2,625 results · Clear filters · Feed
-
Medium 6.5CVE-2025-65900 Public exploit
Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Du…
-
Medium 5.3CVE-2025-65899 Public exploit
Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application ret…
-
Medium 5.3CVE-2025-20384 Public exploit
Unauthenticated Log Injection in Splunk Enterprise
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes int…
-
Medium 6.4CVE-2025-13401 Public exploit
Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in…
-
Medium 5.3CVE-2025-12585 Public exploit
MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that ca…
-
Medium 5.1CVE-2025-50361 Public exploit
Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36…
-
Medium 6.5CVE-2025-65345 Public exploit
alexusmai laravel-file-manager is vulnerable to Directory Traversal
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.
-
Medium 4.0CVE-2025-8045 Public exploit
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to gain access to already freed memory.This issue af…
-
Medium 6.3CVE-2025-13796 Public exploit
deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery
A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url l…
-
Medium 6.3CVE-2025-66034 Public exploit
fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib
fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malic…
-
Medium 5.4CVE-2025-65676 Public exploit
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arb…
-
Medium 5.4CVE-2025-65675 Public exploit
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arb…
-
Medium 4.3CVE-2025-65670 Public exploit
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endp…
-
Medium 6.5CVE-2025-13380 Public exploit
AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read
The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1. This is due to insufficient validation of user-supplied file paths in the 'lqdai_update_post' AJ…
-
Medium 6.1CVE-2025-63735 Public exploit
A reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the t…
-
Medium 6.5CVE-2025-63914 Public exploit
An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui…
-
Medium 6.1CVE-2025-63498 Public exploit
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.
-
Medium 4.9CVE-2025-11973 Public exploit
简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read
The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access a…
-
Medium 5.3CVE-2025-11771 Public exploit
Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale Update
The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function …
-
Medium 6.1CVE-2025-64027 Public exploit
Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow
Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface.…
-
Medium 6.1CVE-2025-63848 Public exploit
Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code…
-
Medium 6.7
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vu…
KEV Nov 18, 2025 -
Medium 5.1CVE-2025-63408 Public exploit
Local Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an unauthenticated local attack…
-
Medium 6.8CVE-2025-63892 Public exploit
A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function create_…
-
Medium 4.3CVE-2025-54320 Public exploit
In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email…
-
Medium 6.1CVE-2025-56526 Public exploit
Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted …
-
Medium 6.5CVE-2025-56499 Public exploit
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary …
-
Medium 6.1CVE-2025-63708 Public exploit
Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows r…
-
Medium 6.1CVE-2025-63830 Public exploit
CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafte…
-
Medium 5.8CVE-2025-64714 Public exploit
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated Local File Inclusion exists in the template-switching feature. If `templateselection` is enabled in t…
-
Medium 5.4
An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E120…
-
Medium 6.9
N-central unauthenticated sessionID generation
N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.
-
Medium 6.1CVE-2025-63419 Public exploit
Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can shar…
-
Medium 5.5CVE-2025-12748 Public exploit
Libvirt: denial of service in xml parsing
A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML…
-
Medium 6.7CVE-2025-31931 Public exploit
Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 wi…
-
Medium 5.9
Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
-
Medium 5.3CVE-2025-11986 Public exploit
Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State
The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the registe…
-
Medium 5.3CVE-2025-11988 Public exploit
Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion
The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows callin…
-
Medium 4.3CVE-2025-12433 Public exploit
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of …
-
Medium 6.5CVE-2025-63296 Public exploit
KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boo…