Archive
August 2025
Vulnerabilities first published in this month (UTC), newest first.
111 results · Clear filters · Feed
-
High 8.7CVE-2025-7771 Public exploit
Code Execution / Escalation of Privileges in ThrottleStop
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the ru…
-
High 8.1
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plu…
-
High 7.5CVE-2025-51040 Public exploit
Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html en…
-
High 7.1CVE-2012-10024 Public exploit
XBMC ≤ 11.0 Web Server Path Traversal
XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document ro…
-
High 8.7CVE-2013-10065 Public exploit
Sysax Multi-Server <= 6.10 SSHD Key Exchange DoS
A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of mal…
-
High 8.6CVE-2012-10028 Public exploit
Netwin SurgeFTP <= v23c8 Authenticated RCE
Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code exec…
-
High 8.6CVE-2012-10029 Public exploit
Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command Injection
Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.
-
High 8.7CVE-2012-10032 Public exploit
Maxthon3 about:history XCS Trusted Zone Code Execution
Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged c…
-
High 8.7CVE-2012-10034 Public exploit
ClanSphere 2011.3 Local File Inclusion via cs_lang Cookie
ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to improper handling of the cs_lang cookie parameter. The application fails to sanitize user-supplied input, allowing attackers to traverse directories and read arbitrary files outside t…
-
High 8.6CVE-2012-10031 Public exploit
BlazeVideo HDTV Player Pro 6.6.0.3 Filename Handling Buffer Overflow
BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supplied input embedded in .plf playlist files. When parsing a crafted .plf file, the MediaPlayerCtrl.dll component invokes PathFindFileNameA()…
-
High 8.6CVE-2025-54135 Public exploit
Cursor Agent is vulnerable to prompt injection via MCP Special Files
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files…
-
High 7.7CVE-2025-54794 Public exploit
Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access
Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation d…
-
High 8.7CVE-2025-54795 Public exploit
Claude Code echo command allowed bypass of user approval prompt for command execution
Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add unt…
-
High 8.5CVE-2013-10052 Public exploit
ZPanel zsudo Local Privilege Escalation
ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw…
-
High 7.3
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command (…
-
High 8.8CVE-2025-20701 Public exploit
In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This co…
-
High 8.8CVE-2025-20700 Public exploit
In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE proto…
-
High 8.4CVE-2025-51726 Public exploit
CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulner…
-
High 7.3CVE-2025-8471 Public exploit
projectworlds Online Admission System adminlogin.php sql injection
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of the file /adminlogin.php. The manipulation of the argument a_id leads to sql injection. The attack ma…
-
High 7.2
Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals
Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally…
-
High 8.1CVE-2025-54424 Public exploit
1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution
1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate ve…
-
High 8.7CVE-2013-10053 Public exploit
ZPanel <= 10.0.0.2 htpasswd Module Username Command Execution
A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system() call that invokes the system’s htpasswd binary. By injecting shell met…
-
High 7.5CVE-2013-10057 Public exploit
Synactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer Overflow
A stack-based buffer overflow vulnerability exists in Synactis PDF In-The-Box ActiveX control (PDF_IN_1.ocx), specifically the ConnectToSynactis method. When a long string is passed to this method—intended to populate the ldCmdLine argument of a WinExec call—…
-
High 8.7CVE-2013-10044 Public exploit
OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file uploa…
-
High 8.6CVE-2013-10061 Public exploit
Netgear Routers setup.cgi RCE
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutral…
-
High 8.6CVE-2013-10058 Public exploit
Linksys Routers apply.cgi Remote Command Injection
An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_…
-
High 8.5CVE-2012-10022 Public exploit
Kloxo <= 6.1.12 Local Privilege Escalation
Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matc…
-
High 8.7
D-Link Devices tools_vct.xgi Authenticated RCE
An OS command injection vulnerability exists in multiple D-Link routers (confirmed on DIR-300 rev A v1.05 and DIR-615 rev D v4.13) via the authenticated tools_vct.xgi CGI endpoint. The web interface fails to properly sanitize user-supplied input in the pingIp…
-
High 8.6
D-Link Routers tools_vct.htm OS Command Injection
An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. The web interface fails to sanitize input passed from the ping_ipaddr parameter to the too…
-
High 8.5CVE-2013-10046 Public exploit
Agnitum Outpost Internet Security Local Privilege Escalation
A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged user to execute arbitrary code with SYSTEM privileges. The flaw resides in the acs.exe component, which exposes a named pipe that accepts un…
-
High 8.7CVE-2025-41373 Public exploit
SQL injection vulnerability in Gandia Integra Total
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encu…