CYBR International Malware Information Sharing Platform (MISP)

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions are met: 1. Use the openid-connect plugin with introspection mode 2. The auth service connected to openid-connect provides services to multiple issuers 3. Multiple issuers share the same private key and relies only on the issuer being different If affected by this vulnerability, it would allow an attacker with a valid account on one of the issuers to log into the other issuer. This issue affects Apache APISIX: until 3.12.0. Users are recommended to upgrade to version 3.12.0 or higher.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges. While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

WINSTAR WN572HP3 v230525 was discovered to contain a heap overflow via the CONTENT_LENGTH variable at /cgi-bin/upload.cgi.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP allows SQL Injection.This issue affects YaySMTP: from n/a through 2.6.5.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting (XSS) vulnerability in both topic names and channel names. This issue has been fixed in Zulip Server 10.4. A workaround for this issue involves denying access to /digest/.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This issue affects Laundry: 2.3.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled server, which is written to the Lucee webroot and executed with the privileges of the Lucee service account. Because Lucee does not enforce integrity checks, path restrictions, or execution controls for scheduled task fetches, this feature can be abused to achieve arbitrary code execution. This issue is distinct from CVE-2024-55354.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Laundry on Linux, MacOS allows Account Takeover. This issue affects Laundry: 2.3.0.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x, etc.).

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

A padding oracle vulnerability exists in Google Chrome’s AppBound cookie encryption mechanism due to observable decryption failure behavior in Windows Event Logs when handling malformed ciphertext in SYSTEM-DPAPI-encrypted blobs. A local attacker can repeatedly send malformed ciphertexts to the Chrome elevation service and distinguish between padding and MAC errors, enabling a padding oracle attack. This allows partial decryption of the SYSTEM-DPAPI layer and eventual recovery of the user-DPAPI encrypted cookie key, which is trivially decrypted by the attacker’s own context. This issue undermines the core purpose of AppBound Encryption by enabling low-privileged cookie theft through cryptographic misuse and verbose error feedback. Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms. This behavior arises from a combination of Chrome’s AppBound implementation and the way Microsoft Windows DPAPI reports decryption failures via Event Logs. As such, the vulnerability relies on cryptographic behavior and error visibility in all supported versions of Windows.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

A cookie encryption bypass vulnerability exists in Google Chrome’s AppBound mechanism due to weak path validation logic within the elevation service. When Chrome encrypts a cookie key, it records its own executable path as validation metadata. Later, when decrypting, the elevation service compares the requesting process’s path to this stored path. However, due to path canonicalization inconsistencies, an attacker can impersonate Chrome (e.g., by naming their binary chrome.exe and placing it in a similar path) and successfully retrieve the encrypted cookie key. This allows malicious processes to retrieve cookies intended to be restricted to the Chrome process only. Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface (default port 8443), inject arbitrary commands as external scripts via the /settings/query.json API, save the configuration, and trigger the script via the /query/{name} endpoint. The injected commands are executed with SYSTEM privileges, enabling full remote compromise. This capability is an intended feature, but the lack of safeguards or privilege separation makes it risky when exposed to untrusted actors.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

A security bypass vulnerability exists in Google Chrome AppBound cookie encryption mechanism due to insufficient validation of COM server paths during inter-process communication. A local low-privileged attacker can hijack the COM class identifier (CLSID) registration used by Chrome's elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie encryption mechanism (protected only by user-DPAPI), thereby enabling cookie decryption by any user-context malware without SYSTEM-level access. This flaw bypasses the protections intended by the AppBound encryption design and allows cookie theft from Chromium-based browsers. Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users. By extracting this password, an attacker can authenticate to the NSClient++ web interface (typically accessible on port 8443) and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM by registering a custom script, saving the configuration, and triggering it via the API. This behavior is documented but insecure, as the plaintext credential exposure undermines access isolation between local users and administrative functions.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

A vulnerability was found in itsourcecode Employee Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /admin/editempprofile.php. The manipulation of the argument FirstName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 1.2
• Impact Score: 5.9
• References: , , , , ,

A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /panel/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , ,

A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /panel/edit-services.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , ,

Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted "password" and "salt". The password can then be obtained through brute-force cracking.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: ,

The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: CRITICAL
• Exploitability Score: 3.9
• Impact Score: 5.9
• References: , ,

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an authenticated, remote attacker to to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 1.7
• Impact Score: 2.7
• References: ,

A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulnerability is an unknown functionality of the file /doctor/manage-patient.php. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.3
• Impact Score: 2.7
• References: , , , , ,

A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add-staff.php. The manipulation of the argument Name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , , ,

A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability affects unknown code of the file /panel/edit-staff.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , , ,

A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. This issue affects some unknown processing of the file /panel/add-services.php. The manipulation of the argument Type leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , , ,

A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/stock.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , , , , ,

SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload to the $cshortname, $cfullname, and $cdate variables.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: 1.39.X, 1.42.X, from 1.43.X before 1.43.2.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

ethereum is a common ethereum structs for Rust. Prior to ethereum crate v0.18.0, signature malleability (according to EIP-2) was only checked for "legacy" transactions, but not for EIP-2930, EIP-1559 and EIP-7702 transactions. This is a specification deviation. The signature malleability itself is not a security issue and not as high of a risk if the ethereum crate is used on a single-implementation blockchain. This issue has been patched in version v0.18.0. A workaround for this issue involves manually checking transaction malleability outside of the crate, however upgrading is recommended.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/index/file/ui.py, the index_fn method accepts both URLs and local file paths without validation. The pipeline streams these paths directly and stores them, enabling attackers to traverse directories (e.g. ../../../../../.env) and exfiltrate sensitive files. This issue has been patched via commit 37cdc28, in version 0.10.7 which has not been made public at time of publication.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To successfully exploit this vulnerability, an attacker would need valid agent credentials.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.8
• Impact Score: 2.7
• References: ,

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker could exploit this vulnerability by logging in to the Cisco Spaces Connector CLI as the spacesadmin user and executing a specific command with crafted parameters. A successful exploit could allow the attacker to elevate privileges from the spacesadmin user and execute arbitrary commands on the underlying operating system as root.

• Vectorstring: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: LOCAL
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 0.8
• Impact Score: 5.2
• References: ,

pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by tampering with kernel memory. Details: The output of "sudo -l" reports the presence of "devmem" command executable as super user without using a password. This command allows to read and write an arbitrary memory area of the target device, specifying an absolute address.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS) via sending a specific sequence of crafted control packets.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authentication via a crafted pairing_failed packet.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. Beginning with release 24R1-SR 1.0 MP, the OAM service software performed PlanId field input validations mitigate the reported path traversal issue.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive after the privilege drop and, in theory, could potentially allow actions beyond the intended scope of the OAM service. These actions could include gaining root privileges, accessing root-owned files, modifying them as the file owner, and then returning them to root ownership. This issue has been corrected starting from release 24R1-SR 0.2 MP and later. Beginning with release 24R1-SR 0.2 MP, the OAM service software capabilities are restricted to the minimum necessary.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity boards using the internal bsoc SSH service, which is available only internally within the baseband and through the internal backplane between the boards. The bsoc SSH allows login from one board to another via the baseband internal backplane using an SSH private key present on the baseband system board. This bsoc SSH capability was previously considered an administrative functionality but has now been restricted to be available only to baseband root-privileged administrators. This restriction mitigates the possibility of misuse with lower-level privileges (e.g., from baseband software images). This mitigation is included starting from release 23R4-SR 3.0 MP and later

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theory, potentially use for injecting arbitrary commands for unprivileged baseband OAM service process execution via special characters added to baseband internal COMA_config.xml file. This issue has been corrected starting from release 24R1-SR 1.0 MP and later, by adding proper input validation to OAM service process which prevents injecting special characters via baseband internal COMA_config.xml file.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use list_first_entry_or_null for opinfo_get_list() The list_first_entry() macro never returns NULL. If the list is empty then it returns an invalid pointer. Use list_first_entry_or_null() to check if the list is empty.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other user's links (and in some cases it might be possible to leak environment secrets). This issue has been patched in version 2.10.3 which has not been made public at time of publication.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , , ,

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Extension allows Stored XSS.This issue affects Mediawiki - TwoColConflict Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check stream id dml21 wrapper to get plane_id [Why & How] Fix a false positive warning which occurs due to lack of correct checks when querying plane_id in DML21. This fixes the warning when performing a mode1 reset (cat /sys/kernel/debug/dri/1/amdgpu_gpu_recover): [ 35.751250] WARNING: CPU: 11 PID: 326 at /tmp/amd.PHpyAl7v/amd/amdgpu/../display/dc/dml2/dml2_dc_resource_mgmt.c:91 dml2_map_dc_pipes+0x243d/0x3f40 [amdgpu] [ 35.751434] Modules linked in: amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_ttm_helper ttm drm_display_helper cec rc_core i2c_algo_bit rfcomm qrtr cmac algif_hash algif_skcipher af_alg bnep amd_atl intel_rapl_msr intel_rapl_common snd_hda_codec_hdmi snd_hda_intel edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec kvm_amd snd_hda_core snd_hwdep snd_pcm kvm snd_seq_midi snd_seq_midi_event snd_rawmidi crct10dif_pclmul polyval_clmulni polyval_generic btusb ghash_clmulni_intel sha256_ssse3 btrtl sha1_ssse3 snd_seq btintel aesni_intel btbcm btmtk snd_seq_device crypto_simd sunrpc cryptd bluetooth snd_timer ccp binfmt_misc rapl snd i2c_piix4 wmi_bmof gigabyte_wmi k10temp i2c_smbus soundcore gpio_amdpt mac_hid sch_fq_codel msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 hid_generic usbhid hid crc32_pclmul igc ahci xhci_pci libahci xhci_pci_renesas video wmi [ 35.751501] CPU: 11 UID: 0 PID: 326 Comm: kworker/u64:9 Tainted: G OE 6.11.0-21-generic #21~24.04.1-Ubuntu [ 35.751504] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 35.751505] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F30 05/22/2024 [ 35.751506] Workqueue: amdgpu-reset-dev amdgpu_debugfs_reset_work [amdgpu] [ 35.751638] RIP: 0010:dml2_map_dc_pipes+0x243d/0x3f40 [amdgpu] [ 35.751794] Code: 6d 0c 00 00 8b 84 24 88 00 00 00 41 3b 44 9c 20 0f 84 fc 07 00 00 48 83 c3 01 48 83 fb 06 75 b3 4c 8b 64 24 68 4c 8b 6c 24 40 <0f> 0b b8 06 00 00 00 49 8b 94 24 a0 49 00 00 89 c3 83 f8 07 0f 87 [ 35.751796] RSP: 0018:ffffbfa3805d7680 EFLAGS: 00010246 [ 35.751798] RAX: 0000000000010000 RBX: 0000000000000006 RCX: 0000000000000000 [ 35.751799] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000 [ 35.751800] RBP: ffffbfa3805d78f0 R08: 0000000000000000 R09: 0000000000000000 [ 35.751801] R10: 0000000000000000 R11: 0000000000000000 R12: ffffbfa383249000 [ 35.751802] R13: ffffa0e68f280000 R14: ffffbfa383249658 R15: 0000000000000000 [ 35.751803] FS: 0000000000000000(0000) GS:ffffa0edbe580000(0000) knlGS:0000000000000000 [ 35.751804] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 35.751805] CR2: 00005d847ef96c58 CR3: 000000041de3e000 CR4: 0000000000f50ef0 [ 35.751806] PKRU: 55555554 [ 35.751807] Call Trace: [ 35.751810] [ 35.751816] ? show_regs+0x6c/0x80 [ 35.751820] ? __warn+0x88/0x140 [ 35.751822] ? dml2_map_dc_pipes+0x243d/0x3f40 [amdgpu] [ 35.751964] ? report_bug+0x182/0x1b0 [ 35.751969] ? handle_bug+0x6e/0xb0 [ 35.751972] ? exc_invalid_op+0x18/0x80 [ 35.751974] ? asm_exc_invalid_op+0x1b/0x20 [ 35.751978] ? dml2_map_dc_pipes+0x243d/0x3f40 [amdgpu] [ 35.752117] ? math_pow+0x48/0xa0 [amdgpu] [ 35.752256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 35.752260] ? math_pow+0x48/0xa0 [amdgpu] [ 35.752400] ? srso_alias_return_thunk+0x5/0xfbef5 [ 35.752403] ? math_pow+0x11/0xa0 [amdgpu] [ 35.752524] ? srso_alias_return_thunk+0x5/0xfbef5 [ 35.752526] ? core_dcn4_mode_programming+0xe4d/0x20d0 [amdgpu] [ 35.752663] ? srso_alias_return_thunk+0x5/0xfbef5 [ 35.752669] dml21_validate+0x3d4/0x980 [amdgpu] (cherry picked from commit f8ad62c0a93e5dd94243e10f1b742232e4d6411e)

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extension allows Stored XSS.This issue affects Mediawiki - MintyDocs Extension: 1.39.X, 1.42.X, from 1.43.X before 1.43.2.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updating and deleting inventory item attachments. This flaw allows authenticated users to perform unauthorized actions on inventory item attachments that they do not own. This issue could lead to unauthorized data manipulation or loss of critical inventory data. This issue has been patched in version 0.20.1. There are no workarounds, users must upgrade.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg ), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: x1e80100: Add GPU cooling Unlike the CPU, the GPU does not throttle its speed automatically when it reaches high temperatures. With certain high GPU loads it is possible to reach the critical hardware shutdown temperature of 120°C, endangering the hardware and making it impossible to run certain applications. Set up GPU cooling similar to the ACPI tables, by throttling the GPU speed when reaching 95°C and polling every 200ms.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , ,

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling potential physical memory access attacks.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. Beginning with release 24R1-SR 1.0 MP, the OAM service software utilizes libarchive APIs with security options enabled, effectively mitigating the reported path traversal issue.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Sending a crafted SOAP "set" operation message within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. The OAM service component restarts automatically after the stack overflow without causing a base station restart or network service degradation, and without leaving any permanent impact on the Nokia Single RAN baseband OAM service.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services such as GFIAgent, bypassing firewall restrictions and exposing internal management endpoints. This enables unauthenticated attackers to access the GFIAgent service on ports 7995 and 7996, retrieve the appliance UUID, and issue administrative requests via the proxy. Exploitation results in full administrative access to the Kerio Control appliance.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the /WEB_VMS/LEVEL15/ endpoint. By crafting a specific POST request with modified Cookie headers and specially formatted parameters, an unauthenticated attacker can retrieve administrative account credentials in plaintext. This flaw allows direct disclosure of sensitive user data due to improper authentication checks and insecure backend logic.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release version by sending a specific HTTP POST request through the Mobile Network Operator (MNO) internal RAN management network.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, which in theory could potentially be used for causing resource exhaustion in the Single RAN baseband OAM service. No practical exploit has been detected for this flaw. However, the issue has been corrected starting from release 24R1-SR 2.1 MP by adding sufficient input validation for received SOAP requests, effectively mitigating the reported issue.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , ,

A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containing attacker-crafted hyperlinks embedding sensitive data. Slack’s link preview bots (e.g., Slack-LinkExpanding, Slackbot, Slack-ImgProxy) will then issue outbound requests to the attacker-controlled URL, resulting in zero-click exfiltration of private data.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , , , , ,

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper authentication. The /proxy handler on port 7996 allows arbitrary forwarding to administrative endpoints when provided with an Appliance UUID, which itself can be retrieved from port 7995. This results in a complete authentication bypass, permitting access to sensitive administrative APIs.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

Missing Authorization vulnerability in Mollie Mollie Payments for WooCommerce.This issue affects Mollie Payments for WooCommerce: from n/a through 8.0.2.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: ,

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.1
• Impact Score: 2.7
• References: , , , ,

The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device file system. Files are written as root. Using Postman it is possible to perform a Directory Traversal attack and write files into any location of the device file system. Similarly to the PUT method, it is possible to leverage the same mechanism to read any file from the file system by using the GET method.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used for SSH CLI access and are able to read all files according to the OS permission instead of remaining inside the chrooted directory position.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax() function in all versions up to, and including, 1.9.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Note: Requires Vikinger Media plugin to be installed and active.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: NONE
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.2
• References: , ,

Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target device. When a non-script or incorrect file is specified, the content of the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to authorized users and may result in the loss of confidentiality of administrative information, which could be leaked to unauthorized actors.

• Vectorstring: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: LOCAL
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 1.8
• Impact Score: 3.6
• References: , ,

The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: CRITICAL
• Exploitability Score: 3.9
• Impact Score: 5.9
• References: , ,

A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new extension versions under any namespace, including those not controlled by an attacker. However, it did not permit deletion of existing extensions, overwriting of published versions, or access to administrative features of the registry. The issue was reported on May 4, 2025, fully resolved by June 24, and followed by a comprehensive audit. No evidence of compromise was found, though 81 extensions were proactively deactivated as a precaution. The standard publishing process remained unaffected. Recommendations have been issued to mitigate similar risks in the future.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization occurs when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings.

• Vectorstring: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: HIGH
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 1.6
• Impact Score: 5.9
• References: , , , ,

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: LOW
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.9
• Impact Score: 1.4
• References: , , ,

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , , ,

Cross-site request forgery vulnerability exists in Active! mail 6 BuildInfo: 6.60.06008562 and earlier. If this vulnerability is exploited, unintended E-mail may be sent when a user accesses a specially crafted URL while being logged in.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

Cross-site scripting vulnerability exists in Active! mail 6 BuildInfo: 6.30.01004145 to 6.60.06008562. If this vulnerability is exploited, an arbitrary script may be executed on the logged-in user's web browser when the user is accessing a specially crafted URL.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.1
• Impact Score: 2.7
• References: , ,

The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 3.1
• Impact Score: 2.7
• References: , , ,

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: NONE
• Availability Impact: NONE
• Base Severity: HIGH
• Exploitability Score: 3.9
• Impact Score: 3.6
• References: , ,

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: HIGH
• Exploitability Score: 2.8
• Impact Score: 5.9
• References: , ,

The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: CHANGED
• Confidentiality Impact: LOW
• Integrity Impact: LOW
• Availability Impact: NONE
• Base Severity: MEDIUM
• Exploitability Score: 2.8
• Impact Score: 2.7
• References: , ,

In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.

• Vectorstring:
• Attack Vector:
• Attack Complexibility:
• Scope:
• Confidentiality Impact:
• Integrity Impact:
• Availability Impact:
• Base Severity:
• Exploitability Score:
• Impact Score:
• References: , ,

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.

• Vectorstring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: NETWORK
• Attack Complexibility: LOW
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH
• Base Severity: CRITICAL
• Exploitability Score: 3.9
• Impact Score: 5.9
• References: , ,