35,507 results · Clear filters · Feed
-
Critical 9.3
ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session han…
-
Medium 6.6CVE-2025-54874 Public exploit
OpenJPEG allows OOB heap memory write in opj_jp2_read_header
OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.
-
Low 2.4CVE-2025-8550 Public exploit
atjiu pybbs list cross site scripting
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/topic/list. The manipulation of the argument Username leads to cross site scripting. The a…
-
High 8.6CVE-2025-54135 Public exploit
Cursor Agent is vulnerable to prompt injection via MCP Special Files
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files…
-
High 7.7CVE-2025-54794 Public exploit
Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access
Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation d…
-
High 8.7CVE-2025-54795 Public exploit
Claude Code echo command allowed bypass of user approval prompt for command execution
Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add unt…
-
Medium 5.4CVE-2025-50592 Public exploit
Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.
-
Medium 6.5CVE-2025-45512 Public exploit
A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attac…
-
Medium 6.5CVE-2025-52078 Public exploit
File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to…
-
Critical 9.3CVE-2013-10054 Public exploit
LibrettoCMS File Manager Arbitrary File Upload
An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plug…
-
High 8.5CVE-2013-10052 Public exploit
ZPanel zsudo Local Privilege Escalation
ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw…
-
Medium 4.7CVE-2025-8518 Public exploit
givanz Vvveb Code Editor code.php save code injection
A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection. The attack may be …
-
Medium 6.3CVE-2025-8517 Public exploit
givanz Vvveb session fixiation
A vulnerability was detected in givanz Vvveb 1.0.6.1. Impacted is an unknown function. The manipulation results in session fixiation. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.0.7 is recommended to …
-
High 7.3
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command (…
-
High 8.8CVE-2025-20701 Public exploit
In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This co…
-
High 8.8CVE-2025-20700 Public exploit
In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE proto…
-
Critical 9.8CVE-2025-50341 Public exploit
A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter. An attacker can m…
-
Medium 6.5CVE-2025-50420 Public exploit
An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via…
-
Medium 4.3CVE-2025-50340 Public exploit
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authent…
-
Critical 9.6CVE-2025-50754 Public exploit
Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A mal…
-
Low 2.9CVE-2025-50422 Public exploit
Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_…
-
Medium 6.5CVE-2025-46206 Public exploit
An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursio…
-
High 8.4CVE-2025-51726 Public exploit
CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulner…
-
Medium 5.3CVE-2025-54554 Public exploit
tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive infor…
-
Medium 6.4CVE-2025-54962 Public exploit
/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such…
-
High 7.3CVE-2025-8471 Public exploit
projectworlds Online Admission System adminlogin.php sql injection
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of the file /adminlogin.php. The manipulation of the argument a_id leads to sql injection. The attack ma…
-
Critical 9.4
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local…
-
High 7.2
Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals
Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally…
-
High 8.1CVE-2025-54424 Public exploit
1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution
1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate ve…
-
High 8.7CVE-2013-10053 Public exploit
ZPanel <= 10.0.0.2 htpasswd Module Username Command Execution
A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system() call that invokes the system’s htpasswd binary. By injecting shell met…
-
High 7.5CVE-2013-10057 Public exploit
Synactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer Overflow
A stack-based buffer overflow vulnerability exists in Synactis PDF In-The-Box ActiveX control (PDF_IN_1.ocx), specifically the ConnectToSynactis method. When a long string is passed to this method—intended to populate the ldCmdLine argument of a WinExec call—…
-
Critical 9.3CVE-2013-10049 Public exploit
Raidsonic NAS Devices Unauthenticated Remote Command Execution
An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-…
-
High 8.7CVE-2013-10044 Public exploit
OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file uploa…
-
Medium 6.9CVE-2013-10063 Public exploit
Netgear SPH200D <= 1.0.4.80 Path Traversal via HTTP GET
A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server. Authenticated attackers can exploit crafted GET requests to access arbitrary files outside the web root by injecting traversal s…
-
Critical 9.4CVE-2013-10060 Public exploit
Netgear Routers pppoe.cgi RCE
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted i…
-
High 8.6CVE-2013-10061 Public exploit
Netgear Routers setup.cgi RCE
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutral…
-
Critical 9.3CVE-2013-10047 Public exploit
MiniWeb <= Build 300 Arbitrary File Upload
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystem. By abusing the upload handler and crafting a traversal path, an attacker ca…
-
High 8.6CVE-2013-10058 Public exploit
Linksys Routers apply.cgi Remote Command Injection
An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_…
-
Medium 6.9CVE-2013-10062 Public exploit
Linksys Routers apply.cgi Path Traversal
A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to…
-
High 8.5CVE-2012-10022 Public exploit
Kloxo <= 6.1.12 Local Privilege Escalation
Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matc…