exploit

How CVE-2025-5912 Works The vulnerability exists in the `do_file` function of the HTTP POST request handler in D-Link DIR-632 firmware

The CVE-2025-XXXXX vulnerability in Apache Tomcat arises due to improper handling of multipart file uploads, leading to a denial-of-service (DoS)

How the CVE Works The vulnerability exists in `/admin/search-vehicle.php` due to improper sanitization of the `searchinputdata` parameter. Attackers can inject

How the CVE Works CVE-2025-5130 is a critical vulnerability in Tmall Demo (up to version 20250505) affecting the `uploadProductImage` function

How the CVE Works CVE-2025-49710 is an integer overflow vulnerability in the `OrderedHashTable` component of Firefox’s JavaScript engine. When processing

How the CVE Works CVE-2025-5908 is a critical buffer overflow vulnerability in TOTOLINK EX1200T routers (up to firmware version 4.1.2cu.5232_B20210713).

How the CVE Works The vulnerability arises due to improper validation of the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter in Liferay Portal (versions 7.0.0–7.4.3.4,

The vulnerability in Teleport allows remote attackers to bypass authentication mechanisms due to improper validation of session tokens during the

This vulnerability in Apache Tomcat allows attackers to bypass security constraints for `PreResources` or `PostResources` when these resources are mounted

How the CVE Works The vulnerability in AssamLook CMS 1.0 arises from improper input sanitization in the `/product.php` file, specifically

How the CVE Works: CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Server 2.4.49. The flaw arises due to

How the CVE Works: CVE-2025-5910 is a critical buffer overflow vulnerability in TOTOLINK EX1200T routers (up to firmware version 4.1.2cu.5232_B20210713).

How the CVE Works CVE-2025-48446 is an incorrect authorization flaw in Drupal Commerce Alphabank Redirect (versions before 1.0.3). The vulnerability

How the CVE Works CVE-2025-27754 is a stored Cross-Site Scripting (XSS) vulnerability in the RSBlog! component (versions 1.11.6 to 1.14.4)

How the CVE Works The vulnerability in TOTOLINK EX1200T (up to v4.1.2cu.5232_B20210713) stems from improper bounds checking in the `/boafrm/formFilter`

How the CVE Works: The vulnerability exists in Liferay Portal’s `SessionClicks` component, which fails to restrict the storage of arbitrary

How the CVE Works The vulnerability in TOTOLINK EX1200T (up to version 4.1.2cu.5232_B20210713) resides in the `/boafrm/formReflashClientTbl` endpoint, which handles

How the CVE Works CVE-2025-48445 is an incorrect authorization flaw in Drupal Commerce Eurobank (Redirect) module, allowing functionality misuse. The

Liferay Portal fails to restrict the depth of GraphQL queries, enabling attackers to craft excessively nested queries. This flaw allows

How the CVE Works CVE-2025-49709 is a memory corruption flaw in Firefox (< 139.0.4) caused by improper handling of certain

How the CVE Works The vulnerability in Apache Commons FileUpload arises due to insufficient limits on multipart header allocations during

How the CVE Works CVE-2025-5357 is a critical buffer overflow vulnerability in FreeFloat FTP Server 1.0, specifically in the PWD

How the CVE Works The vulnerability in TOTOLINK EX1200T (up to v4.1.2cu.5232_B20210713) stems from improper bounds checking in the `/boafrm/formDMZ`

How the CVE Works CVE-2025-47045 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers

How the CVE Works CVE-2025-36528 is an authenticated SQL injection vulnerability in ManageEngine ADAudit Plus (versions 8510 and prior). Attackers

How the CVE Works CVE-2025-41407 is a SQL injection vulnerability in Zoho Corp’s ManageEngine ADAudit Plus versions below 8511. The

How the CVE Works CVE-2025-41444 is an authenticated SQL injection vulnerability in ManageEngine ADAudit Plus (versions 8510 and prior). Attackers

How the CVE Works CVE-2025-41403 is an authenticated SQL injection vulnerability in ManageEngine ADAudit Plus (versions 8510 and prior). Attackers

How the CVE Works CVE-2025-3834 is an authenticated SQL injection vulnerability in ManageEngine ADAudit Plus (versions 8510 and prior). Attackers

How the CVE Works CVE-2025-47049 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and

How the CVE Works CVE-2025-47047 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A

How the CVE Works: CVE-2025-36527 exploits improper input sanitization in the report export feature of ManageEngine ADAudit Plus (versions <

How the CVE Works The vulnerability in AssamLook CMS 1.0 resides in /view_tender.php, where improper sanitization of the `ID` parameter

How CVE-2025-5979 Works This vulnerability exists in the School Fees Payment System 1.0 within the /branch.php file. Attackers can exploit

How the CVE Works When a new user logs in via SSH on an Ubuntu system using authd, the authentication

How the CVE Works CVE-2025-5971 is a critical SQL injection vulnerability in Code-Projects School Fees Payment System 1.0, affecting the

How CVE-2025-47048 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in certain form

How the CVE Works The vulnerability in protobuf-python arises when parsing untrusted Protocol Buffers data containing deeply nested recursive groups

How the CVE Works CVE-2025-3836 is an authenticated SQL injection vulnerability in ManageEngine ADAudit Plus (versions 8510 and prior). Attackers

How the CVE Works CVE-2025-27709 is an authenticated SQL injection vulnerability in ManageEngine ADAudit Plus (versions 8510 and prior). Attackers

How the CVE Works The vulnerability in pycares arises due to improper handling of callback references during garbage collection of

The CVE-2025-46060 vulnerability in TOTOLINK N600R routers involves a buffer overflow in the UPLOAD_FILENAME component. When processing file upload requests,

How the CVE Works CVE-2025-47044 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient

How the CVE Works CVE-2025-47016 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A

How CVE-2025-47004 Works CVE-2025-47004 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers with

How the CVE Works CVE-2025-47017 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient

How CVE-2025-47039 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored XSS vulnerability in form fields. A

How the CVE Works CVE-2025-47020 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient

How the CVE Works CVE-2025-47021 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers

How the CVE Works CVE-2025-5900 is a CSRF vulnerability in Tenda AC9 firmware version 15.03.02.13. The flaw allows an attacker

How CVE-2025-47040 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier suffer from a stored XSS vulnerability in form fields.

How the CVE Works Weblate, an open-source translation platform, lacks rate limiting during second-factor authentication (2FA) verification. Attackers with valid

How CVE-2025-47019 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in certain form

How CVE-2025-47007 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored XSS vulnerability in form fields. Attackers

How the CVE Works: CVE-2025-47013 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A

How the CVE Works CVE-2025-47010 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A

How CVE-2025-47014 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in form fields.

How the CVE Works The vulnerability in Weblate (CVE-2025-XXXX) exposes users’ personal IP addresses through audit log notifications sent via

How the CVE Works CVE-2025-47011 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A

How CVE-2025-47006 Works CVE-2025-47006 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers with

How CVE-2025-47015 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in form fields,

How the CVE Works CVE-2025-47008 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A

How the CVE Works CVE-2025-47012 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A

How the CVE-2025-47005 Works CVE-2025-47005 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers

How the CVE Works The vulnerability in TOTOLINK T10 (4.1.8cu.5207) resides in the `UploadCustomModule` function within /cgi-bin/cstecgi.cgi. A buffer overflow

How the CVE Works CVE-2025-4428 is a critical remote code execution (RCE) vulnerability in Ivanti Endpoint Manager Mobile (EPMM) versions

How the CVE Works CVE-2025-4632 is a path traversal vulnerability in Samsung MagicINFO 9 Server versions before 21.1052. The flaw

How the CVE Works: CVE-2021-23343 is a prototype pollution vulnerability in Node.js `http` module. The flaw arises when user-supplied input

How the CVE Works CVE-2025-4427 is an authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior.

The CVE-2025-XXXX vulnerability in OpenC3 COSMOS 6.0.0 arises from insufficient input validation in the `openc3-api/tables` endpoint. Attackers can manipulate file

How the CVE Works CVE-2025-46965 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A

How the CVE Works CVE-2025-5906 is a critical authentication bypass vulnerability in Laundry System 1.0, affecting an unknown component within

How the CVE Works CVE-2025-46960 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient

How the CVE Works CVE-2025-46963 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers

How the CVE Works: CVE-2025-5020 is a URL spoofing vulnerability in Firefox for iOS (< v139). Attackers could craft malicious

How the CVE Works CVE-2025-46953 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to improper

How the CVE Works The vulnerability exploits Thunderbird’s update mechanism, where a medium-integrity user process can interfere with the SYSTEM-level

How the CVE Works CVE-2025-26241 is a SQL injection vulnerability in osTicket <=1.17.5, specifically in the “Search” function of tickets.php.

How the CVE Works The vulnerability in Open5GS (up to v2.7.3) resides in the NGAP PathSwitchRequest message handler (src/smf/ngap-handler.c). The

How the CVE Works The vulnerability in phpwcms (up to versions 1.9.45/1.10.8) resides in the Feedimport Module’s `include/inc_module/mod_feedimport/inc/processing.inc.php` file. Attackers

How the CVE Works CVE-2025-3523 exploits Thunderbird’s handling of email attachments with external links. When an email contains multiple attachments

How the CVE Works CVE-2025-46964 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient

How the CVE Works: The vulnerability occurs when Salt’s “on-demand pillar” data is requested, triggering the `VirtKey` class. This class

How the CVE Works The vulnerability exists in SaltStack’s GitFS `find_file` method, where user-controlled input from the `tgt_env` variable is

The CVE-2025-XXXXX vulnerability in MCP Inspector arises due to the lack of authentication between the Inspector client and proxy server.

How the CVE Works The vulnerability resides in SaltStack’s Master `pub_ret` method, which processes job IDs (jid) from minions without

How the CVE Works The vulnerability (CVE-2025-XXXX) in SaltStack stems from insufficient path validation in the `recv_file` method, allowing attackers

How the CVE Works: The vulnerability in Salt’s `salt.auth.pki` module stems from improper caller authentication. The module validates the “password”

How the CVE Works This vulnerability exploits a flaw in SaltStack’s minion event bus authorization mechanism. Attackers with a compromised

How the CVE Works: The vulnerability (CVE-2025-XXXX) in SaltStack allows an authenticated minion to inject arbitrary events into the Salt

The CVE-2025-XXXXX vulnerability in `handcraftedinthealps/goodby-csv` involves a gadget chain that could enable remote code execution (RCE) under specific conditions. This

How the CVE Works The vulnerability exists in SaltStack’s ‘on demand’ pillar functionality, which allows minions to request pillar data

How the CVE Works The vulnerability (CVE-2025-XXXXX) in SaltStack allows directory traversal attacks during minion file cache creation. The master’s

How the CVE Works The vulnerability arises when an attacker with edit rights on an App Within Minutes (AWM) application

XWiki fails to enforce proper rights warnings for `NotificationDisplayer` objects, leading to a stored XSS vulnerability. When a low-privileged user

How the CVE Works The vulnerability arises when an attacker with edit rights but no script/programming rights creates an XClass

How the CVE Works: The vulnerability in XWiki allows unauthorized access to page s through the REST API, even for

How the CVE Works XWiki versions 15.9-rc-1 to 16.4.6, 16.5.0-rc-1 to 16.10.2, and 17.0.0-rc-1 are vulnerable due to incomplete rights

XWiki allows remote code execution through insecure handling of default values in wiki macro parameters. The vulnerability occurs when a

This CVE involves XWiki failing to warn administrators when granting `XWiki.Notifications.Code.NotificationEmailRendererClass` admin rights. When a user without script rights creates