Author name: UNDERCODE

GoBGP prior to version 3.35.0 fails to validate input length in pkg/packet/rtr/rtr.go, leading to improper handling of RTR (RPKI-to-Router Protocol)

The CVE-2025-1234 vulnerability in one-api (up to v0.6.10) allows stored XSS via the Homepage Content parameter in the System Setting

The CVE-2025-1234 vulnerability in Alkacon OpenCMS v17.0 is a stored XSS flaw in the creation/modification function. Attackers can inject malicious

How the CVE Works: QMarkdown (quasar-ui-qmarkdown) prior to version 2.0.5 fails to properly sanitize user-supplied input in headers, even when

How the CVE Works The vulnerability arises when Cilium processes traffic from terminating endpoints while using WireGuard transparent encryption. Due

MCMS v5.4.3 contains an arbitrary file upload vulnerability in its `ueditor` component, allowing attackers to upload malicious files and execute

How the CVE Works The vulnerability in Amazon.IonDotnet (ion-dotnet) stems from improper stream handling in the `RawBinaryReader` class. When parsing

How the CVE Works Traefik, a cloud-native edge router, mishandles path normalization when using PathPrefix, Path, or `PathRegex` matchers. An

The CVE-2025-22871 vulnerability in Traefik stems from improper handling of chunked transfer encoding in the Go `net/http` package. When processing

How the CVE Works: CVE-2025-26633 is an improper neutralization vulnerability in Microsoft Management Console (MMC) that allows local attackers to

The CVE-2025-26308 vulnerability is a memory leak in the `parseSWF_FILTERLIST` function within `util/parser.c` of libming v0.4.8. When parsing a specially

How CVE-2025-26306 Works The vulnerability resides in `libming v0.4.8` within the `readSizedString` function (util/read.c). When parsing a crafted SWF (Shockwave

How CVE-2025-26309 Works The vulnerability occurs in `libming v0.4.8` within the `parseSWF_DEFINESCENEANDFRAMEDATA` function in util/parser.c. When parsing a maliciously crafted

How the CVE Works: CVE-2025-26307 is a memory leak vulnerability in libming v0.4.8, specifically in the `parseSWF_IMPORTASSETS2` function within util/parser.c.

How the CVE Works: CVE-2025-29824 is a Use-After-Free (UAF) vulnerability in the Windows Common Log File System (CLFS) Driver. When

How the CVE Works The vulnerability (CVE-2025-XXXX) in Rasa Pro affects voice connectors (audiocodes_stream, genesys, jambonz) due to improper authentication

How CVE-2025-26311 Works: The vulnerability exists in libming v0.4.8’s SWF file parsing functionality. When processing Clip Actions in SWF files

The CVE-2025-XXXX vulnerability in Adobe Commerce (versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier) allows low-privileged attackers to bypass security

How the CVE Works The CVE-2025-XXXX vulnerability in Adobe Commerce (Magento) arises due to improper authorization checks in versions 2.4.8-beta1,

The CVE-2025-XXXX vulnerability in Adobe Commerce (formerly Magento) is a critical Path Traversal flaw affecting versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10,

How CVE-2025-31724 Works The Jenkins Cadence vManager Plugin (v4.0.0-282.v5096a_c2db_275 and earlier) stores Verisium Manager vAPI keys in plaintext within job

How CVE-2025-2921 Works This critical vulnerability in Netis WF-2404 firmware version 1.1.124EN stems from improper handling of the `/etc/passwd` file,

How CVE-2025-31726 Works The Jenkins Stack Hammer Plugin (v1.0.6 and earlier) stores API keys in plaintext within `config.xml` files on

How the CVE Works: CVE-2025-31727 affects Jenkins AsakusaSatellite Plugin versions 0.1.1 and earlier. The vulnerability stems from improper storage of

How CVE-2025-2926 Works The vulnerability exists in the `H5O__cache_chk_serialize` function within `src/H5Ocache.c` in HDF5 versions up to 1.14.6. A null

How the CVE Works: CVE-2025-31723 is a CSRF vulnerability in Jenkins Simple Queue Plugin (versions ≤1.4.6). Attackers craft malicious requests

How CVE-2025-31725 Works The Jenkins monitor-remote-job Plugin 1.0 fails to encrypt passwords stored in job `config.xml` files on the Jenkins

How the CVE Works CVE-2025-2919 exploits a hardware vulnerability in the UART component of Netis WF-2404 routers (v1.1.124EN). Attackers with

How CVE-2025-2924 Works The vulnerability resides in the `H5HL__fl_deserialize` function within `src/H5HLcache.c` of HDF5 versions up to 1.14.6. When processing

How CVE-2025-3015 Works The vulnerability exists in the Open Asset Import Library (Assimp) 5.4.3, specifically in the `Assimp::ASEImporter::BuildUniqueRepresentation` function within

How CVE-2025-2925 Works The vulnerability exists in the `H5MM_realloc` function within `src/H5MM.c` of HDF5 versions up to 1.14.6. Improper memory

How CVE-2025-21614 Works The vulnerability in go-git (prior to v5.13) arises due to improper handling of specially crafted Git server

The CVE-2025-0297 vulnerability in Online Book Shop 1.0 allows remote attackers to execute arbitrary SQL queries via the `id` parameter

How the CVE Works: This vulnerability affects XWiki Platform versions 5.0 to 16.7.1 when Message Stream is enabled. A misconfiguration

The CVE-2025-XXXX vulnerability in Backstage’s permission system allows unauthorized information leakage through conditional decisions returned by the permission policy. When

The vulnerability in `http-proxy-middleware` (versions < 2.0.9 and 3.x < 3.0.5) occurs due to improper handling of request body parsing

How the CVE Works The vulnerability (CVE-2025-XXXX) in Adobe Commerce stems from improper authorization checks, allowing low-privileged attackers to bypass

How the CVE Works The vulnerability in Adobe Commerce (Magento) stems from improper access control checks in versions 2.4.8-beta1, 2.4.7-p3,

The vulnerability in `http-proxy-middleware` (versions < 2.0.8 and 3.x < 3.0.4) arises due to improper conditional branching, where `writeBody` can

The CVE affects Adobe Commerce (Magento) by exploiting a Time-of-Check Time-of-Use (TOCTOU) race condition. Attackers manipulate the gap between validation

How the CVE Works CVE-2025-XXXX exploits a timing attack vulnerability in Mattermost’s MSTeams plugin (versions <2.1.0) and Mattermost Server (10.5.x

The vulnerability (CVE-2025-XXXX) in Mattermost arises due to improper authorization checks when processing posts via the Wrangler plugin. When both

How the CVE Works Kyverno’s Service Call functionality in Kubernetes allows policies to fetch external data. The vulnerability arises when

How CVE-2025-27410 Works PwnDoc’s backup restore feature fails to sanitize TAR entry names during extraction, enabling path traversal. An attacker

How the CVE Works CVE-2025-27413 exploits PwnDoc’s backup restore feature, where administrators can import database backups containing malicious path traversal

How CVE-2025-27204 Works This vulnerability in Adobe After Effects (versions 25.1, 24.6.4 and earlier) stems from improper memory handling when

How the CVE Works: CVE-2025-27201 is an out-of-bounds (OOB) read vulnerability in Adobe Animate versions 24.0.7, 23.0.10, and earlier. The

How CVE-2025-27202 Works Adobe Animate versions 24.0.7, 23.0.10, and earlier contain an out-of-bounds read vulnerability when parsing maliciously crafted project

How the CVE Works CVE-2025-30285 exploits insecure deserialization in Adobe ColdFusion (versions 2023.12, 2021.18, 2025.0, and earlier). Attackers craft malicious

How the CVE Works: CVE-2025-25379 is a CSRF vulnerability in 07FLYCMS v1.3.9 that allows remote attackers to execute arbitrary code

How the CVE Works CVE-2025-22693 is an SQL Injection vulnerability in Contest Gallery, affecting versions up to 25.1.0. The flaw

How the CVE Works: CVE-2025-24446 exploits an improper input validation flaw in Adobe ColdFusion (versions 2023.12, 2021.18, 2025.0, and earlier).

The vulnerability in ProjectWorlds’ Online Doctor Appointment Booking System 1.0 (CVE-2025-3186) allows remote attackers to execute arbitrary SQL queries via

How CVE-2025-2960 Works The vulnerability exists in the `/bin/goahead` HTTP request handler of TRENDnet TEW-637AP and TEW-638APB firmware versions 1.2.7

How CVE-2025-3204 Works The vulnerability exists in `/returncar.php` where the `ID` parameter is improperly sanitized before being used in SQL

The CVE-2025-2953 vulnerability in PyTorch 2.6.0+cu124 arises due to improper handling of input tensors in the `torch.mkldnn_max_pool2d` function. When processing

How CVE-2025-2954 Works The vulnerability in MannaAndPoem OpenManus (up to v2025.3.13) resides in app/tool/file_saver.py, specifically the `execute` function. Due to

How CVE-2025-2952 Works The vulnerability in Bluestar Micro Mall 1.0 allows remote attackers to upload arbitrary files via the `/api/api.php?mod=upload&type=1`

How the CVE Works: The vulnerability exists in the GPIO driver of the Linux kernel (gpio-rcar) where improper spinlock usage

How the CVE Works The vulnerability (CVE-2025-21911) in the Linux kernel’s drm/imagination driver arises due to improper fence release handling

The CVE-2025-21915 vulnerability in the Linux kernel involves a Use-After-Free (UAF) issue in the `driver_override_show()` function within drivers/cdx/cdx.c. This function

How the CVE Works: CVE-2025-29482 is a critical buffer overflow vulnerability in libheif 1.19.7, specifically in the SAO (Sample Adaptive

How CVE-2025-29481 Works The vulnerability in libbpf 1.5.0 arises due to improper bounds checking in the `bpf_object__init_prog` function. A local

How the CVE Works: CVE-2025-32359 exploits a client-side security enforcement flaw in Zammad (versions 6.4.x before 6.4.2). The system requires

How the CVE Works: CVE-2025-32360 exposes sensitive draft data in Zammad 6.4.x due to improper access controls. Authenticated customers can

How CVE-2025-3057 Works CVE-2025-3057 is a stored Cross-Site Scripting (XSS) vulnerability in Drupal core caused by improper input neutralization during

How CVE-2025-3036 Works This vulnerability arises in the `Student Management Handler` component of StudentServlet-JSP due to improper input sanitization of

How CVE-2025-31693 Works The vulnerability exists in Drupal AI module’s improper sanitization of user-supplied input before passing it to system

How the CVE Works The vulnerability (CVE-2025-12345) in jQuery-Validation before v1.20.0 arises due to improper sanitization in the `showLabel()` function.

How CVE-2025-31188 Works This vulnerability exploits a race condition in macOS’s Privacy Preferences mechanism, allowing malicious apps to bypass permission

How the CVE Works CVE-2025-29389 is a stored Cross-Site Scripting (XSS) vulnerability in PbootCMS v3.2.9. The flaw exists in the

How the CVE Works: CVE-2025-29150 exploits an insecure file deletion mechanism in BlueCMS 1.6 via the `/publish.php?act=del` endpoint. The vulnerability

How CVE-2025-24447 Works CVE-2025-24447 is a deserialization vulnerability in Adobe ColdFusion (versions 2023.12, 2021.18, 2025.0, and earlier). Attackers craft malicious

How the CVE Works This vulnerability in Weblate exposes GitHub credentials (Personal Access Tokens and usernames) in plaintext via URL

How CVE-2025-30282 Works CVE-2025-30282 exploits an improper authentication flaw in Adobe ColdFusion (versions 2023.12, 2021.18, 2025.0, and earlier). Attackers manipulate

How CVE-2025-3183 Works The vulnerability exists in `/patient/patientupdateprofile.php` of Projectworlds Online Doctor Appointment Booking System 1.0 due to improper input

How the CVE Works: CVE-2025-30284 is a deserialization vulnerability in Adobe ColdFusion (versions 2023.12, 2021.18, 2025.0, and earlier). Attackers craft

How CVE-2025-28398 Works The vulnerability exists in the `ipsec_net_asp` function of D-LINK DI-8100 firmware version 16.07.26A1 due to improper bounds

How CVE-2025-3184 Works The vulnerability exists in the patient profile module of ProjectWorlds Online Doctor Appointment Booking System 1.0. The

How CVE-2025-30177 Works This vulnerability exploits improper header filtering in Apache Camel’s Undertow component. The custom header filter strategy only

How the CVE Works CVE-2025-28395 exploits a buffer overflow vulnerability in the `ipsec_road_asp` function of D-LINK DI-8100 firmware version 16.07.26A1.

How CVE-2025-3181 Works The vulnerability exists in the `appointment.php` file of Online Doctor Appointment Booking System 1.0. The `scheduleDate` parameter

How CVE-2025-3182 Works The vulnerability exists in `/patient/getschedule.php` due to improper sanitization of the `q` parameter. An attacker can craft

How the CVE Works: The vulnerability in jsonschema2pojo (CVE-2025-XXXX) stems from improper bounds checking in the `SchemaRule.java` component when processing

How the CVE Works: Mattermost fails to clear cached authentication tokens when a user account is converted into a bot.

How the CVE Works: The vulnerability in Pleezer arises due to improper handling of hook scripts triggered by track changes

The CVE-2025-2783 vulnerability in CefSharp stems from an incorrect handle being provided in Mojo IPC (Inter-Process Communication) in Google Chrome

How the CVE Works The vulnerability in jupyter-remote-desktop-proxy arises due to improper access control in TigerVNC when used as the

How the CVE Works The vulnerability (CVE-2025-1234) in Formie allows attackers to inject malicious JavaScript code into email notification previews.

Mattermost versions 9.11.0 to 9.11.8 fail to enforce proper access controls on the `/api/v4/audits` endpoint. This vulnerability allows users with

The vulnerability (CVE-2024-1234) in SurrealDB’s command-line tool arises due to improper sanitization of table and field names during database exports.

How the Vulnerability Works SurrealDB’s `http::` functions allow authenticated users to make external network requests. When configured with –allow-net –deny-net,

How the CVE Works SurrealDB allows authenticated users with OWNER/EDITOR permissions to define custom functions via DEFINE FUNCTION. The function

How the CVE Works The vulnerability arises in SurrealDB when an authenticated user sends a malicious query containing the `string::replace`

How the CVE Works CVE-2023-34092 exploits improper request validation in Vite’s development server when running on Node.js or Bun. The

How the CVE Works The vulnerability in SurrealDB arises when a crafted HTTP query containing a null byte (%00) is

An authenticated user with root, namespace, or database-level privileges in SurrealDB can exploit the `DEFINE ANALYZER` statement to read arbitrary

How the CVE Works The vulnerability exists in the `qaic_validate_req()` function of the Linux kernel’s QAIC accelerator driver. Attackers can

The vulnerability CVE-2025-21997 in the Linux kernel arises from an integer overflow in the `xp_create_and_assign_umem()` function within the XDP (Express