CVE ID : CVE-2025-3504
Published : May 1, 2025, 6:15 a.m. | 1 hour, 56 minutes ago
Description : The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4151
Published : May 1, 2025, 6:15 a.m. | 1 hour, 56 minutes ago
Description : A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/pass-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4152
Published : May 1, 2025, 6:15 a.m. | 1 hour, 56 minutes ago
Description : A vulnerability classified as critical has been found in PHPGurukul Online Birth Certificate System 1.0. Affected is an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4153
Published : May 1, 2025, 7:15 a.m. | 55 minutes ago
Description : A vulnerability classified as critical was found in PHPGurukul Park Ticketing Management System 2.0. Affected by this vulnerability is an unknown functionality of the file /profile.php. The manipulation of the argument adminname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-3521
Published : May 1, 2025, 7:15 a.m. | 55 minutes ago
Description : The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-47153
Published : May 1, 2025, 7:15 a.m. | 55 minutes ago
Description : Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-1_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website’s download page does not offer prebuilt Node.js for Linux on i386.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4100
Published : May 1, 2025, 7:15 a.m. | 55 minutes ago
Description : The Nautic Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘np_marinetraffic_map’ shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4154
Published : May 1, 2025, 7:15 a.m. | 55 minutes ago
Description : A vulnerability, which was classified as critical, has been found in PHPGurukul Pre-School Enrollment System 1.0. Affected by this issue is some unknown functionality of the file /admin/enrollment-details.php. The manipulation of the argument Status leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
Outlaw Botnet Exploits Weak SSH to Hijack Linux Systems for Crypto Mining
While high-profile ransomware and state-backed APT groups often dominate headlines, it’s crucial not to overlook quieter yet persistent threats. One such threat is Outlaw (also known as “Dota”), a Per …
Read more
Published Date:
May 01, 2025 (4 hours, 8 minutes ago)
Vulnerabilities has been mentioned in this article.
CVE-2024-56406
CVE-2023-47039
CVE-2023-47038
CVE-2023-47100
CVE-2025-32444 (CVSS 10): Critical RCE Flaw in vLLM’s Mooncake Integration Exposes AI Infrastructure
A critical security vulnerability has been disclosed in vLLM, a popular open-source library used for high-performance inference and serving of large language models (LLMs). Tracked as CVE-2025-32444, …
Read more
Published Date:
May 01, 2025 (3 hours, 48 minutes ago)
Vulnerabilities has been mentioned in this article.
CVE-2025-32444
CVE-2025-29783
APT28 Cyber Espionage Campaign Targets French Institutions Since 2021
The French National Cybersecurity Agency (ANSSI) has released a detailed report exposing a sustained and strategic cyber-espionage campaign orchestrated by APT28, a group publicly attributed to the Ru …
Read more
Published Date:
May 01, 2025 (3 hours, 43 minutes ago)
Vulnerabilities has been mentioned in this article.
CVE-2025-32444
CVE-2025-29906
CVE-2023-23397
CVE-2025-29906: Finit’s Bundled Getty Flaw Allows Authentication Bypass on Linux Systems
A serious security vulnerability has been discovered in Finit, a lightweight and fast init system for Linux, originally reverse-engineered from the EeePC fastinit by Claudio Matsuoka. Tracked as CVE-2 …
Read more
Published Date:
May 01, 2025 (3 hours, 33 minutes ago)
Vulnerabilities has been mentioned in this article.
CVE-2025-29906
CVE-2024-10442
CVE-2024-10442 (CVSS 10): Zero-Click RCE in Synology DiskStation, PoC Publishes
Image: RET2 Systems
A critical remote code execution (RCE) vulnerability has been disclosed in Synology’s DiskStation DS1823xs+, a popular NAS appliance favored by small businesses and IT professional …
Read more
Published Date:
May 01, 2025 (3 hours, 28 minutes ago)
Vulnerabilities has been mentioned in this article.
CVE-2025-29906
CVE-2024-10442
CVE-2024-3393
CVE-2022-27624
SonicWall Confirms Active Exploitation of SMA 100 Vulnerabilities – Urges Immediate Patching
On April 29, 2025, SonicWall issued an urgent update to two previously disclosed vulnerabilities affecting its SMA 100 Series appliances, confirming that both flaws are now actively being exploited in …
Read more
Published Date:
May 01, 2025 (2 hours, 14 minutes ago)
Vulnerabilities has been mentioned in this article.
CVE-2024-10442
CVE-2024-40766
CVE-2024-38475
CVE-2023-44221
CVE ID : CVE-2025-4145
Published : May 1, 2025, 1:15 a.m. | 2 hours, 37 minutes ago
Description : A vulnerability, which was classified as critical, has been found in Netgear EX6200 1.0.3.94. This issue affects the function sub_3D0BC. The manipulation of the argument host leads to buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4144
Published : May 1, 2025, 1:15 a.m. | 1 hour, 54 minutes ago
Description : PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped.
Fixed in:
https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27
Impact:
PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4143
Published : May 1, 2025, 1:15 a.m. | 1 hour, 54 minutes ago
Description : The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the allowed list of redirect URIs for the given client registration.
Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/26 https://github.com/cloudflare/workers-oauth-provider/pull/26
Impact:
Under certain circumstances (see below), if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visiting a malicious web site, then attacker could potentially steal the victim’s credentials to the same OAuth server and subsequently impersonate them.
In order for the attack to be possible, the OAuth server’s authorized callback must be designed to auto-approve authorizations that appear to come from an OAuth client that the victim has authorized previously. The authorization flow is not implemented by workers-oauth-provider; it is up to the application built on top to decide whether to implement such automatic re-authorization. However, many applications do implement such logic.
Note: It is a basic, well-known requirement that OAuth servers should verify that the redirect URI is among the allowed list for the client, both during the authorization flow and subsequently when exchanging the authorization code for an access token. workers-oauth-provider implemented only the latter check, not the former. Unfortunately, the former is the much more important check. Readers who are familiar with OAuth may recognize that failing to check redirect URIs against the allowed list is a well-known, basic mistake, covered extensively in the RFC and elsewhere. The author of this library would like everyone to know that he was, in fact, well-aware of this requirement, thought about it a lot while designing the library, and then, somehow, forgot to actually make sure the check was in the code. That is, it’s not that he didn’t know what he was doing, it’s that he knew what he was doing but flubbed it.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4146
Published : May 1, 2025, 2:15 a.m. | 1 hour, 38 minutes ago
Description : A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. Affected is the function sub_41940. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-4147
Published : May 1, 2025, 2:15 a.m. | 1 hour, 38 minutes ago
Description : A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this vulnerability is the function sub_47F7C. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
CVE ID : CVE-2025-2816
Published : May 1, 2025, 3:15 a.m. | 38 minutes ago
Description : The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellow_message_dontshow() function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to one on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…