mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 12:38:17 -10:00
Update Sun Nov 9 11:32:44 UTC 2025
This commit is contained in:
trickest-workflows committed
1 parent
b7f68cf2c4
commit
f0429b4a24
71 files changed
+1244
-4
No files matched your search
@@ -0,0 +1,17 @@
|
||||
### [CVE-2008-7164](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7164)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Multiple unspecified vulnerabilities in Shareaza before 2.3.1.0 have unknown impact and attack vectors related to "very important security fixes," possibly involving update notifications and a domain that is no longer controlled by the vendor.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- http://sourceforge.net/project/shownotes.php?group_id=110672&release_id=565250
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2012-1597](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1597)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ezsystems/ezjscore/commit/58854564c7b8672090c25c4b1677d08620d870f2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 i
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/chaitin/xray/blob/f90cf321bc4d294bbf6625a9c4853f3bfdf0a384/pocs/seeyon-oa-cookie-leak.yml
|
||||
- https://www.vulncheck.com/advisories/seeyon-zhiyuan-oa-web-application-system-authentication-bypass
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2022-28860](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28860)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An authentication downgrade in the server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to achieve HTTP access to the camera.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ErwanBroquaire/citilog-8.0-vulnerability
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2022-28861](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28861)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to see FTP credentials in a cleartext HTTP traffic. These can be used for FTP access to the server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ErwanBroquaire/citilog-8.0-vulnerability
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2022-40750](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40750)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236588.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.ibm.com/support/pages/node/6833552
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2022-43771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43771)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://support.pentaho.com/hc/en-us/articles/14455007818509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Limitation-of-a-Pathname-to-a-Restricted-Directory-Path-Traversal-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43771-
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2023-39670](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39670)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Tenda AC6 _US_AC6V1.0BR_V15.03.05.16 was discovered to contain a buffer overflow via the function fgets.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Davidteeri/Bug-Report/blob/main/Tenda/AC6%20buffer%20overflow.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2024-57520](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57520)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory (aka directory traversal) and the attack can only be performed by a privileged user who has the ability to manage the configuration.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/asterisk/asterisk/issues/1122
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ The desktop application in Dot through 0.9.3 allows XSS and resultant command ex
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/EDMPL/Vulnerability-Research/tree/main/CVE-2024-57783
|
||||
- https://github.com/alexpinel/Dot/issues/28
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-11658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11658)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of the file /assets/changeSllyabus.php. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
|
||||
In ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59 ist eine Schwachstelle entdeckt worden. Betroffen ist eine unbekannte Verarbeitung der Datei /assets/changeSllyabus.php. Die Bearbeitung des Arguments File verursacht unrestricted upload. Es ist möglich, den Angriff aus der Ferne durchzuführen. Der Exploit steht zur öffentlichen Verfügung. Dieses Produkt setzt Rolling Releases ein. Aus diesem Grund sind Details zu betroffenen oder zu aktualisierende Versionen nicht verfügbar.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/qqy-123/cve/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-11661](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11661)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Performing manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery
|
||||
In ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59 wurde eine Schwachstelle gefunden. Es geht um eine nicht näher bekannte Funktion. Mit der Manipulation mit unbekannten Daten kann eine missing authentication-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit ist öffentlich verfügbar und könnte genutzt werden. Das Produkt nutzt ein Rolling Release für die kontinuierliche Auslieferung. Deshalb gibt es keine Versionsangaben zu betroffenen oder aktualisierten Releases.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/qqy-123/cve/issues/6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-11820](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11820)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widgets in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping on data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects multiple chart widgets including Area Chart, Line Chart, Column Chart, Donut Chart, Heatmap Chart, Radar Chart, Polar Chart, Pie Chart, Radial Chart, and Advance Data Table widgets.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/webber-naut/3c26ce96cc18d3b8387edb8482653bc3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12208](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12208)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
|
||||
In SourceCodester Best House Rental Management System 1.0 wurde eine Schwachstelle gefunden. Es geht um die Funktion login2 der Datei /admin_class.php. Durch Beeinflussen des Arguments Username mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/K1nakoo/cve/blob/main/58/report.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12209)
|
||||
|
||||
%20&color=brightgreen)
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
|
||||
In Tenda O3 1.0.0.10(2478) ist eine Schwachstelle entdeckt worden. Es geht hierbei um die Funktion SetValue/GetValue der Datei /goform/setDhcpConfig. Die Manipulation des Arguments dhcpEn führt zu stack-based buffer overflow. Der Angriff kann über das Netzwerk erfolgen. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDhcpConfig.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12210](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12210)
|
||||
|
||||
%20&color=brightgreen)
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
|
||||
Eine Schwachstelle wurde in Tenda O3 1.0.0.10(2478) gefunden. Es geht dabei um die Funktion SetValue/GetValue der Datei /goform/AdvSetLanip. Die Veränderung des Parameters lanIp resultiert in stack-based buffer overflow. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/AdvSetLanip.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12212](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12212)
|
||||
|
||||
%20&color=brightgreen)
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
|
||||
In Tenda O3 1.0.0.10(2478) wurde eine Schwachstelle gefunden. Hierbei geht es um die Funktion SetValue/GetValue der Datei /goform/setNetworkService. Dank der Manipulation des Arguments upnpEn mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setNetworkService.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12213)
|
||||
|
||||
%20&color=brightgreen)
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument lan leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
|
||||
In Tenda O3 1.0.0.10(2478) ist eine Schwachstelle entdeckt worden. Betroffen ist die Funktion SetValue/GetValue der Datei /goform/setVlanConfig. Dank Manipulation des Arguments lan mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Ein Angriff ist aus der Distanz möglich. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setVlanConfig.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2025-12223](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12223)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Package Information Module. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
|
||||
Es wurde eine Schwachstelle in Bdtask Flight Booking Software up to 3.1 entdeckt. Betroffen ist eine unbekannte Verarbeitung der Datei /b2c/package-information der Komponente Package Information Module. Die Manipulation führt zu unrestricted upload. Es ist möglich, den Angriff aus der Ferne durchzuführen. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12223.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12232](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12232)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing manipulation of the argument page results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
|
||||
In Tenda CH22 1.0.0.1 wurde eine Schwachstelle gefunden. Es ist betroffen die Funktion fromSafeClientFilter der Datei /goform/SafeClientFilter. Mittels Manipulieren des Arguments page mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Es ist möglich, den Angriff aus der Ferne durchzuführen. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/QIU-DIE/CVE/issues/13
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12238](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12238)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
|
||||
Eine Schwachstelle wurde in code-projects Automated Voting System 1.0 gefunden. Hierbei betrifft es unbekannten Programmcode der Datei /admin/user.php. Die Veränderung des Parameters Username resultiert in sql injection. Der Angriff lässt sich über das Netzwerk starten. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/xmqaq/cve/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12253)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/get_expiredtime.php. This manipulation of the argument uid causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
|
||||
Eine Schwachstelle wurde in AMTT Hotel Broadband Operation System 1.0 gefunden. Dies betrifft einen unbekannten Teil der Datei /user/portal/get_expiredtime.php. Dank der Manipulation des Arguments uid mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/guapiqing/cve/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12254)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected by this issue is some unknown functionality of the file /add_judge.php. Such manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
|
||||
Es wurde eine Schwachstelle in code-projects Online Event Judging System 1.0 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei /add_judge.php. Dank Manipulation des Arguments fullname mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/daminqaq/damin-CVE/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12255)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing manipulation of the argument fullname results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
|
||||
In code-projects Online Event Judging System 1.0 wurde eine Schwachstelle gefunden. Hierbei betrifft es unbekannten Programmcode der Datei /add_contestant.php. Mit der Manipulation des Arguments fullname mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/zzonce/cve/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12258](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12258)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. Impacted is the function setOpModeCfg of the file /cgi-bin/cstecgi.cg of the component POST Parameter Handler. The manipulation of the argument opmode results in stack-based buffer overflow. The attack may be performed from remote.
|
||||
Es wurde eine Schwachstelle in TOTOLINK A3300R 17.0.0cu.557_B20221024 entdeckt. Betroffen ist die Funktion setOpModeCfg der Datei /cgi-bin/cstecgi.cg der Komponente POST Parameter Handler. Mittels dem Manipulieren des Arguments opmode mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Es ist möglich, den Angriff aus der Ferne durchzuführen.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setOpModeCfg.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12259](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12259)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. This manipulation of the argument recHour causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.
|
||||
In TOTOLINK A3300R 17.0.0cu.557_B20221024 wurde eine Schwachstelle gefunden. Betroffen davon ist die Funktion setScheduleCfg der Datei /cgi-bin/cstecgi.cgi der Komponente POST Parameter Handler. Mittels Manipulieren des Arguments recHour mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setScheduleCfg.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12261](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12261)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
|
||||
Eine Schwachstelle wurde in CodeAstro Gym Management System 1.0 gefunden. Es geht um eine nicht näher bekannte Funktion der Datei /admin/actions/remove-announcement.php. Durch Manipulieren des Arguments ID mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/JeromClown/cve/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12271](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12271)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
|
||||
In Tenda CH22 1.0.0.1 ist eine Schwachstelle entdeckt worden. Dabei betrifft es die Funktion fromRouteStatic der Datei /goform/RouteStatic. Mittels dem Manipulieren des Arguments page mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/QIU-DIE/CVE/issues/20
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12272](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12272)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in Tenda CH22 1.0.0.1. This impacts the function fromAddressNat of the file /goform/addressNat. Performing manipulation of the argument page results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
|
||||
Eine Schwachstelle wurde in Tenda CH22 1.0.0.1 gefunden. Hierbei betrifft es die Funktion fromAddressNat der Datei /goform/addressNat. Mittels Manipulieren des Arguments page mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/QIU-DIE/CVE/issues/21
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12279](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12279)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in code-projects Client Details System 1.0. This vulnerability affects unknown code of the file /welcome.php. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
|
||||
Es wurde eine Schwachstelle in code-projects Client Details System 1.0 entdeckt. Betroffen hiervon ist ein unbekannter Ablauf der Datei /welcome.php. Die Manipulation führt zu cross site scripting. Der Angriff kann remote ausgeführt werden. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/hellonewbie/tutorial/issues/7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12280](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12280)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /update-clients.php. Performing manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
|
||||
In code-projects Client Details System 1.0 wurde eine Schwachstelle gefunden. Es geht um eine nicht näher bekannte Funktion der Datei /update-clients.php. Die Veränderung resultiert in cross site scripting. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/hellonewbie/tutorial/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2025-12282](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12282)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in code-projects Client Details System 1.0. The affected element is an unknown function of the file /admin/manage-users.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used.
|
||||
Eine Schwachstelle wurde in code-projects Client Details System 1.0 gefunden. Es geht dabei um eine nicht klar definierte Funktion der Datei /admin/manage-users.php. Dank der Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/hellonewbie/tutorial/issues/10
|
||||
- https://github.com/hellonewbie/tutorial/issues/12
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12283)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
|
||||
Es wurde eine Schwachstelle in code-projects Client Details System 1.0 entdeckt. Dabei geht es um eine nicht genauer bekannte Funktion. Dank Manipulation mit unbekannten Daten kann eine authorization bypass-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/hellonewbie/tutorial/issues/11
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12293)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
|
||||
Es wurde eine Schwachstelle in SourceCodester Point of Sales 1.0 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei /category.php. Durch das Beeinflussen des Arguments Category mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/J-Fy2767/CVE/issues/4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12298](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12298)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in code-projects Simple Food Ordering System 1.0. This affects an unknown part of the file /editcategory.php. The manipulation of the argument pname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
|
||||
In code-projects Simple Food Ordering System 1.0 wurde eine Schwachstelle gefunden. Es geht dabei um eine nicht klar definierte Funktion der Datei /editcategory.php. Durch Manipulation des Arguments pname mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/underatted/CVE/issues/19
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12299)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument pname/category/price results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
|
||||
In code-projects Simple Food Ordering System 1.0 ist eine Schwachstelle entdeckt worden. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /addproduct.php. Mittels dem Manipulieren des Arguments pname/category/price mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/underatted/CVE/issues/18
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12304)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the file PayController.java of the component Order Status Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
|
||||
Eine Schwachstelle wurde in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b gefunden. Es betrifft die Funktion alipayIsSucceed der Datei PayController.java der Komponente Order Status Handler. Durch Beeinflussen mit unbekannten Daten kann eine improper authorization-Schwachstelle ausgenutzt werden. Der Angriff kann remote ausgeführt werden. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Hwwg/cve/issues/3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12308](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12308)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletemessage.php. Performing manipulation of the argument message_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
|
||||
Eine Schwachstelle wurde in code-projects Nero Social Networking Site 1.0 gefunden. Hierbei betrifft es unbekannten Programmcode der Datei /deletemessage.php. Dank der Manipulation des Arguments message_id mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/yuan466/CVE/blob/main/three/report.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12322](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12322)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. Executing manipulation of the argument page can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
|
||||
Es wurde eine Schwachstelle in Tenda CH22 1.0.0.1 entdeckt. Betroffen davon ist die Funktion fromNatStaticSetting der Datei /goform/NatStaticSetting. Durch das Beeinflussen des Arguments page mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/QIU-DIE/CVE/issues/19
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12336](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12336)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_index.php. Such manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
|
||||
In Campcodes Retro Basketball Shoes Online Store 1.0 ist eine Schwachstelle entdeckt worden. Dabei betrifft es einen unbekannter Codeteil der Datei /admin/admin_index.php. Durch die Manipulation des Arguments Username mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/HYLCXH/CVE/issues/14
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12339)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/admin_football.php. The manipulation of the argument pid leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
|
||||
In Campcodes Retro Basketball Shoes Online Store 1.0 wurde eine Schwachstelle gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei /admin/admin_football.php. Mittels Manipulieren des Arguments pid mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Ein Angriff ist aus der Distanz möglich. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/HYLCXH/CVE/issues/17
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-12399](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12399)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/d0n601/CVE-2025-12399
|
||||
- https://ryankozak.com/posts/cve-2025-12399/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12593](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12593)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit_room.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
|
||||
Eine Schwachstelle wurde in code-projects Simple Online Hotel Reservation System 2.0 gefunden. Es geht dabei um eine nicht klar definierte Funktion der Datei /admin/edit_room.php der Komponente Photo Handler. Die Veränderung resultiert in unrestricted upload. Der Angriff kann über das Netzwerk passieren. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/asd1238525/cve/blob/main/upload2.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12595](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12595)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in Tenda AC23 16.03.07.52. This impacts the function formSetVirtualSer of the file /goform/SetVirtualServerCfg. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
|
||||
In Tenda AC23 16.03.07.52 wurde eine Schwachstelle gefunden. Hierbei geht es um die Funktion formSetVirtualSer der Datei /goform/SetVirtualServerCfg. Dank der Manipulation des Arguments list mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/LX-LX88/cve/issues/8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12596)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in Tenda AC23 16.03.07.52. Affected is the function saveParentControlInfo of the file /goform/saveParentControlInfo. Such manipulation of the argument Time leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
|
||||
In Tenda AC23 16.03.07.52 ist eine Schwachstelle entdeckt worden. Betroffen ist die Funktion saveParentControlInfo der Datei /goform/saveParentControlInfo. Dank Manipulation des Arguments Time mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Ein Angriff ist aus der Distanz möglich. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/LX-LX88/cve/issues/9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12598](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12598)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. Other parameters might be affected as well.
|
||||
Es wurde eine Schwachstelle in SourceCodester Best House Rental Management System 1.0 entdeckt. Betroffen davon ist die Funktion save_tenant der Datei /admin_class.php. Durch die Manipulation des Arguments firstname mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/321190176/Best-house-rental-management-system-2/blob/main/report.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12607](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12607)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
|
||||
Es wurde eine Schwachstelle in itsourcecode Online Loan Management System 1.0 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei /manage_payment.php. Durch das Manipulieren des Arguments ID mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cintahue/CVE/issues/4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12608)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
|
||||
In itsourcecode Online Loan Management System 1.0 wurde eine Schwachstelle gefunden. Hierbei betrifft es unbekannten Programmcode der Datei /manage_user.php. Durch Manipulieren des Arguments ID mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cintahue/CVE/issues/5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12609](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12609)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. Performing manipulation of the argument id/ini_weight results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
|
||||
Eine Schwachstelle wurde in CodeAstro Gym Management System 1.0 gefunden. Es geht um eine nicht näher bekannte Funktion der Datei /admin/update-progress.php. Dank der Manipulation des Arguments id/ini_weight mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/iamzzzzz/iam/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12611](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12611)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIp leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
|
||||
In Tenda AC21 16.03.08.16 wurde eine Schwachstelle gefunden. Es geht dabei um die Funktion formSetPPTPServer der Datei /goform/SetPptpServerCfg. Mit der Manipulation des Arguments startIp mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/LX-LX88/cve/issues/10
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12612](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12612)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
|
||||
In Campcodes School Fees Payment Management System 1.0 ist eine Schwachstelle entdeckt worden. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /ajax.php. Durch die Manipulation mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Die Schwachstelle wurde öffentlich offengelegt und könnte ausgenutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ProgramShowMaker/CVE/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12614](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12614)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
|
||||
Eine Schwachstelle wurde in SourceCodester Best House Rental Management System 1.0 gefunden. Hierbei geht es um die Funktion delete_payment der Datei /admin_class.php. Durch Manipulation des Arguments ID mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit ist öffentlich verfügbar und könnte genutzt werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/321190176/Best-house-rental-management-system-3/blob/main/report.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12615](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12615)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key␍ . The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.
|
||||
Es wurde eine Schwachstelle in PHPGurukul News Portal 1.0 entdeckt. Betroffen ist eine unbekannte Funktion der Datei /onps/settings.py. Mittels dem Manipulieren des Arguments SECRET_KEY mit unbekannten Daten kann eine use of hard-coded cryptographic key␍ -Schwachstelle ausgenutzt werden. Ein Angriff ist aus der Distanz möglich. Das Durchführen eines Angriffs ist mit einer relativ hohen Komplexität verbunden. Sie gilt als schwierig auszunutzen. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Hard-coded%20Cryptographic%20Key.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12616](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12616)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used.
|
||||
In PHPGurukul News Portal 1.0 wurde eine Schwachstelle gefunden. Es ist betroffen eine unbekannte Funktion der Datei /onps/settings.py. Mittels Manipulieren mit unbekannten Daten kann eine insertion of sensitive information into debugging code-Schwachstelle ausgenutzt werden. Es ist möglich, den Angriff aus der Ferne durchzuführen. Die Komplexität eines Angriffs ist eher hoch. Sie ist schwierig ausnutzbar. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Information%20Disclosure%20via%20Debug%20Mode.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12623](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12623)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Token Handler. Such manipulation leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
|
||||
In fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032 ist eine Schwachstelle entdeckt worden. Dabei betrifft es einen unbekannter Codeteil der Datei fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java der Komponente Authentication Token Handler. Die Manipulation führt zu authorization bypass. Der Angriff kann über das Netzwerk passieren. Das Durchführen eines Angriffs ist mit einer relativ hohen Komplexität verbunden. Die Ausnutzung wird als schwierig beschrieben. Der Exploit steht zur öffentlichen Verfügung. Bei diesem Produkt handelt es sich um ein Rolling Release, das eine fortlaufende Bereitstellung ermöglicht. Aus diesem Grund stehen keine Versionsinformationen zu betroffenen oder aktualisierten Versionen zur Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/fushengqian/fuint/issues/67
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12853](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12853)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
|
||||
In SourceCodester Best House Rental Management System 1.0 ist eine Schwachstelle entdeckt worden. Es geht hierbei um die Funktion delete_house der Datei /admin_class.php. Durch das Manipulieren des Arguments ID mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Cashbeebee/CVE/issues/2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12855](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12855)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in code-projects Responsive Hotel Site 1.0. This issue affects some unknown processing of the file /admin/newsletterdel.php. The manipulation of the argument eid results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
|
||||
Es wurde eine Schwachstelle in code-projects Responsive Hotel Site 1.0 entdeckt. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /admin/newsletterdel.php. Durch das Beeinflussen des Arguments eid mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/newsletterdel-sql-injection/report.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12862](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12862)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in projectworlds Online Notes Sharing Platform 1.0. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.
|
||||
Es wurde eine Schwachstelle in projectworlds Online Notes Sharing Platform 1.0 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei /dashboard/userprofile.php. Durch die Manipulation des Arguments image mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Die Ausnutzung wurde veröffentlicht und kann verwendet werden.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/K1nakoo/cve/blob/main/tmp74/report.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2025-12873](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12873)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
|
||||
In Campcodes School File Management 1.0 wurde eine Schwachstelle gefunden. Hierbei betrifft es unbekannten Programmcode der Datei /admin/update_user.php. Durch Manipulation des Arguments user_id mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff lässt sich über das Netzwerk starten. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/YYYGdd/CVE/issues/1
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2025-12916](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12916)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System 3.0. Impacted is an unknown function of the file /fort/portal_login of the component Frontend. This manipulation of the argument loginUrl causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.11 and 3.0.12 is recommended to address this issue. It is advisable to upgrade the affected component.
|
||||
In Sangfor Operation and Maintenance Security Management System 3.0 wurde eine Schwachstelle gefunden. Dies betrifft einen unbekannten Teil der Datei /fort/portal_login der Komponente Frontend. Mit der Manipulation des Arguments loginUrl mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Die Ausnutzung wurde veröffentlicht und kann verwendet werden. Das Problem kann durch ein Upgrade auf Version 3.0.11 and 3.0.12 adressiert werden. Die Aktualisierung der betroffenen Komponente wird empfohlen.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://h4cker.zip/post/fe0ada/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2025-12917](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12917)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in TOZED ZLT T10 T10PLUS_3.04.15. The affected element is an unknown function of the file /reqproc/proc_post of the component Reboot Handler. Such manipulation leads to denial of service. Access to the local network is required for this attack to succeed. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
|
||||
In TOZED ZLT T10 T10PLUS_3.04.15 ist eine Schwachstelle entdeckt worden. Dabei betrifft es einen unbekannter Codeteil der Datei /reqproc/proc_post der Komponente Reboot Handler. Durch die Manipulation mit unbekannten Daten kann eine denial of service-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei im lokalen Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://youtu.be/3Me3wlH5cfU
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-27093](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27093)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be accessible from other implants.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/BishopFox/sliver/security/advisories/GHSA-q8j9-34qf-7vq7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,7 +10,7 @@ TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingDat
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27222.txt
|
||||
|
||||
#### Github
|
||||
- https://github.com/MrTuxracer/advisories
|
||||
|
||||
@@ -10,7 +10,7 @@ TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authe
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27223.txt
|
||||
|
||||
#### Github
|
||||
- https://github.com/MrTuxracer/advisories
|
||||
|
||||
@@ -10,7 +10,7 @@ TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27225.txt
|
||||
|
||||
#### Github
|
||||
- https://github.com/MrTuxracer/advisories
|
||||
|
||||
@@ -14,6 +14,7 @@ Use of an insecure temporary directory in the Windows License plugin for the Che
|
||||
|
||||
#### Reference
|
||||
- http://seclists.org/fulldisclosure/2025/Oct/6
|
||||
- https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250724-01_Checkmk_Agent_Privilege_Escalation_via_Insecure_Temporary_Files
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
### [CVE-2025-55315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55315)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/stSLAYER/b0be1f0fe95f56c08ef2bd69f40cd817
|
||||
- https://github.com/stSLAYER/ZeroDayVulnerabilities-/blob/main/RT-Systems/POC/README.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2025-60541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-60541)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/linshenkx/prompt-optimizer/issues/179
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -15623,6 +15623,7 @@ CVE-2008-7154 - https://www.exploit-db.com/exploits/4879
|
||||
CVE-2008-7156 - https://www.exploit-db.com/exploits/4859
|
||||
CVE-2008-7157 - https://www.exploit-db.com/exploits/4859
|
||||
CVE-2008-7163 - https://www.exploit-db.com/exploits/4854
|
||||
CVE-2008-7164 - http://sourceforge.net/project/shownotes.php?group_id=110672&release_id=565250
|
||||
CVE-2008-7166 - http://aluigi.altervista.org/adv/ruttorrent2-adv.txt
|
||||
CVE-2008-7167 - https://www.exploit-db.com/exploits/5936
|
||||
CVE-2008-7169 - https://www.exploit-db.com/exploits/5963
|
||||
@@ -23346,6 +23347,7 @@ CVE-2012-1580 - https://bugzilla.wikimedia.org/show_bug.cgi?id=35317
|
||||
CVE-2012-1584 - http://www.openwall.com/lists/oss-security/2012/03/21/11
|
||||
CVE-2012-1584 - http://www.openwall.com/lists/oss-security/2012/03/26/4
|
||||
CVE-2012-1593 - http://www.exploit-db.com/exploits/18758
|
||||
CVE-2012-1597 - https://github.com/ezsystems/ezjscore/commit/58854564c7b8672090c25c4b1677d08620d870f2
|
||||
CVE-2012-1602 - http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html
|
||||
CVE-2012-1603 - http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html
|
||||
CVE-2012-1604 - http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html
|
||||
@@ -89460,6 +89462,7 @@ CVE-2021-44596 - https://medium.com/@tomerp_77017/wondershell-a82372914f26
|
||||
CVE-2021-44598 - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44598
|
||||
CVE-2021-44599 - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/Online-Enrollment-Management-System
|
||||
CVE-2021-44600 - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/MSMS
|
||||
CVE-2021-4461 - https://github.com/chaitin/xray/blob/f90cf321bc4d294bbf6625a9c4853f3bfdf0a384/pocs/seeyon-oa-cookie-leak.yml
|
||||
CVE-2021-4461 - https://www.vulncheck.com/advisories/seeyon-zhiyuan-oa-web-application-system-authentication-bypass
|
||||
CVE-2021-44617 - http://packetstormsecurity.com/files/166285/Baixar-GLPI-Project-9.4.6-SQL-Injection.html
|
||||
CVE-2021-44622 - https://github.com/Yu3H0/IoT_CVE/tree/main/886N/chkRegVeriRegister
|
||||
@@ -94598,6 +94601,8 @@ CVE-2022-2884 - http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-C
|
||||
CVE-2022-2884 - https://gitlab.com/gitlab-org/gitlab/-/issues/371098
|
||||
CVE-2022-2885 - https://huntr.dev/bounties/edeed309-be07-4373-b15e-2d1eb415eb89
|
||||
CVE-2022-2886 - https://vuldb.com/?id.206688
|
||||
CVE-2022-28860 - https://github.com/ErwanBroquaire/citilog-8.0-vulnerability
|
||||
CVE-2022-28861 - https://github.com/ErwanBroquaire/citilog-8.0-vulnerability
|
||||
CVE-2022-28862 - https://www.gruppotim.it/it/footer/red-team.html
|
||||
CVE-2022-28862 - https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html
|
||||
CVE-2022-28863 - https://www.gruppotim.it/it/footer/red-team.html
|
||||
@@ -98153,6 +98158,7 @@ CVE-2022-40735 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.8
|
||||
CVE-2022-40736 - https://github.com/axiomatic-systems/Bento4/issues/755
|
||||
CVE-2022-40737 - https://github.com/axiomatic-systems/Bento4/issues/756
|
||||
CVE-2022-40738 - https://github.com/axiomatic-systems/Bento4/issues/756
|
||||
CVE-2022-40750 - https://www.ibm.com/support/pages/node/6833552
|
||||
CVE-2022-40755 - https://github.com/jasper-software/jasper/issues/338
|
||||
CVE-2022-40761 - https://github.com/Samsung/mTower/blob/efd36709306a9afcca5b4782499d01be0c7a02a5/tee/tee/tee_svc_cryp.c#L1248
|
||||
CVE-2022-40761 - https://github.com/Samsung/mTower/issues/83
|
||||
@@ -99219,6 +99225,7 @@ CVE-2022-43751 - https://www.mcafee.com/support/?articleId=TS103348&page=shell&s
|
||||
CVE-2022-43753 - https://bugzilla.suse.com/show_bug.cgi?id=1204716
|
||||
CVE-2022-43769 - http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html
|
||||
CVE-2022-4377 - https://vuldb.com/?id.215197
|
||||
CVE-2022-43771 - https://support.pentaho.com/hc/en-us/articles/14455007818509--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Limitation-of-a-Pathname-to-a-Restricted-Directory-Path-Traversal-Versions-before-9-4-0-0-and-9-3-0-1-including-8-3-x-Impacted-CVE-2022-43771-
|
||||
CVE-2022-43774 - https://www.tenable.com/security/research/tra-2022-33
|
||||
CVE-2022-43775 - https://www.tenable.com/security/research/tra-2022-33
|
||||
CVE-2022-43776 - https://www.tenable.com/security/research/tra-2022-34
|
||||
@@ -106583,6 +106590,7 @@ CVE-2023-39666 - https://www.dlink.com/en/security-bulletin/
|
||||
CVE-2023-39667 - https://www.dlink.com/en/security-bulletin/
|
||||
CVE-2023-39668 - https://www.dlink.com/en/security-bulletin/
|
||||
CVE-2023-39669 - https://www.dlink.com/en/security-bulletin/
|
||||
CVE-2023-39670 - https://github.com/Davidteeri/Bug-Report/blob/main/Tenda/AC6%20buffer%20overflow.md
|
||||
CVE-2023-39671 - https://www.dlink.com/en/security-bulletin/
|
||||
CVE-2023-39674 - https://www.dlink.com/en/security-bulletin/
|
||||
CVE-2023-39675 - https://blog.sorcery.ie/posts/simpleimportproduct_sqli/
|
||||
@@ -118371,6 +118379,7 @@ CVE-2024-57494 - https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2024-5
|
||||
CVE-2024-57498 - https://github.com/saysky/ForestBlog/issues/102
|
||||
CVE-2024-57514 - https://www.zyenra.com/blog/xss-in-tplink-archer-a20.html
|
||||
CVE-2024-57519 - https://github.com/open5gs/open5gs/issues/3635
|
||||
CVE-2024-57520 - https://github.com/asterisk/asterisk/issues/1122
|
||||
CVE-2024-57522 - https://github.com/HackWidMaddy/CVE-2024-57522
|
||||
CVE-2024-57523 - https://github.com/HackWidMaddy/CVE-2024-57523.
|
||||
CVE-2024-57529 - https://medium.com/@a77777mad/xss-vulnerability-discovered-in-jetplanner-pro-a-popular-flight-planning-solution-2dd48a7f6e72
|
||||
@@ -118506,6 +118515,7 @@ CVE-2024-5775 - https://github.com/CveSecLook/cve/issues/44
|
||||
CVE-2024-57768 - https://gitee.com/r1bbit/JFinalOA/issues/IBHUMT
|
||||
CVE-2024-57778 - https://github.com/KUK3N4N/CVE-2024-57778
|
||||
CVE-2024-57782 - https://github.com/tzzhang123456/test123/issues/2
|
||||
CVE-2024-57783 - https://github.com/EDMPL/Vulnerability-Research/tree/main/CVE-2024-57783
|
||||
CVE-2024-57783 - https://github.com/alexpinel/Dot/issues/28
|
||||
CVE-2024-57811 - https://github.com/google/security-research/security/advisories/GHSA-xf7j-4x67-6h93
|
||||
CVE-2024-57822 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067896
|
||||
@@ -120960,9 +120970,11 @@ CVE-2025-11652 - https://github.com/cymiao1978/cve/blob/main/14.md#poc
|
||||
CVE-2025-11653 - https://github.com/ashin9/CVE/issues/2
|
||||
CVE-2025-11656 - https://github.com/qqy-123/cve/issues/1
|
||||
CVE-2025-11657 - https://github.com/qqy-123/cve/issues/2
|
||||
CVE-2025-11658 - https://github.com/qqy-123/cve/issues/3
|
||||
CVE-2025-11659 - https://github.com/qqy-123/cve/issues/4
|
||||
CVE-2025-1166 - https://gist.github.com/jmx0hxq/0ce2c97ca11b2423a203b5719438c9f8
|
||||
CVE-2025-11660 - https://github.com/qqy-123/cve/issues/5
|
||||
CVE-2025-11661 - https://github.com/qqy-123/cve/issues/6
|
||||
CVE-2025-11662 - https://github.com/Scorbunny2/Best-salon-management-system-SQL-injection
|
||||
CVE-2025-11663 - https://github.com/HYLCXH/CVE/issues/12
|
||||
CVE-2025-11664 - https://github.com/HYLCXH/CVE/issues/13
|
||||
@@ -120979,6 +120991,7 @@ CVE-2025-1181 - https://sourceware.org/bugzilla/attachment.cgi?id=15918
|
||||
CVE-2025-1181 - https://vuldb.com/?submit.495402
|
||||
CVE-2025-1182 - https://sourceware.org/bugzilla/attachment.cgi?id=15919
|
||||
CVE-2025-1182 - https://vuldb.com/?id.295086
|
||||
CVE-2025-11820 - https://gist.github.com/webber-naut/3c26ce96cc18d3b8387edb8482653bc3
|
||||
CVE-2025-1184 - https://github.com/janssensjelle/published-pocs/blob/main/pihome_sqli_ajax.md
|
||||
CVE-2025-11842 - https://github.com/asust9/smidge-vuln?tab=readme-ov-file
|
||||
CVE-2025-11849 - https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10
|
||||
@@ -121042,7 +121055,13 @@ CVE-2025-12206 - https://shimo.im/docs/aBAYMVMB2jUP9jAj
|
||||
CVE-2025-12206 - https://shimo.im/docs/aBAYMVMB2jUP9jAj/
|
||||
CVE-2025-12207 - https://shimo.im/docs/vVqRMVMlrycMO63y
|
||||
CVE-2025-12207 - https://shimo.im/docs/vVqRMVMlrycMO63y/
|
||||
CVE-2025-12208 - https://github.com/K1nakoo/cve/blob/main/58/report.md
|
||||
CVE-2025-12209 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDhcpConfig.md
|
||||
CVE-2025-12210 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/AdvSetLanip.md
|
||||
CVE-2025-12211 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDmzInfo.md
|
||||
CVE-2025-12212 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setNetworkService.md
|
||||
CVE-2025-12213 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setVlanConfig.md
|
||||
CVE-2025-12223 - https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12223.md
|
||||
CVE-2025-12225 - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/WifiGuestSet/WifiGuestSet.md
|
||||
CVE-2025-12226 - https://github.com/zhang947/vul/blob/main/report.md
|
||||
CVE-2025-12227 - https://github.com/QIU-DIE/CVE/issues/8
|
||||
@@ -121050,10 +121069,12 @@ CVE-2025-12228 - https://github.com/QIU-DIE/CVE/issues/9
|
||||
CVE-2025-12229 - https://github.com/QIU-DIE/CVE/issues/10
|
||||
CVE-2025-12230 - https://github.com/QIU-DIE/CVE/issues/11
|
||||
CVE-2025-12231 - https://github.com/QIU-DIE/CVE/issues/12
|
||||
CVE-2025-12232 - https://github.com/QIU-DIE/CVE/issues/13
|
||||
CVE-2025-12233 - https://github.com/QIU-DIE/CVE/issues/14
|
||||
CVE-2025-12235 - https://github.com/QIU-DIE/CVE/issues/16
|
||||
CVE-2025-12236 - https://github.com/QIU-DIE/CVE/issues/17
|
||||
CVE-2025-12237 - https://github.com/juzidddd/Projectworlds-ALMS-SQLi-Vulnerability-Disclosure/issues/1
|
||||
CVE-2025-12238 - https://github.com/xmqaq/cve/issues/8
|
||||
CVE-2025-1224 - https://gitee.com/r1bbit/yimioa/issues/IBI731
|
||||
CVE-2025-12241 - https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setLanguageCfg.md
|
||||
CVE-2025-12242 - https://github.com/yihaofuweng/cve/issues/54
|
||||
@@ -121063,9 +121084,15 @@ CVE-2025-12246 - https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot/
|
||||
CVE-2025-12248 - https://github.com/1276486/CVE/issues/17
|
||||
CVE-2025-12250 - https://github.com/mikecole-mg/security_findings/blob/main/openwga/openwga-rce.md
|
||||
CVE-2025-12252 - https://github.com/xmqaq/cve/issues/10
|
||||
CVE-2025-12253 - https://github.com/guapiqing/cve/issues/3
|
||||
CVE-2025-12254 - https://github.com/daminqaq/damin-CVE/issues/2
|
||||
CVE-2025-12255 - https://github.com/zzonce/cve/issues/3
|
||||
CVE-2025-12256 - https://github.com/zzonce/cve/issues/2
|
||||
CVE-2025-12257 - https://github.com/Cloverhyl/CVE/issues/2
|
||||
CVE-2025-12258 - https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setOpModeCfg.md
|
||||
CVE-2025-12259 - https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setScheduleCfg.md
|
||||
CVE-2025-12260 - https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setSyslogCfg.md
|
||||
CVE-2025-12261 - https://github.com/JeromClown/cve/issues/1
|
||||
CVE-2025-12262 - https://github.com/anyizilegong/cve/issues/1
|
||||
CVE-2025-12263 - https://github.com/anyizilegong/cve/issues/2
|
||||
CVE-2025-12265 - https://github.com/QIU-DIE/CVE/issues/18
|
||||
@@ -121073,19 +121100,31 @@ CVE-2025-12267 - https://www.codester.com/items/comments/58847/modern-shop-php-e
|
||||
CVE-2025-12268 - https://gist.github.com/KhanMarshaI/ef07d20eb1cbe30c71722fbded7cc056
|
||||
CVE-2025-12269 - https://gist.github.com/KhanMarshaI/c06263648d8a807108801e1a4daf0ab9
|
||||
CVE-2025-12270 - https://gist.github.com/KhanMarshaI/f71f86fbd5d8e8363f9113a8c054c28b
|
||||
CVE-2025-12271 - https://github.com/QIU-DIE/CVE/issues/20
|
||||
CVE-2025-12272 - https://github.com/QIU-DIE/CVE/issues/21
|
||||
CVE-2025-12274 - https://github.com/QIU-DIE/CVE/issues/23
|
||||
CVE-2025-12276 - https://gist.github.com/KhanMarshaI/4a89e9d807094b6dd4a138bc5664e748
|
||||
CVE-2025-12279 - https://github.com/hellonewbie/tutorial/issues/7
|
||||
CVE-2025-12280 - https://github.com/hellonewbie/tutorial/issues/8
|
||||
CVE-2025-12281 - https://github.com/hellonewbie/tutorial/issues/9
|
||||
CVE-2025-12282 - https://github.com/hellonewbie/tutorial/issues/10
|
||||
CVE-2025-12282 - https://github.com/hellonewbie/tutorial/issues/12
|
||||
CVE-2025-12283 - https://github.com/hellonewbie/tutorial/issues/11
|
||||
CVE-2025-12287 - https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12287.md
|
||||
CVE-2025-12288 - https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12288.md
|
||||
CVE-2025-12289 - https://github.com/1276486/CVE/issues/19
|
||||
CVE-2025-12290 - https://github.com/1276486/CVE/issues/18
|
||||
CVE-2025-12292 - https://github.com/J-Fy2767/CVE/issues/2
|
||||
CVE-2025-12293 - https://github.com/J-Fy2767/CVE/issues/4
|
||||
CVE-2025-12294 - https://github.com/J-Fy2767/CVE/issues/6
|
||||
CVE-2025-12298 - https://github.com/underatted/CVE/issues/19
|
||||
CVE-2025-12299 - https://github.com/underatted/CVE/issues/18
|
||||
CVE-2025-12300 - https://github.com/underatted/CVE/issues/20
|
||||
CVE-2025-12301 - https://github.com/underatted/CVE/issues/22
|
||||
CVE-2025-12302 - https://github.com/underatted/CVE/issues/21
|
||||
CVE-2025-12303 - https://github.com/kiyoleee/CVE/issues/1
|
||||
CVE-2025-12304 - https://github.com/Hwwg/cve/issues/3
|
||||
CVE-2025-12308 - https://github.com/yuan466/CVE/blob/main/three/report.md
|
||||
CVE-2025-1231 - https://devolutions.net/security/advisories/DEVO-2025-0002/
|
||||
CVE-2025-12311 - https://github.com/kiyoleee/CVE/issues/2
|
||||
CVE-2025-12312 - https://github.com/kiyoleee/CVE/issues/3
|
||||
@@ -121094,25 +121133,49 @@ CVE-2025-12314 - https://github.com/kaka00666/food-ordering-cve/issues/1
|
||||
CVE-2025-12315 - https://github.com/kaka00666/food-ordering-cve/issues/2
|
||||
CVE-2025-12316 - https://github.com/Abxery/cveee/issues/1
|
||||
CVE-2025-1232 - https://wpscan.com/vulnerability/c4ea8357-ddd7-48ac-80c9-15b924715b14/
|
||||
CVE-2025-12322 - https://github.com/QIU-DIE/CVE/issues/19
|
||||
CVE-2025-12325 - https://github.com/yishengsss/CVE-Best-house-rental-management-system-V1.0-admin_class.php-save_house-SQL-injection/blob/main/report.md
|
||||
CVE-2025-12336 - https://github.com/HYLCXH/CVE/issues/14
|
||||
CVE-2025-12337 - https://github.com/HYLCXH/CVE/issues/15
|
||||
CVE-2025-12338 - https://github.com/HYLCXH/CVE/issues/16
|
||||
CVE-2025-12339 - https://github.com/HYLCXH/CVE/issues/17
|
||||
CVE-2025-12346 - https://note-hxlab.wetolink.com/share/8QmDZCddHvyR
|
||||
CVE-2025-12347 - https://note-hxlab.wetolink.com/share/lIWZkTHQPSVh
|
||||
CVE-2025-12351 - https://www.honeywell.com/us/en/product-security
|
||||
CVE-2025-12378 - https://github.com/tinggeogle01-lang/cve/issues/1
|
||||
CVE-2025-12399 - https://github.com/d0n601/CVE-2025-12399
|
||||
CVE-2025-12399 - https://ryankozak.com/posts/cve-2025-12399/
|
||||
CVE-2025-1244 - http://www.openwall.com/lists/oss-security/2025/03/01/2
|
||||
CVE-2025-12463 - https://blog.blacklanternsecurity.com/p/cve-2025-12463-98-unauthenticated
|
||||
CVE-2025-12485 - https://devolutions.net/security/advisories/DEVO-2025-0016
|
||||
CVE-2025-12593 - https://github.com/asd1238525/cve/blob/main/upload2.md
|
||||
CVE-2025-12595 - https://github.com/LX-LX88/cve/issues/8
|
||||
CVE-2025-12596 - https://github.com/LX-LX88/cve/issues/9
|
||||
CVE-2025-12598 - https://github.com/321190176/Best-house-rental-management-system-2/blob/main/report.md
|
||||
CVE-2025-12607 - https://github.com/cintahue/CVE/issues/4
|
||||
CVE-2025-12608 - https://github.com/cintahue/CVE/issues/5
|
||||
CVE-2025-12609 - https://github.com/iamzzzzz/iam/issues/1
|
||||
CVE-2025-12611 - https://github.com/LX-LX88/cve/issues/10
|
||||
CVE-2025-12612 - https://github.com/ProgramShowMaker/CVE/issues/1
|
||||
CVE-2025-12614 - https://github.com/321190176/Best-house-rental-management-system-3/blob/main/report.md
|
||||
CVE-2025-12615 - https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Hard-coded%20Cryptographic%20Key.md
|
||||
CVE-2025-12616 - https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Information%20Disclosure%20via%20Debug%20Mode.md
|
||||
CVE-2025-12623 - https://github.com/fushengqian/fuint/issues/67
|
||||
CVE-2025-12695 - https://research.jfrog.com/vulnerabilities/dspy-sandbox-escape-arbitrary-file-read-jfsa-2025-001495652/
|
||||
CVE-2025-12808 - https://devolutions.net/security/advisories/DEVO-2025-0016
|
||||
CVE-2025-12853 - https://github.com/Cashbeebee/CVE/issues/2
|
||||
CVE-2025-12855 - https://github.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/newsletterdel-sql-injection/report.md
|
||||
CVE-2025-12856 - https://github.com/AmengDream/CVE/blob/main/Responsive_Hotel_Site/reservation-sql-injection/report.md
|
||||
CVE-2025-1286 - https://wpscan.com/vulnerability/c42556c7-09b6-49ae-9f87-cbaf16e7c280/
|
||||
CVE-2025-12862 - https://github.com/K1nakoo/cve/blob/main/tmp74/report.md
|
||||
CVE-2025-12873 - https://github.com/YYYGdd/CVE/issues/1
|
||||
CVE-2025-1288 - https://wpscan.com/vulnerability/175af35d-6972-42c9-b7ac-913ce1fbac64/
|
||||
CVE-2025-1289 - https://wpscan.com/vulnerability/5a296b59-f305-49a2-88b8-fca998f2c43e/
|
||||
CVE-2025-1290 - https://issuetracker.google.com/issues/301886931
|
||||
CVE-2025-12907 - https://issues.chromium.org/issues/427367145
|
||||
CVE-2025-12908 - https://issues.chromium.org/issues/421511847
|
||||
CVE-2025-12916 - https://h4cker.zip/post/fe0ada/
|
||||
CVE-2025-12917 - https://youtu.be/3Me3wlH5cfU
|
||||
CVE-2025-1292 - https://issuetracker.google.com/issues/324336238
|
||||
CVE-2025-1302 - https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456
|
||||
CVE-2025-1302 - https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585
|
||||
@@ -122496,6 +122559,7 @@ CVE-2025-2708 - https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md
|
||||
CVE-2025-27088 - https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-pp9m-qf39-hxjc
|
||||
CVE-2025-2709 - https://github.com/Hebing123/cve/issues/84
|
||||
CVE-2025-27090 - https://github.com/BishopFox/sliver/security/advisories/GHSA-fh4v-v779-4g2w
|
||||
CVE-2025-27093 - https://github.com/BishopFox/sliver/security/advisories/GHSA-q8j9-34qf-7vq7
|
||||
CVE-2025-27096 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-j856-wh9m-9vpm
|
||||
CVE-2025-2710 - https://github.com/Hebing123/cve/issues/85
|
||||
CVE-2025-27101 - https://github.com/obiba/opal/security/advisories/GHSA-rxmx-gqjj-vhv8
|
||||
@@ -122523,6 +122587,9 @@ CVE-2025-27152 - https://github.com/axios/axios/security/advisories/GHSA-jr5f-v2
|
||||
CVE-2025-27154 - https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w599
|
||||
CVE-2025-27163 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2134
|
||||
CVE-2025-2717 - https://github.com/mono7s/Dir-823x/blob/main/diag_nslookup/diag_nslookup.md
|
||||
CVE-2025-27222 - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27222.txt
|
||||
CVE-2025-27223 - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27223.txt
|
||||
CVE-2025-27225 - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27225.txt
|
||||
CVE-2025-2733 - https://magnificent-dill-351.notion.site/Command-Execution-in-Openmanus-2025-3-13-1b6c693918ed80b2826ef6bb385693fa
|
||||
CVE-2025-2734 - https://github.com/0xabandon/CVE/issues/1
|
||||
CVE-2025-2735 - https://github.com/0xabandon/CVE/issues/2
|
||||
@@ -123377,6 +123444,7 @@ CVE-2025-32878 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisorie
|
||||
CVE-2025-32879 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-026.txt
|
||||
CVE-2025-32880 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-029.txt
|
||||
CVE-2025-32919 - http://seclists.org/fulldisclosure/2025/Oct/6
|
||||
CVE-2025-32919 - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250724-01_Checkmk_Agent_Privilege_Escalation_via_Insecure_Temporary_Files
|
||||
CVE-2025-32931 - https://github.com/lishihihi/voyager-issue-report/
|
||||
CVE-2025-32943 - https://research.jfrog.com/vulnerabilities/peertube-hls-path-traversal/
|
||||
CVE-2025-32944 - https://research.jfrog.com/vulnerabilities/peertube-archive-persistent-dos/
|
||||
@@ -125737,6 +125805,7 @@ CVE-2025-55298 - https://github.com/ImageMagick/ImageMagick/security/advisories/
|
||||
CVE-2025-55300 - https://github.com/komari-monitor/komari/security/advisories/GHSA-q355-h244-969h
|
||||
CVE-2025-55303 - https://github.com/withastro/astro/security/advisories/GHSA-xf8x-j4p2-f749
|
||||
CVE-2025-55304 - https://github.com/Exiv2/exiv2/issues/3333
|
||||
CVE-2025-55315 - https://gist.github.com/N3mes1s/d0897c13ca199e739ecc2b562f466040
|
||||
CVE-2025-55341 - https://seguridaddigital.ec/research/20251101/report-20251101.en.pdf
|
||||
CVE-2025-55342 - https://seguridaddigital.ec/research/20251101/report-20251101.en.pdf
|
||||
CVE-2025-55343 - https://seguridaddigital.ec/research/20251101/report-20251101.en.pdf
|
||||
@@ -125921,6 +125990,7 @@ CVE-2025-5644 - https://drive.google.com/file/d/1VtiMMp7ECun3sq3AwlqQrU9xEPA45eO
|
||||
CVE-2025-5644 - https://github.com/radareorg/radare2/issues/24233
|
||||
CVE-2025-5644 - https://github.com/radareorg/radare2/issues/24233#issuecomment-2918847833
|
||||
CVE-2025-56447 - https://gist.github.com/stSLAYER/b0be1f0fe95f56c08ef2bd69f40cd817
|
||||
CVE-2025-56447 - https://github.com/stSLAYER/ZeroDayVulnerabilities-/blob/main/RT-Systems/POC/README.md
|
||||
CVE-2025-56448 - https://medium.com/@wagneralves_87750/cve-2025-56448-replay-attack-vulnerability-in-positron-px360bt-car-alarm-system-c9f1ccea6ebe
|
||||
CVE-2025-5645 - https://drive.google.com/file/d/1LVaraZB30lJXtrvp-4bcEJrZYFJb2bfc/view?usp=sharing
|
||||
CVE-2025-5645 - https://github.com/radareorg/radare2/issues/24234
|
||||
@@ -126416,6 +126486,7 @@ CVE-2025-60514 - https://www.secstrike.ai/cve-2025-60514-tillywork-sql-injection
|
||||
CVE-2025-60535 - https://github.com/vityuasd/VulList/blob/main/CVE-2025-60535.md
|
||||
CVE-2025-60536 - https://github.com/vityuasd/VulList/blob/main/CVE-2025-60536.md
|
||||
CVE-2025-60540 - https://github.com/vityuasd/VulList/blob/main/CVE-2025-60540.md
|
||||
CVE-2025-60541 - https://github.com/linshenkx/prompt-optimizer/issues/179
|
||||
CVE-2025-60547 - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/02-buffer%20overflow-formSetWAN_Wizard7.md
|
||||
CVE-2025-60548 - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/01-buffer%20overflow-formLanSetupRouterSettings.md
|
||||
CVE-2025-60550 - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/04-buffer%20overflow-formEasySetTimezone.md
|
||||
|
||||
Reference in new issue
Block a user