CVE ID : CVE-2025-4493

Published : May 28, 2025, 1:15 p.m. | 22 minutes ago

Description : Improper privilege assignment in PAM JIT privilege sets in Devolutions
Server allows a PAM user to perform PAM JIT
requests on unauthorized groups by exploiting a user interface issue.

This issue affects the following versions : 

* Devolutions Server 2025.1.3.0 through 2025.1.7.0
* Devolutions Server 2024.3.15.0 and earlier

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Its primary focus is to preserve these great systems for future generations while providing a good user experience. The post…

CVE ID : CVE-2025-5287

Published : May 28, 2025, 9:15 a.m. | 2 hours, 20 minutes ago

Description : The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘post’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Severity: 7.5 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-1753

Published : May 28, 2025, 10:15 a.m. | 1 hour, 20 minutes ago

Description : LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the `–files` argument, which is directly passed into `os.system`. An attacker who controls the content of this argument can inject and execute arbitrary shell commands. This vulnerability can be exploited locally if the attacker has control over the CLI arguments, and remotely if a web application calls the LLama-Index CLI with a user-controlled filename. This issue can lead to arbitrary code execution on the affected system.

Severity: 7.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-4963

Published : May 28, 2025, 10:15 a.m. | 1 hour, 20 minutes ago

Description : The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-5295

Published : May 28, 2025, 11:15 a.m. | 20 minutes ago

Description : A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.0. This vulnerability affects unknown code of the component PORT Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Severity: 7.3 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-40673

Published : May 28, 2025, 11:15 a.m. | 20 minutes ago

Description : A Missing Authorization vulnerability has been found in DinoRANK. This
vulnerability allows an attacker to access invoices of any user via
accessing endpoint ‘/facturas/YYYY-MM/SDRYYMM-XXXXX.pdf’ because there
is no access control. The pdf filename can be obtained via OSINT,
insecure network traffic or brute force.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Archinstall è un programma di installazione basato su menu per Arch Linux, una delle distribuzioni GNU/Linux più apprezzate dagli utenti…

A behind-the-scenes look at building a physics-based character controller using AI, React Three Fiber, Three.js, and Rapier. Source: Read More 

Thunderbird è un client di posta elettronica, rubrica, chat, notizie e calendario sviluppato come software libero e distribuito con licenza…

KaOS Linux è una distribuzione GNU/Linux indipendente, focalizzata sull’offrire un ambiente moderno, stabile e ottimizzato attorno al software KDE (K…

The iRasptek Raspberry Pi 5 8GB Starter Kit gives you everything you need to get started with your adventures with…

AlmaLinux, nato nel 2021 come risposta alla trasformazione di CentOS in CentOS Stream, si è affermato rapidamente come una distribuzione…

CVE ID : CVE-2025-4800

Published : May 28, 2025, 6:15 a.m. | 3 hours, 10 minutes ago

Description : The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site’s server, which may make remote code execution possible.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-5025

Published : May 28, 2025, 7:15 a.m. | 2 hours, 10 minutes ago

Description : libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-4947

Published : May 28, 2025, 7:15 a.m. | 2 hours, 10 minutes ago

Description : libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-4009

Published : May 28, 2025, 7:15 a.m. | 2 hours, 10 minutes ago

Description : The Evertz SVDN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product
features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz.

This web interface has two endpoints that are vulnerable to arbitrary command injection and the authentication mechanism has a flaw leading to authentication bypass.

Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2024-54020

Published : May 28, 2025, 8:15 a.m. | 1 hour, 10 minutes ago

Description : A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat feeds via crafted update requests.

Severity: 2.3 | LOW

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-22252

Published : May 28, 2025, 8:15 a.m. | 1 hour, 10 minutes ago

Description : A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID : CVE-2025-24473

Published : May 28, 2025, 8:15 a.m. | 1 hour, 10 minutes ago

Description : A exposure of sensitive system information to an unauthorized control sphere in Fortinet FortiClientWindows versions 7.2.0 through 7.2.1 may allow an unauthorized remote attacker to view application information via navigation to a hosted webpage, if Windows is configured to accept incoming connections to port 8053 (non-default setup)

Severity: 3.7 | LOW

Visit the link for more details, such as CVSS details, affected products, timeline, and more…