Web Security Insights By Maloy Roy Orko

CVE ID : CVE-2025-9736 Published : Aug. 31, 2025, 4:15 p.m. | 2 hours, 29 minutes ago Description : A security vulnerability has been detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_query_assemble_designer/jaxrs/statement of the component Personal Profile Page. Such manipulation of the argument description/queryName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/1dEUFXM via IFTTT

CVE ID : CVE-2025-9735 Published : Aug. 31, 2025, 4:15 p.m. | 2 hours, 29 minutes ago Description : A weakness has been identified in O2OA up to 10.0-410. This affects an unknown function of the file /x_query_assemble_designer/jaxrs/table of the component Personal Profile Page. This manipulation of the argument description/applicationName/queryName causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/xpkTye5 via IFTTT

CVE ID : CVE-2025-9695 Published : Aug. 30, 2025, 4:15 p.m. | 2 hours, 26 minutes ago Description : A vulnerability was identified in GalleryVault Gallery Vault App up to 4.5.2 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.thinkyeah.galleryvault. The manipulation leads to improper export of android application components. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/9thcGn6 via IFTTT

CVE ID : CVE-2025-30267 Published : Aug. 29, 2025, 6:15 p.m. | 23 minutes ago Description : A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/T0BcGjh via IFTTT

CVE ID : CVE-2025-30264 Published : Aug. 29, 2025, 6:15 p.m. | 23 minutes ago Description : A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later Severity: 7.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/BZ0EJSf via IFTTT

CVE ID : CVE-2025-31979 Published : Aug. 28, 2025, 5:15 p.m. | 1 hour, 12 minutes ago Description : A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/4NzkKl1 via IFTTT

CVE ID : CVE-2025-31977 Published : Aug. 28, 2025, 5:15 p.m. | 1 hour, 12 minutes ago Description : HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms.  An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/SjfIZEG via IFTTT

CVE ID : CVE-2025-31972 Published : Aug. 28, 2025, 5:15 p.m. | 1 hour, 12 minutes ago Description : HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/103SlU7 via IFTTT

CVE ID : CVE-2025-50978 Published : Aug. 27, 2025, 4:15 p.m. | 2 hours, 8 minutes ago Description : In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient input sanitization of filename elements. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/xDQaJ7Y via IFTTT

CVE ID : CVE-2025-1994 Published : Aug. 26, 2025, 5:15 p.m. | 1 hour, 3 minutes ago Description : IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the BinaryFormatter function. Severity: 7.8 | HIGH

CVE ID : CVE-2025-1494 Published : Aug. 26, 2025, 5:15 p.m. | 1 hour, 3 minutes ago Description : IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/0C9vKDx via IFTTT

Hi   all, I am Maloy Roy Orko. Recently,in one of my pentest research,I found a web application project and it was Real Estate Management System by Script and Tools. So, I downloaded this and started to find vulnerabilities if it has. Surprisingly,I found Broken Access Control  vulnerability and for specifically CWE-698: Execution After Redirect (EAR ) in /admin/userlist.php CVE Number : In Review CWE Number : CWE-284 ,CWE-698 Source Code Review: As you can see ,There are no die() or exit() after header() redirect! That's why,this vulnerability is occuring! Some Important Informations: Title of the Vulnerability:  Real Estate Management System V 1.0 | /admin/userlist.php | Broken Access Control| Found By Maloy Roy Orko Vulnerability Class:  Broken Access Control Product Name : Real Estate Management System  Vendor : https://github.com/scriptandtools/ Vulnerable Product Link: https://github.com/scriptandtools/Real-Estate-website-in-PHP Vulnerable File/Component...

Hi All,  I am Maloy Roy Orko. CVE Number: In Review CWE : 94 Recently in one of my pentest research, I found a Real Estate Management System By scriptandtools which is an open source project using native PHP. Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of File Extension or Upload protection In register.php file. It can lead into: Malware Distribution Remote Code Execution (RCE) Data Breach Denial of Service (DoS) Web Shell Installation Bypassing Security Controls Reputation Damage The Main Thing Is ,If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too.Thats why I am trying to inform everyone about this. Title of the Vulnerability:  Real Estate Management System V 1.0 | User Image Upload - register.php | Remote Code Execution| Found By Maloy Roy Orko Vulnerability Class : Remote Code...

CVE ID : CVE-2025-29420 Published : Aug. 25, 2025, 5:15 p.m. | 5 hours, 6 minutes ago Description : PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/MxwmWCd via IFTTT

CVE ID : CVE-2025-9394 Published : Aug. 24, 2025, 4:15 p.m. | 1 hour, 44 minutes ago Description : A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called 22d16cb142f293bf956f66a4d399cdd65576d36c. A patch should be applied to remediate this issue. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/RlwO9mH via IFTTT

CVE ID : CVE-2025-9393 Published : Aug. 24, 2025, 4:15 p.m. | 1 hour, 44 minutes ago Description : A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function addStaProfile of the file /goform/addStaProfile. Performing manipulation of the argument profile_name/Ssid/wep_key_1/wep_key_2/wep_key_3/wep_key_4/wep_key_length/wep_default_key/cipher/passphrase results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/SOJlBxe via IFTTT

CVE ID : CVE-2025-9392 Published : Aug. 24, 2025, 3:15 p.m. | 2 hours, 44 minutes ago Description : A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function qosClassifier of the file /goform/qosClassifier. Such manipulation of the argument dir/sFromPort/sToPort/dFromPort/dToPort/protocol/layer7/dscp/remark_dscp leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/hVKfvai via IFTTT

CVE ID : CVE-2025-9391 Published : Aug. 24, 2025, 3:15 p.m. | 2 hours, 44 minutes ago Description : A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/0emOVld via IFTTT

CVE ID : CVE-2025-9379 Published : Aug. 24, 2025, 7:15 a.m. | 2 hours, 8 minutes ago Description : A vulnerability was determined in Belkin AX1800 1.1.00.016. Affected by this vulnerability is an unknown functionality of the component Firmware Update Handler. This manipulation causes insufficient verification of data authenticity. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/twhjySc via IFTTT

CVE ID : CVE-2025-8208 Published : Aug. 24, 2025, 6:15 a.m. | 1 hour, 7 minutes ago Description : The Spexo Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/rDBJsXf via IFTTT

CVE ID : CVE-2025-36174 Published : Aug. 24, 2025, 2:15 a.m. | 28 minutes ago Description : IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened. Severity: 8.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/HeofTWR via IFTTT

CVE ID : CVE-2025-36157 Published : Aug. 24, 2025, 2:15 a.m. | 28 minutes ago Description : IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/CqU9GTR via IFTTT

CVE ID : CVE-2025-38665 Published : Aug. 22, 2025, 4:15 p.m. | 41 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode Andrei Lalaev reported a NULL pointer deref when a CAN device is restarted from Bus Off and the driver does not implement the struct can_priv::do_set_mode callback. There are 2 code path that call struct can_priv::do_set_mode: - directly by a manual restart from the user space, via can_changelink() - delayed automatic restart after bus off (deactivated by default) To prevent the NULL pointer deference, refuse a manual restart or configure the automatic restart delay in can_changelink() and report the error via extack to user space. As an additional safety measure let can_restart() return an error if can_priv::do_set_mode is not set instead of dereferencing it unchecked. Severity: 0.0 | NA Visit the link for more details, such as CV...

CVE ID : CVE-2025-43756 Published : Aug. 21, 2025, 5:15 p.m. | 1 hour, 38 minutes ago Description : A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/gh0sHi2 via IFTTT

CVE ID : CVE-2025-43755 Published : Aug. 21, 2025, 5:15 p.m. | 1 hour, 38 minutes ago Description : A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/h02KtOJ via IFTTT

CVE ID : CVE-2025-20269 Published : Aug. 20, 2025, 5:15 p.m. | 52 minutes ago Description : A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the underlying file system on an affected device. This vulnerability is due to insufficient input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface on an affected device. A successful exploit could allow the attacker to access sensitive files from the affected device. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/vkJth8L via IFTTT

CVE ID : CVE-2025-20131 Published : Aug. 20, 2025, 5:15 p.m. | 52 minutes ago Description : A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload via the ISE GUI. A successful exploit could allow the attacker to upload arbitrary files to an affected system. Severity: 4.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/fNBz6eH via IFTTT

CVE ID : CVE-2025-38600 Published : Aug. 19, 2025, 5:15 p.m. | 54 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan() The ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS elements so this >= needs to be > to prevent an out of bounds access. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/zuSK5oJ via IFTTT

CVE ID : CVE-2025-3639 Published : Aug. 18, 2025, 5:15 p.m. | 53 minutes ago Description : Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled. Severity: 2.0 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/TeBWIKw via IFTTT

CVE ID : CVE-2025-54118 Published : Aug. 18, 2025, 4:15 p.m. | 1 hour, 53 minutes ago Description : NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Sensitive information disclosure in NamelessMC before 2.2.4 allows unauthenticated remote attacker to gain sensitive information such as absolute path of the source code via list parameter. This vulnerability is fixed in 2.2.4. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/xRUQdwF via IFTTT

CVE ID : CVE-2025-54117 Published : Aug. 18, 2025, 4:15 p.m. | 1 hour, 53 minutes ago Description : NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the dashboard text editor component. This vulnerability is fixed in 2.2.4. Severity: 9.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/YZz0VSv via IFTTT

Hi All,  I am Maloy Roy Orko . CVE Number: In Review CWE: 89 Recently in one of my pentest research, I found an chat application which is built using PHP and JavaScript By shafhasan . Curious to explore its functionalities, I downloaded and set it up in my local system.  After fiddling with the source code, I found that it did not have any kind of SQL Injection protection . It can lead into mass user data in risk and database leaks can be happened by hackers too and admin panel credentials were in risk too. The Main Thing Is : If any NON-IT personal uses this template,he will fall into this vulnerability and his companies reputation can be lost too. That's why , I am trying to inform everyone about this. Title of the Vulnerability : Chatbox 1.0 | chat.php?user_id= SQL Injection | Found By Maloy Roy Orko   Vulnerability Class : SQL Injection Product Name : Chatbox 1.0 Vendor : https://github.com/shafhasan/ Vulnerable Product Link:   https://github.com/shafh...

CVE ID : CVE-2025-7342 Published : Aug. 17, 2025, 11:15 p.m. | 50 minutes ago Description : A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the image build process. Additionally, virtual machine images built using the Nutanix or the OVA provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their Windows nodes use VM images created via the Image Builder project with its Nutanix or OVA provider. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/gpsq5A7 via IFTTT

CVE ID : CVE-2025-9093 Published : Aug. 17, 2025, 10:15 p.m. | 1 hour, 50 minutes ago Description : A security vulnerability has been detected in BuzzFeed App 2024.9 on Android. This affects an unknown part of the file AndroidManifest.xml of the component com.buzzfeed.android. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/6hplYFf via IFTTT

CVE ID : CVE-2025-9090 Published : Aug. 17, 2025, 3:15 a.m. | 49 minutes ago Description : A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/0PzHrJx via IFTTT

CVE ID : CVE-2025-9089 Published : Aug. 17, 2025, 12:15 a.m. | 1 hour, 48 minutes ago Description : A vulnerability was determined in Tenda AC20 16.03.08.12. This issue affects the function sub_48E628 of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/VoDvawT via IFTTT

CVE ID : CVE-2025-9088 Published : Aug. 16, 2025, 11:15 p.m. | 48 minutes ago Description : A vulnerability was found in Tenda AC20 16.03.08.12. This vulnerability affects the function save_virtualser_data of the file /goform/formSetVirtualSer. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/WsZQKIu via IFTTT

CVE ID : CVE-2025-9087 Published : Aug. 16, 2025, 11:15 p.m. | 48 minutes ago Description : A vulnerability has been found in Tenda AC20 16.03.08.12. This affects the function set_qosMib_list of the file /goform/SetNetControlList of the component SetNetControlList Endpoint. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/MAgbqBC via IFTTT

CVE ID : CVE-2025-49897 Published : Aug. 15, 2025, 4:15 p.m. | 1 hour, 45 minutes ago Description : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/3gowAK8 via IFTTT

CVE ID : CVE-2025-49432 Published : Aug. 15, 2025, 4:15 p.m. | 1 hour, 45 minutes ago Description : Missing Authorization vulnerability in FWDesign Ultimate Video Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Video Player: from n/a through 10.1. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/cVvz1Jh via IFTTT

CVE ID : CVE-2025-20254 Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago Description : A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition. Severity: 5.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilit...

Get Certificates And Recognition For Your Knowledge! 👨‍💻 Monthly QUIZ Date : September 1,2025 Topic : Random Stuffs On Cyber Security Exam Format : MCQS & Short Questions Exam Medium : Our Website Quiz Link Will Be Shared in Our Page and will be available in the whole day! Web Link: https://www.websecurityinsights.my.id/?m=1 Join our Facebook community : https://facebook.com/groups/1015307810072889/ #quiz #QuizChallenge #olympiad #cybersecurity #IT #cybersecuritytraining #onlinequiz

CVE ID : CVE-2025-23303 Published : Aug. 13, 2025, 6:15 p.m. | 26 minutes ago Description : NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/riolq4b via IFTTT

CVE ID : CVE-2025-53734 Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago Description : Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/Paw2W6B via IFTTT

CVE ID : CVE-2025-53733 Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago Description : Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/8O6DbkA via IFTTT

CVE ID : CVE-2025-25231 Published : Aug. 11, 2025, 6:15 p.m. | 20 minutes ago Description : Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/tVy9opO via IFTTT

CVE ID : CVE-2025-8866 Published : Aug. 11, 2025, 5:15 p.m. | 1 hour, 20 minutes ago Description : YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/D0NFV2a via IFTTT

CVE ID : CVE-2025-8818 Published : Aug. 10, 2025, 11:15 p.m. | 1 hour, 18 minutes ago Description : A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function setDFSSetting of the file /goform/setLan. The manipulation of the argument lanNetmask/lanIp leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/rTgxjYO via IFTTT

CVE ID : CVE-2025-8817 Published : Aug. 10, 2025, 10:15 p.m. | 17 minutes ago Description : A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this vulnerability is the function setLan of the file /goform/setLan. The manipulation of the argument lan2enabled leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/KRLdu9j via IFTTT

CVE ID : CVE-2025-8763 Published : Aug. 9, 2025, 6:15 p.m. | 2 hours, 14 minutes ago Description : A vulnerability was found in Ruijie EG306MG 3.0(1)B11P309. It has been rated as problematic. This issue affects some unknown processing of the file /etc/strongswan.conf of the component strongSwan. The manipulation of the argument i_dont_care_about_security_and_use_aggressive_mode_psk leads to missing encryption of sensitive data. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/DuC4UJ3 via IFTTT

CVE ID : CVE-2025-8758 Published : Aug. 9, 2025, 4:15 p.m. | 2 hours, 14 minutes ago Description : A vulnerability was found in TRENDnet TEW-822DRE FW103B02. It has been classified as problematic. This affects an unknown part of the component vsftpd. The manipulation leads to least privilege violation. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/8fE3OWJ via IFTTT

CVE ID : CVE-2025-46414 Published : Aug. 8, 2025, 5:15 p.m. | 2 hours, 5 minutes ago Description : The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number. The API provides clear feedback when the correct PIN is entered. This vulnerability was patched in a server-side update on April 6, 2025. Severity: 8.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/ukGiQJF via IFTTT

CVE ID : CVE-2025-50952 Published : Aug. 7, 2025, 3:15 p.m. | 2 hours ago Description : openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/SAfEbuP via IFTTT

CVE ID : CVE-2025-47188 Published : Aug. 7, 2025, 3:15 p.m. | 2 hours ago Description : A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit through 6.4 SP4, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the phone, leading to disclosure or modification of sensitive configuration data or affecting device availability and operation. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/osep6VY via IFTTT

CVE ID : CVE-2024-52885 Published : Aug. 6, 2025, 3:15 p.m. | 1 hour, 58 minutes ago Description : The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the Mobile Access gateway. Severity: 5.0 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/5BP0ntp via IFTTT

CVE ID : CVE-2025-43978 Published : Aug. 5, 2025, 5:15 p.m. | 1 hour, 56 minutes ago Description : Jointelli 5G CPE 21H01 firmware JY_21H01_A3_v1.36 devices allow (blind) OS command injection. Multiple endpoints are vulnerable, including /ubus/?flag=set_WPS_pin and /ubus/?flag=netAppStar1 and /ubus/?flag=set_wifi_cfgs. This allows an authenticated attacker to execute arbitrary OS commands with root privileges via crafted inputs to the SSID, WPS, Traceroute, and Ping fields. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/JHNqeyQ via IFTTT

CVE ID : CVE-2025-44954 Published : Aug. 4, 2025, 5:15 p.m. | 1 hour, 51 minutes ago Description : RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account. Severity: 9.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/c1P0HqS via IFTTT

CVE ID : CVE-2025-20697 Published : Aug. 4, 2025, 2:15 a.m. | 51 minutes ago Description : In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915681; Issue ID: MSV-3795. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/aPMB8TS via IFTTT

CVE ID : CVE-2025-20696 Published : Aug. 4, 2025, 2:15 a.m. | 51 minutes ago Description : In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215; Issue ID: MSV-3801. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/FQcM8kE via IFTTT

CVE ID : CVE-2025-54956 Published : Aug. 3, 2025, 6:15 p.m. | 51 minutes ago Description : The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request. Severity: 3.2 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/XU853zk via IFTTT

CVE ID : CVE-2025-23276 Published : Aug. 2, 2025, 10:15 p.m. | 50 minutes ago Description : NVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. A successful exploit of this vulnerability may lead to escalation of privileges, denial of service, code execution, information disclosure and data tampering. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/q6bswtT via IFTTT

CVE ID : CVE-2025-8471 Published : Aug. 2, 2025, 7:15 p.m. | 1 hour, 50 minutes ago Description : A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of the file /adminlogin.php. The manipulation of the argument a_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/Kw7j0yA via IFTTT

CVE ID : CVE-2025-8470 Published : Aug. 2, 2025, 6:15 p.m. | 50 minutes ago Description : A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/deleteroom.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/hMWrnsZ via IFTTT

CVE ID : CVE-2025-8469 Published : Aug. 2, 2025, 5:15 p.m. | 1 hour, 50 minutes ago Description : A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/deletegallery.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/9txidWz via IFTTT

CVE ID : CVE-2025-53010 Published : Aug. 1, 2025, 6:15 p.m. | 49 minutes ago Description : MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1.39.2, when parsing shader nodes in a MTLX file, the MaterialXCore code accesses a potentially null pointer, which can lead to crashes with maliciously crafted files. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/sDTJqQe via IFTTT

CVE ID : CVE-2025-53009 Published : Aug. 1, 2025, 6:15 p.m. | 49 minutes ago Description : MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stack exhaustion. An attacker could intentionally crash a target program that uses OpenEXR by sending a malicious MTLX file. This is fixed in version 1.39.3. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/GB23cKi via IFTTT

CVE ID : CVE-2025-50870 Published : Aug. 1, 2025, 6:15 p.m. | 49 minutes ago Description : Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the requesting user. This allows any authenticated or unauthenticated attacker to enumerate and retrieve sensitive student details by altering the email value in the request URL, leading to information disclosure. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/gV8yQwe via IFTTT

CVE ID : CVE-2025-50869 Published : Aug. 1, 2025, 6:15 p.m. | 49 minutes ago Description : A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user input. Authenticated users can inject arbitrary JavaScript code. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more... from Latest Vulnerabilities https://ift.tt/DMXzEgB via IFTTT