2024-57046

CVE-2024-57046 affects Netgear DGN2200 routers; authentication can be bypassed by requesting URLs with ?x=1.gif for firmware versions v1.0.0.46 and earlier. The public details describe an authentication bypass that lets unauthorized users access administrative functions and router configuration. ...

CVE-2025-1338

CVE-2025-1338 affects NUUO Camera versions up to 20250203. The vulnerability resides in the handle_config.php function print_file, where manipulation of the log argument enables remote OS command injection. The issue is remotely exploitable and has public exploits/public disclosure. Impact is rem...

CVE-2025-1302

CVE-2025-1302 affects jsonpath-plus

CVE-2025-26793

CVE-2025-26793 affects Hirsch Enterphone MESH Web GUI. The default credentials (username: freedom, password: viscount) are not forced to be changed during initial configuration, and changing them is cumbersome. Attackers may use the Internet-facing endpoint mesh.webadmin.MESHAdminServlet to gain ...