EUVD-2025-203824

Server-Side Request Forgery SSRF vulnerability in Ctera Portal 8.1.x 8.1.1417.24 allows remote attackers to induce the server to make arbitrary HTTP requests via a crafted HTML file containing an iframe...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2025:4397-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4397-1 advisory. Update to Mozilla Thunderbird 140.6 bsc1254551. - MFSA 2025-96 CVE-2025-14321: use-after-free in...

EUVD-2025-203421

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload malicious JavaScript files, rename them to PHP, and execute system commands by exploiting the saveE and...

EUVD-2025-203409

Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code...

EUVD-2025-203411

TOTOLINK A3300R V17.0.0cu.557B20221024 and N200RE V9.3.5u.6448B20240521 and V9.3.5u.6437B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without logging in remote...

EUVD-2025-203420

GOM Player 2.3.90.5360 contains a buffer overflow vulnerability in the equalizer preset name input field that allows attackers to crash the application. Attackers can overwrite the preset name with 260 'A' characters to trigger a buffer overflow and cause application instability...

EUVD-2025-203415

SyncBreeze 15.2.24 contains a denial of service vulnerability in the login authentication mechanism that allows attackers to crash the service. Attackers can send an oversized password parameter with repeated 'password=' values to overwhelm the login endpoint and potentially disrupt service...

EUVD-2025-203440

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token...

EUVD-2025-203439

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 Deploy transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques...

EUVD-2025-203438

Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file with system commands to the plugin directory and execute arbitrary code by accessing the...

CVE-2025-37731

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

CVE-2025-67907

CVE-2025-67907 is a reservation duplicate of CVE-2025-67906. The linked details for CVE-2025-67906 describe a Cross-Site Scripting (XSS) vulnerability in MISP before 2.5.28, exposed via app/View/Elements/Workflows/executionPath.ctp in the workflow execution path. No exploit specifics are provided...

CVE-2025-14673 gmg137 snap7-rs client.rs as_ct_write heap-based overflow

A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7rs::client::S7Client::asctwrite of the file /tests/snap7-rs/src/client.rs. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2025-8869

creationtimestamp| type| source ---|---|--- 2025-12-14 08:52:53+00:00| seen| https://gist.github.com/LavrukhinaV/c5dec5c8620e117b91092bb60d984a6c 2025-12-14 19:03:16+00:00| seen| https://gist.github.com/skyreaper925/07a25adb281d1f64c2224318485ae6b8 2025-12-21 19:31:57+00:00| seen|...

CVE-2025-14587

A vulnerability was identified in itsourcecode Online Pet Shop Management System 1.0. This affects an unknown part of the file /pet1/available.php. Such manipulation of the argument Name leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be us...

CVE-2025-9856

creationtimestamp| type| source ---|---|--- 2025-12-13 12:01:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7ukkv6rwn22...

CVE-2025-8195

creationtimestamp| type| source ---|---|--- 2025-12-13 11:41:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7ujhrufvy2q 2025-12-15 08:53:10+00:00| seen| https://gist.github.com/Darkcrai86/5baec8d35c6a1ab87a1837ab40d2e03b...

CVE-2025-14584

creationtimestamp| type| source ---|---|--- 2025-12-13 03:25:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7tnrn6qax2u...

CVE-2025-11266

An out-of-bounds write vulnerability exists in the Grassroots DICOM library GDCM. The issue is triggered during parsing of a malformed DICOM file containing encapsulated PixelData fragments compressed image data stored as multiple fragments. This vulnerability leads to a segmentation fault caused...

CVE-2025-14537

A weakness has been identified in code-projects Class and Exam Timetable Management 1.0. Affected by this issue is some unknown functionality of the file /preview7.php. This manipulation of the argument courseyearsection/semester causes sql injection. Remote exploitation of the attack is possible...