Author name: UNDERCODE

The CVE-2025-12888 vulnerability exploits subtle timing differences in the X25519 elliptic curve key exchange on Espressif ESP32 (Xtensa architecture) chips.

How the CVE Works: This vulnerability exists within the wolfSSL library’s implementation of TLS 1.3. During the handshake, a client

How the Mentioned CVE Works: Apache Druid’s Kerberos authenticator requires a secret key (druid.auth.authenticator.kerberos.cookieSignatureSecret) to cryptographically sign authentication cookies, preventing

The vulnerability CVE-2025-11931 in wolfSSL involves an integer underflow in the XChaCha20-Poly1305 decryption function. Specifically, when the function wc_XChaCha20Poly1305_Decrypt() is

How the CVE Works The vulnerability CVE-2022-25899 exists in the `auth0/node-jws` library versions <=3.2.2 and 4.0.0. It stems from an

The CVE-2025-66059 vulnerability exists in the Seriously Simple Podcasting WordPress plugin versions up to and including 3.13.0. It arises from

The vulnerability exists within the Shiro-based authentication login endpoint of Central Dogma. The `redirect` query parameter in the login request

The vulnerability CVE-2025-13789 is a Server-Side Request Forgery (SSRF) flaw in ZenTao versions up to 21.7.6-8564. It resides in the

How the CVE Works: The Seriously Simple Podcasting WordPress plugin, up to and including version 3.13.0, fails to implement nonce

How the CVE works: The CVE-2025-66060 vulnerability in the Seriously Simple Podcasting WordPress plugin stems from missing authorization checks in

How the CVE Works: The vulnerability exists in the Tryton server (trytond) where the data export functionality fails to validate

How the CVE Works: This SQL injection vulnerability exists within the `deleteTableColumnStatistics` method of the Hive Metastore Server’s Thrift API

The vulnerability exists within the `file::delete` function of /file/module/file/control.php. This function handles requests to delete files stored within the ZenTao

The CVE-2025-62189 vulnerability in LogStare Collector arises from flawed authorization logic within the UserRegistration module. During account creation, the system

How the Mentioned CVE Works: During the TLS 1.2 handshake, a server can send a `CertificateRequest` message to authenticate the

The vulnerability CVE-2025-13546 is a SQL injection issue in the ashraf-kabir travel-agency web application. It affects the /results.php file within

The CVE-2025-13544 vulnerability in ashraf-kabir travel-agency stems from inadequate file validation in the `/customer_register.php` endpoint. Attackers can remotely send HTTP

How the CVE works: The vulnerability exists in the IDonate WordPress plugin’s panding_blood_request_action() function, which is hooked to WordPress AJAX

The vulnerability occurs in mruby versions up to 3.4.0 within the sort_cmp function in src/array.c. This function handles element comparisons

How the mentioned CVE works: The vulnerability exists in the `/admin_area/index.php` file of the ashraf-kabir travel-agency software. The `edit_pack` parameter

How the CVE Works The vulnerability is in ZITADEL’s user federation auto-linking logic. When a user logs in via an

How CVE-2025-12468 works: The vulnerability exists in the FunnelKit Automations plugin for WordPress, all versions up to and including 3.6.4.1.

How the mentioned CVE works: The FunnelKit Automations plugin for WordPress has an AJAX handler function `bwfan_test_email` for sending test

This vulnerability resides in the bootloader component of MediaTek’s System-on-a-Chip (SoC) firmware. The flaw exists due to improper validation of

How the mentioned CVE works: The vulnerability exists in MediaTek modem software. A missing bounds check occurs during signal processing.

The vulnerability CVE-2025-20753 in MediaTek modem firmware stems from inadequate exception handling within the base station connection protocol. When User

The CVE-2025-66307 vulnerability targets the “Forgot Password” functionality within the Grav admin plugin’s interface at the /admin/forgot endpoint. When a

The vulnerability CVE-2025-13813 affects moxi159753 Mogu Blog v2 versions up to 5.2. It involves the Storage Management component, specifically the

How the CVE Works: The vulnerability exists in the `/admin/config/site` endpoint of the Grav admin plugin prior to version 1.11.0-beta.1.

The vulnerability targets Mogu Blog v2 versions up to 5.2. The flaw resides in the `LocalFileServiceImpl.uploadPictureByUrl` function within the `/file/uploadPicsByUrl`

The CVE-2025-63534 vulnerability is a Reflected Cross-Site Scripting (XSS) flaw within the `login.php` component of Blood Bank Management System version

The CVE-2025-13816 vulnerability exists in the `FileOperation.unzip` function within the `/networkDisk/unzipFile` endpoint of Mogu Blog. This function is responsible for

The vulnerability CVE-2025-13815 exists in moxi159753 Mogu Blog v2 versions up to 5.2. It involves an unknown function within the

The Grav admin plugin, an HTML interface for configuring Grav and managing pages, contains a stored cross-site scripting (XSS) vulnerability

The vulnerability exists in the `/admin/pages/ ` endpoint of the Grav Admin Plugin prior to version 1.11.0-beta.1. Attackers with administrative

The CVE-2025-66309 is a reflected Cross-Site Scripting (XSS) vulnerability in the Grav admin plugin. It affects versions prior to 1.11.0-beta.1.

The CVE-2025-66310 vulnerability operates through a Stored Cross-Site Scripting (XSS) mechanism in the Grav admin plugin, specifically targeting the `/admin/pages/

The SQL injection vulnerability resides in the `abs.php` component of Blood Bank Management System 1.0. This file handles search functionality,

The CVE-2025-5888 vulnerability in jsnjfz WebStack-Guns version 1.0 is a cross-site request forgery (CSRF) flaw that allows remote attackers to

CVE-2025-60646 is a stored cross-site scripting vulnerability in the Business Line Management module of Xxl-api version 1.3.0. The flaw allows

This vulnerability exists within the modem firmware stack of MediaTek chipsets. It is caused by improper validation of specific input

The CVE-2025-65113 vulnerability exploits an authorization bypass in ClipBucket v5’s AJAX flagging system. The flaw resides in the endpoint handling

CVE-2025-20379 is a privilege escalation vulnerability in Splunk Enterprise and Splunk Cloud Platform. It affects Splunk Enterprise versions below 10.0.1,

How the CVE Works: The vulnerability resides within the modem firmware stack, specifically in a function that processes signaling messages

This vulnerability exists within the MediaTek modem firmware. It is caused by a missing bounds check when processing certain signaling

The vulnerability resides in the MediaTek GNSS (Global Navigation Satellite System) firmware driver (mtk-gnss-driver.ko). The issue is an integer overflow

How the Mentioned CVE Works: The vulnerability exists in the `/api/storage/upload` endpoint of PubNet, a self-hosted package repository for Dart

The vulnerability exists within the `fontTools.varLib.main()` function, which processes XML-based .designspace files. When a malicious .designspace file is parsed, it

How the CVE works: CVE-2025-20378 is an unvalidated redirect vulnerability in Splunk Enterprise and Cloud Platform’s web login endpoint. The

The Cross-Site Request Forgery (CSRF) vulnerability in xxl-api v1.3.0 enables attackers to arbitrarily add users to the management module. This

The vulnerability exists within the modem firmware’s Radio Resource Control (RRC) protocol stack. When a User Equipment (UE), such as

The vulnerability exists in the PyFory serialization library’s fallback mechanism. When deserializing data, PyFory can be forced to use the

Apache Flink CDC version 3.4.0 contains a SQL injection vulnerability that allows maliciously crafted identifiers, such as database or table

How the mentioned CVE works: This vulnerability exists in MediaTek modem firmware due to a logic error. When a User

How the CVE Works: This vulnerability resides within the modem firmware stack, specifically in the processing of Radio Resource Control

The CVE-2025-20790 vulnerability exists in MediaTek modem firmware due to improper input validation during communication with base stations. When a

How CVE-2025-20792 works: This vulnerability in MediaTek modem firmware stems from improper input validation during cellular signal processing. When a

How CVE-2025-65670 Works: The Insecure Direct Object Reference (IDOR) vulnerability in classroomio 0.1.13 arises from insufficient server-side authorization checks on

How the CVE works: The vulnerability resides in the GPU pdma (Physical Direct Memory Access) component of MediaTek graphics processors.

How the mentioned CVE works: This vulnerability exists within the MediaTek modem firmware’s error handling routines. When a User Equipment

The CVE-2025-65676 vulnerability operates through a stored cross-site scripting (XSS) mechanism within the Classroomio Learning Management System version 0.1.13. Authenticated

The CVE-2025-4779 vulnerability affects lunary-ai/lunary versions before 1.9.24. It is a stored cross-site scripting (XSS) flaw in the `v1/runs/ingest` endpoint.

How the mentioned CVE works: In classroomio version 0.1.13, the Explore page displays courses for students. The application intended to

The CVE-2025-6703 vulnerability arises from insufficient input validation in the Mozilla neqo library, a QUIC protocol implementation. When processing QUIC

The vulnerability resides in the `@vitejs/plugin-rsc` and its dependency react-server-dom-webpack. Affected versions improperly handle the deserialization of client-transmitted data within

This vulnerability exists in the BlazeMeter Jenkins Plugin. The plugin provides configuration options in the Jenkins UI, such as dropdown

The vulnerability in assyncmy versions through 0.2.10 stems from improper sanitization of dictionary keys used in SQL query construction. When

The vulnerability, CVE-2025-55182, stems from insecure deserialization within the React Server Components flight protocol implementation. When Next.js with the App

How the CVE works: The CVE-2025-11626 vulnerability exists in the MONGO protocol dissector within Wireshark versions 4.4.0 to 4.4.9 and

How the CVE Works This vulnerability exists within the `view_edit.shtm` endpoint of the ScadaBR application, which is a component of

The CVE-2025-13499 vulnerability targets the Kafka protocol dissector in Wireshark versions 4.6.0 and 4.4.0 through 4.4.10. This dissector parses Kafka

The vulnerability exists in TCMAN GIM v11 version 20250304. It involves the PDAWebService.asmx web service. This service exposes a SOAP

The CVE-2025-46174 vulnerability in Ruoyi v4.8.0 stems from an incorrect access control flaw in the resetPwd method of SysUserController.java. This

The vulnerability in React Server Components stems from insecure deserialization within the server-side rendering pipeline. When server components receive serialized

The CVE-2025-13674 vulnerability stems from a flaw in the BPv7 (Bundle Protocol version 7) dissector within Wireshark version 4.6.0. When

The vulnerability (CVE-2025-54078) occurs in the Coder platform’s Workspace Agent. By default, the agent redirects its internal logs to the

The vulnerability is within the `Options::fontFamily` method in the Magick++ C++ API. When invoked with an empty string argument, the

The vulnerability occurs in the `/var/tdf/download_setting.php` endpoint of Mozart FM Transmitter devices running affected firmware versions. This PHP script uses

The vulnerability resides in the status_contents.php script of the Mozart FM Transmitter software. It involves a while loop that attempts

FeehiCMS version 2.1.1 contains a vulnerability in its ad management module that allows authenticated remote attackers to upload arbitrary files

How the mentioned CVE works: OrangeHRM versions 5.0 to 5.7 lack session invalidation during user state changes. When an account

The vulnerability exists in the `django.core.serializers.xml_serializer.getInnerText()` function within Django’s XML deserialization framework. This function is responsible for extracting text content

The vulnerability resides in the `/var/tdf/restore_settings.php` endpoint of the Mozart FM Transmitter firmware. This PHP script is accessible without any

How the Mentioned CVE Works The vulnerability exists within the `/var/tdf/start_upgrade.php` script of the Mozart FM Transmitter’s web interface. This

How the CVE Works: The vulnerability exists in the `status_contents.php` script located at `/var/tdf/` within the web interface of Mozart

The disclosed vulnerability in Step CA affects deployments using ACME (Automated Certificate Management Environment) and SCEP (Simple Certificate Enrollment Protocol)

The vulnerability exists in the `upgrade_contents.php` firmware upgrade endpoint. This script accepts file uploads intended for device firmware updates. It

The CVE-2025-66262 vulnerability operates through the `restore_mozzi_memories.sh` script in affected Mozart FM Transmitter devices. This script handles user-supplied tar archive

How the CVE Works The vulnerability resides in the `deletehidden` parameter of the Mozart FM Transmitter web interface. This parameter,

The vulnerability exists in the `/var/tdf/patch_contents.php` endpoint of the device’s web interface. This script handles file uploads for system updates

The vulnerability stems from improper neutralization of special elements used in shell commands within the Claude Code environment. Specifically, errors

The vulnerability exploits the `DToA` number conversion library within the Mozilla Rhino JavaScript engine. When the `Number.prototype.toFixed()` method is called

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw arising from insecure XML construction. The affected Mozart FM Transmitter software

This vulnerability allows an authenticated attacker to execute arbitrary code with root privileges on the affected Mozart FM Transmitter devices.

How the CVE works: The vulnerability exists in the `patch_contents.php` file of the Mozart FM Transmitter web interface. This script

The CVE-2025-66260 vulnerability is a SQL injection flaw in the `status_sql.php` endpoint of DB Electronica Telecomunicazioni S.p.A.’s Mozart FM Transmitter

How the mentioned CVE works: The vulnerability affects Step CA deployments using the SSHPOP provisioner for SSH certificate issuance. The

How CVE-2025-66254 works: The vulnerability exists in the `upgrade_contents.php` script of Mozart FM Transmitter devices. This PHP file is accessible

The vulnerability exists within the recruitment module’s file retrieval endpoint. When an authenticated user sends an HTTP request to download

This vulnerability exploits a logic flaw in the OrangeHRM password reset mechanism (versions 5.0 to 5.7). The reset process involves