Archive
21 May 2025
Vulnerabilities first published on this day (UTC), newest first.
114 results · Feed
-
High 8.2
Stack overflow leading to DoS can be triggered by a malicious authenticated client.
Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
-
Medium 6.9
Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.
Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.
-
High 8.3
Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
-
High 8.2
Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
-
Medium 6.8
XXE vulnerability in Eclipse JGit
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are v…
-
Critical 9.8
Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to incl…
-
Critical 9.8
Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
-
Medium 6.5
Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c
A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming …
-
Medium 4.3
HkCms Search index.html cross site scripting
A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting.…
-
Low 2.4
moonlightL hexo-boot Dynamic List Page index.html cross site scripting
A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html of the component Dynamic List Page. The manipulation leads to cross site scripting. The attack can be…
-
Medium 6.1
Cross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker to execute arbitrary …
-
Medium 6.5
AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.
-
High 7.7CVE-2024-56429 Public exploit
itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users …
-
Medium 5.5CVE-2024-56428 Public exploit
The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the …
-
High 8.4
An issue in Valvesoftware Steam Client Steam Client 1738026274 allows attackers to escalate privileges via a crafted ex…
-
Critical 9.1CVE-2025-27558 Public exploit
IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected A…
-
High 8.4
An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell scrip…
-
Critical 10.0
The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution
The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.
-
High 8.6
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference
The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.
-
Medium 6.8
The Backup Plus extension for TYPO3 (ns_backup) allows command injections
The ns_backup extension through 13.0.0 for TYPO3 allows command injection.
-
High 8.6
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference
The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
-
Medium 6.4
[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability
The cs_seo extension through 9.2.0 for TYPO3 allows XSS.
-
High 8.6
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location
The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.
-
Medium 5.3
The femanager TYPO3 extension allows Insecure Direct Object Reference
The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.
-
Medium 6.1
The Backup Plus extension for TYPO3 (ns_backup) allows XSS
The ns_backup extension through 13.0.0 for TYPO3 allows XSS.
-
Medium 6.1
A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the …
-
High 7.2
A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary …
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to in…
-
High 7.2
A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting …
-
Medium 6.5
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_…
-
Medium 6.5
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4…
-
Critical 9.8
An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication
-
High 7.2
An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash funct…
-
Medium 6.5
Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information vi…