Author name: UNDERCODE

How the CVE works: In OISM libcoap version 4.3.5, the function tls_verify_call_back() in src/coap_openssl.c handles DTLS handshake verification. During this

CVE-2025-36112 is an information disclosure vulnerability affecting IBM Sterling B2B Integrator and IBM Sterling File Gateway. The flaw allows unauthorized

The vulnerability CVE-2025-60632 targets Free5GC versions 4.0.0 and 4.0.1, specifically in the Npcf_BDTPolicyControl API. This API handles background data transfer

The vulnerability CVE-2025-65501 is a null pointer dereference in the coap_dtls_info_callback() function within OISM libcoap version 4.3.5. This function handles

This vulnerability exists because IBM Concert versions 1.0.0 through 2.0.0 utilize deprecated or weak cryptographic algorithms (e.g., DES, RC4, or

The vulnerability exploits the Nnssf_NSSAIAvailability API in Free5GC by sending a maliciously crafted POST request. This API, part of the

The vulnerability is a NULL pointer dereference in the coap_dtls_generate_cookie() function within src/coap_openssl.c of OISM libcoap version 4.3.5. This function

The CVE-2025-64048 vulnerability is a stored cross-site scripting (XSS) issue in YCCMS version 3.4, specifically within the management functionality. The

The vulnerability CVE-2025-60633 exploits a flaw in the Nudm_SubscriberDataManagement API within Free5GC versions 4.0.0 and 4.0.1. This API handles subscriber

CVE-2025-36134 exploits a vulnerability in IBM Sterling B2B Integrator and Sterling File Gateway where a sensitive cookie does not have

How the CVE-2025-62497 Vulnerability Works This CVE describes a classic Cross-Site Request Forgery (CSRF) vulnerability in the Sony SNC-CX600W network

How the Mentioned CVE Works: CVE-2025-64761 is a privilege escalation flaw in the OpenBao identity and secrets manager. It exploits

The vulnerability exists in the lsfusion platform versions up to 6.1 within the `UploadFileRequestHandler` function in the file platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java. The

The CVE-2025-13261 vulnerability exists in the lsfusion platform versions up to 6.1. It is a path traversal flaw in the

How the CVE Works: The vulnerability exists in API endpoints (e.g., /api/getUserProfile, /api/getProject) of Primakon Pi Portal v1.0.18. These endpoints

The vulnerability exists in SIGB PMB version 8.0.1.14 within the /opac_css/ajax_selector.php component. The `id` and `datas` parameters are directly incorporated

How CVE-2025-64066 Works The vulnerability exists in the `/api/v2/user/register` REST endpoint of Primakon Pi Portal version 1.0.18. This endpoint is

The vulnerability exists in the cms_rest.php component of SIGB PMB v8.0.1.14. Attackers send crafted HTTP requests with malicious serialized data

How the CVE Works: This vulnerability exploits a flaw in the authentication logic of the Uniong WebITR platform. An attacker

CVE-2025-13770 is a SQL injection vulnerability in WebITR software developed by Uniong. It occurs due to improper input validation in

How the CVE Works: The vulnerability exists in the /api/v2/pp_users endpoint of Primakon Pi Portal version 1.0.18. This API handles

How the mentioned CVE works: The CVE-2025-65647 vulnerability is an Insecure Direct Object Reference (IDOR) in the Track order function

How the CVE Works: The vulnerability exists in the `/api/V2/pp_udfv_admin` endpoint of Primakon Pi Portal version 1.0.18. This endpoint implements

How the CVE works: Primakon Pi Portal version 1.0.18 API endpoints lack server-side authorization validation, relying solely on UI restrictions.

The CVE-2025-34240 vulnerability exists within the Advantech WebAccess/VPN software, specifically in versions prior to 1.1.5. The flaw is located in

The CVE-2025-34241 vulnerability is a SQL injection issue in Advantech WebAccess/VPN software. It affects versions before 1.1.5. The flaw resides

The vulnerability exists within the `ajaxDeviceFwRulesAction()` method of the AjaxFwRulesController. This endpoint, designed to return firewall rule data for devices

The CVE-2025-34242 vulnerability is a SQL injection flaw in Advantech WebAccess/VPN versions prior to 1.1.5. It specifically exists in the

How the mentioned CVE works: The Xtooltech Xtool AnyScan Android application version 4.40.40 and prior embeds a static cryptographic key

How the mentioned CVE works: 1. The update server endpoint lacks authentication. 2. No credentials are required for access. 3.

The CVE-2025-34246 vulnerability exists in Advantech WebAccess/VPN versions before 1.1.5. It is a SQL injection flaw within the `AjaxPrevalidationController.ajaxAction()` method.

How CVE-2025-63434 Works: The Xtool AnyScan Android application incorporates an update mechanism that automatically checks for and installs new software

The CVE-2025-34247 vulnerability involves a SQL injection flaw in Advantech WebAccess/VPN. It specifically exists within the NetworksController.addNetworkAction() function. This function

The vulnerability exists in the `unpackFile` function within the `ZipUtils.java` component of the lsfusion platform. This function is responsible for

The CVE-2025-63432 vulnerability stems from the Xtool AnyScan Android application’s failure to implement proper SSL certificate validation during TLS connections

The vulnerability occurs in libssh when utilizing the ChaCha20 cipher through OpenSSL. During cipher context initialization, if heap memory is

The CVE-2025-34245 vulnerability exists within the `AjaxStandaloneVpnClientsController.ajaxAction()` function of Advantech WebAccess/VPN. This function handles AJAX requests for datatable operations, such

The CVE-2025-34243 vulnerability exists in Advantech WebAccess/VPN versions before 1.1.5. It is a SQL injection flaw in the `AjaxFwRulesController.ajaxNetworkFwRulesAction()` function.

How the mentioned CVE works: The CVE-2022-31652 vulnerability exists within the system_settings.shtm page of ScadaBR. This page is part of

How the mentioned CVE works: The CVE-2025-5307 vulnerability exists within the ‘Create Workbook’ feature of the OpenStack Mistral dashboard plugin.

The CVE-2025-12345 vulnerability in Apache Druid stems from a weak fallback mechanism for the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration parameter. When system administrators

Angular’s HttpClient class provides built-in Cross-Site Request Forgery (XSRF) protection. This mechanism works by comparing the request URL against the

The vulnerability exists in the multi-session plugin’s `/sign-out` after-hook. The hook retrieves the raw `cookie` header from the request and

The vulnerability CVE-2025-12816 is an Interpretation Conflict in the node-forge library’s ASN.1 parser. The flaw exists because the `asn1.validate` function

The vulnerability in node-forge’s `asn1.derToOid` function stems from using JavaScript’s 32-bit bitwise left-shift operator (<<) to decode Object Identifier (OID)

The CVE-2025-49607 vulnerability in REDAXO CMS stems from inadequate input sanitization within the template management feature. An authenticated attacker with

The CVE-2025-53033 vulnerability in REDAXO CMS functions by exploiting the “Output” code field within its module management system. This field

The vulnerability in [email protected] is a command injection flaw arising from improper neutralization of special elements used in an OS

The vulnerability exists in the `asn1.fromDer` function within forge/lib/asn1.js. The DER parser implementation uses a recursive function, _fromDer, to process

The CVE-2025-5307 vulnerability in OpenSearch exists within the query parser for the `query_string` functionality. When a specially crafted, complex query

How the mentioned CVE works: This vulnerability exists within the Keycloak LDAP User Federation provider. An authenticated attacker with realm

The CVE-2024-43651 vulnerability in Valibot is a ReDoS flaw within the `emoji()` validator’s `EMOJI_REGEX` pattern. The regex is structured with

The vulnerability exploits Ray’s insufficient browser request filtering. Ray’s dashboard endpoints, like /api/jobs/, are protected by a middleware that blocks

How the mentioned CVE works: The vulnerability exists in the API endpoint responsible for user creation, typically /api/user. The endpoint

The vulnerability is a reflected Cross-Site Scripting (XSS) in the Mediapool backend component. The attack flow begins when a user

How the mentioned CVE works: The vulnerability is a heap-based buffer overflow in the `nftnl-rs` Rust crate, a wrapper for

How the mentioned CVE works: CVE-2023-46805 is an authentication bypass vulnerability within the web component of Ivanti Connect Secure and

The vulnerability CVE-2024-23635 in the OWASP Java HTML Sanitizer arises from a specific and insecure interaction between the `noscript` and

How the mentioned CVE works: The vulnerability is an Insecure Direct Object Reference (IDOR) in the Better Auth Passkey Plugin.

How the mentioned CVE works: The vulnerability is a nil pointer dereference in the NSSF (Network Slice Selection Function) module

How the CVE Works The vulnerability exists within the Nudm_SubscriberDataManagement service of Free5GC. An unauthenticated attacker can send a specially

How the mentioned CVE works: The vulnerability CVE-2025-53032 exists within the Npcf_BDTPolicyControl service of Free5GC. A threat actor can exploit

How the mentioned CVE works: The vulnerability exists within the handling of template closures in the `Contao\Template::once()` method. Backend users

The vulnerability exists within the Snappy compression block decoder in affected versions of VictoriaMetrics. The decoder fails to properly validate

The CVE-2024-XXXX vulnerability in the cggmp24 library stems from insecure handling of presignatures in two specific contexts. First, when combined

How the CVE Works The vulnerability exists within the Fugue framework’s RPC server implementation. The `_decode()` function located in `fugue/rpc/flask.py`

The CGGMP21 threshold ECDSA protocol utilizes Zero-Knowledge (ZK) proofs to allow multiple parties to collaboratively generate signatures without any single

The CVE-2024-36401 vulnerability in GeoServer operates through its Web Map Service (WMS) `GetMap` endpoint at /geoserver/wms. This endpoint accepts XML-based

The CVE-2024-23307 vulnerability operates within the GeoServer Web Map Service (WMS) GetFeatureInfo request when the output format is set to

How the mentioned CVE works: The vulnerability CVE-2025-XXXX in body-parser version 2.2.0 stems from an inefficient algorithm for parsing URL-encoded

How the mentioned CVE works: Apache Syncope allows configuration to store user passwords in its internal database using AES encryption,

How the mentioned CVE works: The vulnerability CVE-2024-31453 is a credential disclosure flaw in the Grype vulnerability scanner. In affected

How the mentioned CVE works: The CVE-2024-52419 vulnerabilities stem from eKuiper’s failure to properly sanitize user-supplied input before using it

How the mentioned CVE works: The vulnerability exists because OMERO.web utilizes the jquery-form library for handling AJAX form submissions and

How the CVE Works: The vulnerability exists in Babylon’s consensus message handling for vote extensions. The code fails to properly

The CVE-2025-XXXX vulnerability stems from Babylon’s incomplete implementation of the BIP-322 standard for simple signature verification. The specification mandates that

How the CVE Works The vulnerability resides in the LZWDecode filter used by pypdf to decompress data streams within PDF

The vulnerability CVE-2024-34080 in Formwork CMS stems from a failure to sanitize user-supplied input within the blog tag field before

When the `sendDefaultPii` configuration option is set to `true` in affected versions of the Sentry Node.js SDK, the SDK’s tracing

How the Mentioned CVE Works The vulnerability, CVE-2025-5301, is a privilege escalation flaw within the OpenBao identity group subsystem. A

How the mentioned CVE works: The vulnerability exists in a Python-based web application. The initial patch for an SSRF flaw

How the mentioned CVE works: The vulnerability resides within the REST WebServices component of Oracle Identity Manager. An unauthenticated attacker

How the mentioned CVE works The vulnerability exists in the `thread_amount` function of the affected crate. On Windows, the function

The vulnerability occurs in mlx::core::load() when parsing a NumPy .npy file. The function reads a 118-byte header into a buffer.

How the mentioned CVE works: The vulnerability exists in the `display.php` file at line 396. The application unsafely retrieves user

The vulnerability occurs in the mlx::core::load_gguf() function when processing a maliciously crafted GGUF file. The function `extract_tensor_data()` receives a `gguf_tensor`

How the mentioned CVE works: The vulnerability exists in the zx CLI tool when the `–prefer-local` flag is used. This

The CVE-2025-XXXX vulnerability in Grafana Enterprise stems from an insecure handling of the `externalId` attribute during SCIM provisioning. When the

How the CVE Works: The vulnerability exists in the `sql.php` file of phpPgAdmin. Between lines 68 and 76, the code

The CVE-2025-13357 vulnerability stems from an insecure default configuration within the HashiCorp Vault Terraform Provider. The provider’s resource for configuring

How the mentioned CVE works: The vulnerability CVE-2024-46772 is a logic flaw in SpiceDB’s `LookupResources` API. When a schema defines

How the mentioned CVE works: The vulnerability in Clerk-js version 5.88.0 resides in the OAuth one-time password (OTP) verification logic.

CVE-2024-32471 is an authorization bypass vulnerability stemming from an incorrect policy enforcement mechanism in the OpenFGA engine. The flaw occurs

How the mentioned CVE works: The vulnerability exists in the CSV import functionality of Snipe-IT. When an admin user uploads

How the mentioned CVE works: This vulnerability exists within the filesystem traversal logic of OSV-SCALIBR. Specifically, in the fallback path

The CVE-2024-49700 vulnerability in Minder is a Server-Side Request Forgery (SSRF) flaw originating from the `http.send` function within custom Rego

The vulnerability in authkit-nextjs versions 2.11.0 and below stems from a failure to set appropriate anti-caching HTTP headers on authenticated

The vulnerability in the anthropic-ai/claude-code platform stems from an insufficient validation mechanism for sed commands. The system’s read-only validation, intended

How the mentioned CVE works: In couch-auth version 0.21.2, the `src/user.ts` module between lines 700-707 handles user authentication by storing