exploit

How CVE-2025-25985 Works The vulnerability exists in Macro-video Technologies’ V380E6_C1 IP camera firmware version 1020302. A physically proximate attacker can

How the CVE Works The vulnerability exists in the `RP_pingGatewayByBBS` function within `/goform/RP_pingGatewayByBBS` in Linksys RE6500, RE6250, RE6300, RE6350, RE7000,

How the CVE Works The vulnerability (CVE-2025-5441) in Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 routers stems from improper

How the CVE Works The vulnerability exists in the `RP_checkCredentialsByBBS` function within `/goform/RP_checkCredentialsByBBS` in Linksys RE6500, RE6250, RE6300, RE6350, RE7000,

The vulnerability in Paragon Software products (e.g., Partition Manager, Hard Disk Manager) stems from improper input validation in the `biontdrv.sys`

How the CVE Works CVE-2025-24814 exploits a misconfiguration in Apache Solr’s FileSystemConfigSetService, the default component in standalone or user-managed mode.

How the CVE Works CVE-2025-48957 is a path traversal vulnerability in AstrBot versions 3.4.4 to 3.5.12. The flaw allows attackers

How the CVE Works: CVE-2024-1086 is a use-after-free vulnerability in the Linux kernel’s Netfilter subsystem, specifically in the `nf_tables` component.

The CVE-2025-XXXX vulnerability in Paragon Software products occurs when the kernel-mode driver fails to properly validate the `MappedSystemVa` pointer before

How the CVE Works CVE-2025-48827 exploits a vulnerability in vBulletin (versions 5.0.0–5.7.5 and 6.0.0–6.0.3) where unauthenticated users can bypass access

The CVE-2025-XXXX vulnerability in Paragon Partition Manager (version 17.9.1) stems from a null pointer dereference in `biontdrv.sys` due to an

The vulnerability (CVE-2025-XXXX) in Paragon Software products, including Paragon Partition Manager 17.9.1, stems from improper validation of user-supplied data length

How the CVE Works CVE-2025-48958 is an HTML Injection vulnerability in Froxlor’s customer account portal. Attackers can inject malicious HTML

How the CVE Works CVE-2025-2190 exploits improper certificate validation in the Transsnet Store mobile app (com.transsnet.store), allowing attackers to intercept

The CVE involves a heap-based out-of-bounds write vulnerability in the GPRS protocol implementation across multiple Samsung Exynos processors and modems.

How the CVE Works CVE-2025-3600 is an unsafe reflection vulnerability in Progress® Telerik® UI for AJAX (versions 2011.2.712 to 2025.1.218).

How the CVE Works The CVE-2025-47701 vulnerability in Drupal’s Restrict route by IP module (versions before 1.3.0) allows attackers to

The vulnerability in Samsung Exynos processors (including Mobile, Wearable, and Modem variants) stems from a missing length check in the

How CVE-2025-4493 Works The vulnerability stems from improper privilege assignment in PAM JIT (Just-In-Time) privilege sets within Devolutions Server. Due

How the CVE Works CVE-2025-48828 exploits vBulletin’s template engine by abusing PHP conditionals in templates. Attackers craft malicious template code

How the CVE Works CVE-2025-48206 is an XSS vulnerability in the ns_backup extension (up to v13.0.0) for TYPO3. The flaw

How the CVE Works The vulnerability arises in Free5GC v4.0.0 due to improper bounds checking in the AMF component when

The vulnerability in Samsung Exynos processors (including Mobile, Wearable, and Modem variants) stems from improper length validation in the NAS

How the CVE Works: CVE-2025-4415 is an XSS vulnerability in Drupal Piwik PRO caused by improper input sanitization during web

How the CVE Works CVE-2025-46701 exploits improper case sensitivity handling in Apache Tomcat’s CGI servlet. Attackers can bypass security constraints

How CVE-2025-4416 Works The CVE-2025-4416 vulnerability in Drupal’s Events Log Track module arises due to unrestricted resource allocation during event

How the CVE Works The vulnerability occurs in Allure 2’s `xunit-xml-plugin` due to insecure XML parsing. The plugin uses `DocumentBuilderFactory`

How CVE-2025-50349 Works The vulnerability exists in `update-teacher-pic.php` due to insufficient input validation. Attackers can manipulate file paths using `../`

How the CVE Works CVE-2025-50348 exploits a directory traversal vulnerability in PHPGurukul’s Pre-School Enrollment System (v1.0) via the `update-class-pic.php` component.

How CVE-2025-6404 Works The vulnerability exists in the `/admin/search.php` file of Campcodes Online Teacher Record Management System 1.0 where improper

How CVE-2025-6122 Works This vulnerability exists in the `/table.php` file of Restaurant Order System 1.0 where improper sanitization of the

How CVE-2025-48988 Works CVE-2025-48988 is a critical vulnerability in Apache Tomcat that allows attackers to exploit uncontrolled resource allocation. The

How the CVE Works CVE-2025-47438 is a PHP Local File Inclusion (LFI) vulnerability in WP Job Portal (versions up to

How the CVE Works CVE-2021-22931 is a critical remote code execution vulnerability in Node.js due to improper input validation in

How the CVE Works The vulnerability exists in the `/tablelow.php` file of Restaurant Order System 1.0 where improper sanitization of

How the CVE Works CVE-2025-6123 is a critical SQL injection vulnerability in Restaurant Order System 1.0, specifically in the `/payment.php`

How CVE-2025-6406 Works The vulnerability exists in the `/hms/forgot-password.php` file of Campcodes Online Hospital Management System 1.0. The `fullname` parameter

How the CVE Works CVE-2025-45475 is an SSRF vulnerability in maccms10’s Friend Link Management module. The flaw allows attackers to

How CVE-2025-6407 Works This critical SQL injection vulnerability exists in Campcodes Online Hospital Management System 1.0 within the `/user-login.php` file.

How CVE-2025-6408 Works The vulnerability exists in the `/doctor/search.php` file of Campcodes Online Hospital Management System 1.0 where improper sanitization

How the CVE Works: CVE-2023-30588 is an HTTP request smuggling vulnerability in Node.js due to improper parsing of chunked transfer

How the CVE Works CVE-2025-48746 exploits a missing authentication mechanism in Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 and

How CVE-2025-6409 Works The vulnerability exists in `/admin/forgot-password.php` due to improper sanitization of the `email` parameter. An attacker can inject

How the CVE Works CVE-2025-32752 affects Dell ThinOS versions 2502 and prior, where sensitive information is stored in cleartext within

How the CVE Works CVE-2025-46722 affects vLLM, an LLM inference engine, in versions 0.7.0 to 0.9.0. The vulnerability lies in

How the CVE Works CVE-2021-23343 is a prototype pollution vulnerability in Node.js versions before 16.4.1, 14.17.2, and 12.22.2. The issue

How the CVE Works CVE-2025-1234 affects Fastify versions 5.0.0 to 5.3.0 and 4.9.0, where applications using content-type-based validation can be

How the CVE Works CVE-2025-48942 is a DoS vulnerability in vLLM (0.8.0 to 0.9.0) triggered by sending a malformed `json_schema`

How the CVE Works CVE-2025-26319 exploits an insecure file upload mechanism in FlowiseAI Flowise v2.2.6. The vulnerability resides in the

How the CVE Works CVE-2025-27622 affects Jenkins 2.499 and earlier, including LTS 2.492.1 and earlier. The vulnerability occurs because Jenkins

How the CVE Works CVE-2025-27623 affects Jenkins 2.499 and earlier, including LTS 2.492.1, where encrypted secrets in `config.xml` are not

How the CVE Works CVE-2025-27624 is a CSRF vulnerability in Jenkins versions 2.499 and earlier (including LTS 2.492.1 and earlier).

How the CVE Works CVE-2025-27625 affects Jenkins versions 2.499 and earlier, including LTS 2.492.1. The vulnerability arises due to improper

How the CVE Works The vulnerability (CVE-2025-XXXXX) in Kubernetes occurs when the `DynamicResourceAllocation` feature gate is enabled. The `NodeRestriction` admission

How the CVE Works In Node.js versions 0.12 to 2.x, the `pbkdf2` library incorrectly processes `Uint8Array` inputs, silently substituting them

How the CVE Works The vulnerability occurs in the `pbkdf2-browserify` polyfill when non-standard or case-variant hash algorithms (e.g., sha3-256, SHA-1,

How the CVE Works: The vulnerability exists in the `gateway_proxy_handler` component of MLflow versions before 3.1.0. Due to insufficient validation

How the CVE Works The vulnerability CVE-2025-XXXXX in ChangeDetection.io arises due to insufficient input sanitization in the watch overview feature.

How the CVE Works The vulnerability (CVE-2025-XXXXX) in spytrap-adb before version 0.3.5 stems from a failure to display detected stalkerware

How the CVE Works The vulnerability stems from an improperly implemented connection limiter in letmein services (letmeind and letmeinfwd). The

How CVE-2025-3577 Works The vulnerability exists in the web management interface of Zyxel AMG1302-T10B firmware version 2.00(AAJC.16)C0. An authenticated attacker

How the CVE Works CVE-2025-25382 exploits a flawed payment validation mechanism in SANCHAYA v3.0.4’s Property Tax Payment Portal. Attackers craft

How CVE-2025-25908 Works The vulnerability exists in Tianti v2.3’s `//ajax/save` endpoint, where user-supplied input in the `coverImageURL` parameter is improperly

How CVE-2025-6143 Works The vulnerability exists in the `/boafrm/formNtp` endpoint of TOTOLINK EX1200T firmware version 4.1.2cu.5232_B20210713. When processing HTTP POST

How the CVE Works CVE-2025-27190 is an Improper Access Control vulnerability in Adobe Commerce that allows attackers to bypass security

How the CVE Works CVE-2025-6146 is a critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105. The flaw exists

How the CVE Works CVE-2025-28197 affects Crawl4AI versions <=0.4.247 due to improper input validation in /crawl4ai/async_dispatcher.py. The vulnerability allows attackers

How the CVE Works: The vulnerability in TOTOLINK EX1200T firmware version 4.1.2cu.5232_B20210713 stems from improper handling of HTTP POST requests

How the CVE Works CVE-2025-27893 exploits a flaw in Archer Platform (versions 6 to 6.14.00202.10024) where authenticated users with record

How the CVE Works The vulnerability in TOTOLINK EX1200T (4.1.2cu.5232_B20210713) stems from improper handling of HTTP POST requests in the

How the CVE Works CVE-2025-6147 is a critical buffer overflow vulnerability in TOTOLINK A702R firmware version 4.0.0-B20230721.1521. The flaw resides

How the CVE Works CVE-2025-25620 exploits a stored XSS vulnerability in UnifiedTransform 2.0’s “Create assignment” function. Attackers inject malicious JavaScript

How the CVE Works: CVE-2025-3795 is a stored XSS vulnerability in DaiCuo 1.3.13’s SEO Optimization Settings section. Attackers inject malicious

How the CVE Works CVE-2025-25614 exploits an incorrect access control flaw in UnifiedTransform 2.0, allowing teachers to escalate privileges and

How the CVE Works The vulnerability in TOTOLINK EX1200T (firmware 4.1.2cu.5232_B20210713) stems from improper handling of HTTP POST requests in

How the CVE Works CVE-2025-6165 is a critical buffer overflow vulnerability in TOTOLINK X15 firmware version 1.0.0-B20230714.1105. The flaw exists

How the CVE Works CVE-2025-26865 exploits improper neutralization of special elements in Apache OFBiz’s template engine, allowing server-side template injection

How the CVE Works: The vulnerability exists in Apache Camel’s default header filtering mechanism, which fails to properly block maliciously

How the CVE Works CVE-2025-6164 exploits a buffer overflow vulnerability in TOTOLINK A3002R firmware version 4.0.0-B20230531.1404. The flaw resides in

How the CVE Works CVE-2025-44022 exploits a flaw in vvveb CMS v1.0.6’s plugin mechanism, allowing attackers to upload malicious code

How the CVE Works CVE-2025-6163 is a critical buffer overflow vulnerability in TOTOLINK A3002RU firmware version 3.0.0-B20230809.1615. The flaw resides

How the CVE Works CVE-2025-46646 is a vulnerability in Artifex Ghostscript before version 10.05.0, where the `decode_utf8` function in `base/gp_utf8.c`

How CVE-2025-2123 Works The vulnerability in GeSHi (up to v1.0.9.1) resides in the `get_var` function within /contrib/cssgen.php. Improper sanitization of

How the CVE Works Vert.x 4.5.12 altered the behavior of duplicated context duplication. Previously, duplicating a context created an empty,

How the CVE Works CVE-2025-2149 affects PyTorch 2.6.0+cu124 in the `nnq_Sigmoid` function of the Quantized Sigmoid Module. The vulnerability arises

How the CVE Works CVE-2025-29547 is a null pointer dereference vulnerability in Rollback Rx Professional 12.8.0.0, specifically in the driver

How CVE-2025-2148 Works This critical vulnerability in PyTorch 2.6.0+cu124 stems from improper memory handling in the `torch.ops.profiler._call_end_callbacks_on_jit_fut` function when processing

How the CVE Works CVE-2025-21553 exploits a flaw in Oracle Database Server’s Java VM component, affecting versions 19.3-19.25, 21.3-21.16, and

How the CVE Works CVE-2025-21583 is a vulnerability in MySQL Server (versions 8.4.0 and 9.0.0) within the DDL (Data Definition

How the CVE Works CVE-2025-21568 is an access control vulnerability in Oracle Hyperion Data Relationship Management (version 11.2.19.0.000). The flaw

How the CVE Works CVE-2025-28056 exploits a SQL injection flaw in Rebuild CMS versions v3.9.0 through v3.9.3. The vulnerability resides

How the CVE Works CVE-2025-30691 is a vulnerability in Oracle Java SE’s compiler component, affecting versions 21.0.6 and 24, including

How the CVE Works CVE-2025-21552 is a critical vulnerability in Oracle JD Edwards EnterpriseOne Orchestrator (component: E1 IOT Orchestrator Security)

How the CVE Works CVE-2025-30721 is a vulnerability in MySQL Server’s User-Defined Function (UDF) component. It affects MySQL versions 8.0.0-8.0.41,

How the CVE Works CVE-2025-21557 is a Cross-Site Request Forgery (CSRF) vulnerability in Oracle Application Express (APEX) versions 23.2 and

How the CVE Works: CVE-2025-43946 exploits TCPWave DDI 11.34P1C2 by combining an unrestricted file upload vulnerability with path traversal. Attackers

How CVE-2025-21569 Works This vulnerability exists in the Web Services component of Oracle Hyperion Data Relationship Management (version 11.2.19.0.000). It

How CVE-2025-21495 Works This vulnerability exists in MySQL Enterprise Firewall due to improper handling of specially crafted network requests via

How CVE-2025-43947 Works CVE-2025-43947 exploits improper access control in Codemers KLIMS 1.6.DEV. The system fails to validate user roles before