35,507 results · Clear filters · Feed
-
Low 2.0CVE-2025-3639 Public exploit
Liferay Portal Login Bypass Vulnerability
Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 all…
-
Medium 5.9
CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an emb…
-
Medium 6.3
Tenda AC20 Telnet Service telnet websFormDefine command injection
A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploi…
-
High 7.8CVE-2025-38502 Public exploit
bpf: Fix oob access in cgroup local storage
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup loca…
-
High 7.5CVE-2025-38501 Public exploit
ksmbd: limit repeated connections from clients with the same IP
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client conn…
-
Critical 9.8
StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. Th…
-
Medium 6.4CVE-2025-5844 Public exploit
Radius Blocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parameter
The Radius Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subHeadingTagName’ parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authen…
-
Medium 4.3CVE-2025-8091 Public exploit
EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure
The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_eventon shortcodes due to insufficient restrictions on which posts can be included. This makes it poss…
-
High 7.3CVE-2025-8971 Public exploit
itsourcecode Online Tour and Travel Management System travellers.php sql injection
A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument val-username leads to sql injection. The attack…
-
Critical 10.0
Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability
A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. This vulnerability is du…
-
Critical 9.4
Insecure Deserialization Vulnerability
Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
KEV Aug 13, 2025 -
High 8.8CVE-2025-8714 Public exploit
PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall…
-
Critical 9.8
Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermo…
-
Medium 6.0CVE-2025-0309 Public exploit
Netskope Client Local Elevation of Privileges
An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates an…
-
Critical 10.0CVE-2011-10011 Public exploit
WeBid 1.0.2 converter.php Remote PHP Code Injection
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary P…
-
Critical 9.3CVE-2012-10054 Public exploit
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path tra…
-
Critical 10.0CVE-2011-10013 Public exploit
Traq 2.0–2.3 admincp/common.php RCE
Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality.…
-
Critical 9.3CVE-2012-10060 Public exploit
Sysax Multi Server < 5.55 SSH Username Buffer Overflow
Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds c…
-
Critical 10.0CVE-2011-10019 Public exploit
Spreecommerce < 0.60.2 Search Parameter RCE
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send meth…
-
Critical 10.0CVE-2011-10017 Public exploit
Snort Report nmap.php/nbtscan.php RCE
Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell comma…
-
High 8.7CVE-2011-10009 Public exploit
S40 CMS 0.4.2 Path Traversal
S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely wit…
-
Critical 9.3CVE-2011-10016 Public exploit
Real Networks Netzip Classic 7.5.1.86 File Parsing Buffer Overflow
Real Networks Netzip Classic version 7.5.1.86 is vulnerable to a stack-based buffer overflow when parsing a specially crafted ZIP archive. The vulnerability is triggered when the application attempts to process a file name within the archive that exceeds the …
-
Critical 10.0CVE-2012-10058 Public exploit
RabidHamster R4 Log Entry sprintf() Buffer Overflow
RabidHamster R4 v1.25 contains a stack-based buffer overflow vulnerability due to unsafe use of sprintf() when logging malformed HTTP requests. A remote attacker can exploit this flaw by sending a specially crafted URI, resulting in arbitrary code execution u…
-
Critical 9.4CVE-2011-10010 Public exploit
QuickShare File Server 1.2.1 Path Traversal RCE
QuickShare File Server 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of user-supplied file paths. Authenticated users can exploit this flaw by submitting crafted sequences to access or write files outside the inte…
-
High 8.7CVE-2012-10056 Public exploit
PHP Volunteer Management System 1.0.2 Arbitrary File Upload
PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Becau…
-
High 8.4CVE-2011-10012 Public exploit
NetOp Remote Control Client 9.5 .dws File Buffer Overflow
NetOp (now part of Impero Software) Remote Control Client v9.5 is vulnerable to a stack-based buffer overflow when processing .dws configuration files. If a .dws file contains a string longer than 520 bytes, the application fails to perform proper bounds chec…
-
Critical 10.0CVE-2011-10018 Public exploit
myBB 1.6.4 Backdoor Arbitrary Command Execution
myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduce…
-
High 8.4CVE-2012-10057 Public exploit
Lattice Semiconductor ispVM System 18.0.2 XCF File Handling Buffer Overflow
Lattice Semiconductor ispVM System v18.0.2 contains a buffer overflow vulnerability in its handling of .xcf project files. When parsing the version attribute of the ispXCF XML tag, the application fails to properly validate input length, allowing a specially …
-
High 8.7CVE-2011-10014 Public exploit
GTA SA-MP server.cfg Buffer Overflow
GTA San Andreas Multiplayer (SA-MP) server version 0.3.1.1 is vulnerable to a stack-based buffer overflow triggered by parsing a malformed server.cfg configuration file. The vulnerability allows local attackers to execute arbitrary code when the server binary…
-
Critical 9.4CVE-2012-10059 Public exploit
Dolibarr ERP/CRM Post-Auth OS Command Injection
Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary …
-
Critical 9.3CVE-2011-10015 Public exploit
Cytel Studio <= 9.0 .CY3 File Stack Buffer Overflow
Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer (256 bytes) without pro…
-
Critical 9.3CVE-2012-10055 Public exploit
ComSndFTP v1.3.7 Beta USER Format String RCE
ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (s…
-
High 7.3CVE-2025-8924 Public exploit
Campcodes Online Water Billing System viewbill.php sql injection
A vulnerability was identified in Campcodes Online Water Billing System 1.0. This issue affects some unknown processing of the file /viewbill.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit ha…
-
High 8.2CVE-2025-55163 Public exploit
Netty MadeYouReset HTTP/2 DDoS Vulnerability
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames …
-
Medium 6.5CVE-2025-55668 Public exploit
Apache Tomcat: session fixation via rewrite valve
Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended …
-
High 7.5CVE-2025-8671 Public exploit
CVE-2025-8671
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening stre…
-
Critical 9.8CVE-2025-8760 Public exploit
INSTAR 2K+/4K fcgi_server base64_decode buffer overflow
A vulnerability was identified in INSTAR 2K+ and 4K 3.11.1 Build 1124. This affects the function base64_decode of the component fcgi_server. The manipulation of the argument Authorization leads to buffer overflow. It is possible to initiate the attack remotel…
-
Critical 9.8CVE-2025-7384 Public exploit
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for…
-
Medium 6.5CVE-2025-50946 Public exploit
OliveTin OS Command Injection vulnerability
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.
-
Medium 5.4CVE-2025-52392 Public exploit
Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. T…