exploit

How the CVE Works The vulnerability exists in Ibexa DXP’s Admin UI assets (versions 4.6.0-alpha1 to 4.6.20) due to improper

How the CVE Works The vulnerability exists in Ibexa DXP’s RichText Field Type (versions 4.6.0-beta1 to 4.6.20) due to improper

The CVE-2025-XXXX vulnerability in Ibexa eZ Platform’s Admin UI assets allows stored Cross-Site Scripting (XSS) attacks in the back office.

How CVE-2025-26846 Works CVE-2025-26846 is an improper access control vulnerability in Znuny versions before 7.1.4. The flaw resides in the

How the CVE Works The vulnerability exists in the `citizen-search-noresults-` and `citizen-search-noresults-desc` system messages, which are rendered as raw HTML

How CVE-2025-46986 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in certain form

How CVE-2025-46987 Works CVE-2025-46987 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier.

How CVE-2025-46988 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How the CVE Works: The vulnerability exists in `starcitizentools/citizen-skin` versions >= 2.13.0, < 3.3.1. User-controlled input in preference menu headings

How the CVE Works The vulnerability arises in the `Citizen` skin for MediaWiki, where user registration date messages (Language::userDate) are

How CVE-2025-46985 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in form fields,

How CVE-2025-46984 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in certain form fields,

How the CVE Works: CVE-2025-44830 is a SQL injection vulnerability in EngineerCMS versions 1.02 through 2.0.5. The flaw exists in

How the CVE Works The vulnerability exists in the `Menu.mustache` template of the Citizen-Skin for MediaWiki. System messages for menu

How CVE-2025-46846 Works CVE-2025-46846 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier.

How the CVE Works CVE-2025-46851 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The

How CVE-2025-46850 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-46837 Works This vulnerability exists due to insufficient input sanitization in form fields of Adobe Experience Manager (AEM) 6.5.22

How CVE-2025-46845 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in certain form

How CVE-2025-46843 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in form fields,

How CVE-2025-46874 Works CVE-2025-46874 is a reflected Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier.

How CVE-2025-46840 Works CVE-2025-46840 is an Improper Authorization flaw in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability

How CVE-2025-46838 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to sanitize user-supplied input in form fields, allowing attackers

How CVE-2025-46841 Works CVE-2025-46841 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier.

How CVE-2025-44868 Works: The vulnerability exists in the `adm.cgi` component of Wavlink WL-WN530H4 firmware version 20220801. The `ping_test` function improperly

How CVE-2025-46844 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in form fields,

How CVE-2025-46847 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-46842 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-46848 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-5593 Works The vulnerability in FreeFloat FTP Server 1.0 occurs in the HOST command handler due to improper bounds

How the CVE Works The CVE-2025-XXXXX vulnerability in vantage6 allows attackers to bypass brute-force protection when changing passwords. An authenticated

How the CVE Works The CVE-2025-XXXXX vulnerability in Vantage6 Server stems from its use of an auto-generated UUID1 as the

How CVE-2025-1799 Works The vulnerability in Zorlan SkyCaiji 2.9 arises from improper input validation in the `previewAction` function within vendor/skycaiji/app/admin/controller/Tool.php.

How the CVE Works: This vulnerability exploits improper input sanitization in XWiki’s REST API query endpoint when using Oracle databases.

How the Vulnerability Works CVE-2025-25426 exploits improper input sanitization in yshopmall’s image listing interface (<=v1.9.0). Attackers inject malicious SQL queries

How CVE-2025-46873 Works CVE-2025-46873 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier.

How CVE-2025-46865 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in form fields,

How CVE-2025-1791 Works The vulnerability in Zorlan SkyCaiji 2.9 stems from insufficient validation in the `fileAction` function within vendor/skycaiji/app/admin/controller/Tool.php. The

How CVE-2025-46886 Works This stored XSS vulnerability in Adobe Experience Manager (AEM) 6.5.22 and earlier allows attackers with low privileges

How CVE-2025-46859 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-46870 Works CVE-2025-46870 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier.

How CVE-2025-46857 Works CVE-2025-46857 is a reflected Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier.

How CVE-2025-46862 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-46853 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-46860 Works CVE-2025-46860 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers with

How CVE-2025-46866 Works CVE-2025-46866 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier.

How CVE-2025-46854 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in web form fields,

How CVE-2025-46861 Works CVE-2025-46861 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers with

How CVE-2025-46858 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in web form

How CVE-2025-46885 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in form fields,

How CVE-2025-46855 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-46883 Works The vulnerability exists in Adobe Experience Manager (AEM) versions 6.5.22 and earlier due to insufficient input sanitization

How CVE-2025-46872 Works Adobe Experience Manager (AEM) 6.5.22 and earlier fails to properly sanitize user-supplied input in form fields, allowing

How CVE-2025-46884 Works Adobe Experience Manager (AEM) versions 6.5.22 and earlier fail to properly sanitize user-supplied input in certain form

How CVE-2025-4327 Works This CSRF vulnerability in MRCMS 3.1.2 allows attackers to trick authenticated users into executing unintended actions via

FoxCMS v1.2.5 contains a SQL injection vulnerability in the `executeCommand` method within DataBackup.php. This flaw allows attackers to inject malicious

How the CVE Works: CVE-2025-45239 exploits a flaw in the `restores` method within `DataBackup.php` in FoxCMS v2.0.6. Attackers manipulate file

FoxCMS v1.2.5 contains an arbitrary file deletion vulnerability in the `delRestoreSerie` method due to insufficient input validation. Attackers can exploit

How CVE-2025-2048 Works The Lana Downloads Manager plugin (before v1.10.0) fails to sanitize user-controlled input in file download requests. Admin-level

How CVE-2025-26842 Works CVE-2025-26842 is an information disclosure vulnerability in Znuny (up to v7.1.3) where unauthorized users can access S/MIME

How CVE-2025-4329 Works CVE-2025-4329 is a path traversal vulnerability in 74CMS versions up to 3.33.0. The flaw exists in the

How CVE-2025-26844 Works CVE-2025-26844 affects Znuny up to version 7.1.3 by failing to set the `HttpOnly` flag on session cookies.

How the CVE Works CVE-2025-44073 exploits a SQL injection vulnerability in SeaCMS v13.3 via the `admin_comment_news.php` component. Attackers manipulate user-supplied

How CVE-2025-4980 Works The vulnerability in Netgear DGND3700 firmware version 1.1.00.15_1.00.15NA resides in the `mini_http` component, specifically within the `/currentsetting.htm`

How CVE-2025-44108 Works This stored XSS vulnerability in Flatpress CMS (before v1.4) allows authenticated attackers (with admin access) to inject

How CVE-2025-4978 Works This critical vulnerability in Netgear DGND3700 (v1.1.00.15_1.00.15NA) stems from weak authentication in /BRS_top.html. Attackers bypass Basic Authentication

How CVE-2025-43714 Works CVE-2025-43714 exploits ChatGPT’s improper handling of SVG files by rendering them inline instead of treating them as

How CVE-2025-3908 Works CVE-2025-3908 is a local privilege escalation vulnerability in OpenVPN 3 Linux (v20-v24) due to insecure handling of

How CVE-2025-4940 Works This vulnerability exploits improper input sanitization in the `/admin_info.php` file, specifically in the `batch` parameter. Attackers can

How CVE-2025-30072 Works The Tiiwee X1 Alarm System (TWX1HAKV2) suffers from an authentication bypass vulnerability due to improper handling of

How CVE-2025-3582 Works The Newsletter plugin (before v8.85) for WordPress fails to sanitize and escape form settings, allowing admins to

How CVE-2025-4905 Works The vulnerability exists in the `load_qc_pickl` function within basestation3/QC.py, where unsafe deserialization occurs via the `qc_file` argument.

How CVE-2025-28203 Works The Victure RX1800 EN_V1.0.0_r12_110933 firmware contains an unsanitized user input vulnerability in its web management interface. Attackers

How CVE-2025-26086 Works The vulnerability occurs in RSI Queue Management System v3.0’s task handling component. When processing GET requests containing

How the CVE Works CVE-2025-22157 is a privilege escalation flaw in Jira Core and Service Management (Data Center & Server)

How CVE-2025-4999 Works The vulnerability exists in the `sub_4153FC` function within `/cgi-bin/sysconf.cgi` of Linksys FGW3000-AH and FGW3000-HK firmware up to

How CVE-2025-28371 Works The EnGenius ENH500 AP 2T2R V3.0 running firmware FW3.7.22 fails to enforce proper authentication checks during password

How CVE-2025-5000 Works The vulnerability exists in the `control_panel_sw` function within `/cgi-bin/sysconf.cgi` of Linksys FGW3000-AH and FGW3000-HK firmware versions up

How CVE-2025-2929 Works The Order Delivery Date WordPress plugin (pre-12.4.0) fails to sanitize user-supplied input in the `delivery_date` parameter before

How CVE-2025-41231 Works CVE-2025-41231 is a missing authorization flaw in VMware Cloud Foundation that allows attackers with local access to

How CVE-2025-4977 Works This vulnerability in Netgear DGND3700 firmware version 1.1.00.15_1.00.15NA allows remote attackers to access sensitive data via /BRS_top.html.

How the CVE Works: CVE-2025-33053 is a critical vulnerability in Microsoft Windows WebDAV (Web Distributed Authoring and Versioning) that allows

How the CVE Works CVE-2025-47885 is a stored Cross-Site Scripting (XSS) vulnerability in the Jenkins Health Advisor by CloudBees Plugin

FluxBB 1.5.11 suffers from a stored Cross-Site Scripting (XSS) vulnerability in the Forum Description Field within admin_forums.php. The flaw arises

How CVE-2025-47888 Works The Jenkins DingTalk Plugin (v2.7.3 and earlier) fails to enforce SSL/TLS certificate and hostname validation when establishing

How CVE-2025-47884 Works The vulnerability in Jenkins OpenID Connect Provider Plugin (versions ≤ 96.vee8ed882ec4d) stems from insecure handling of environment

How the CVE Works CVE-2025-47886 is a critical CSRF flaw in Jenkins Cadence vManager Plugin (v4.0.1-286.v9e25a_740b_a_48 and earlier). Attackers craft

How CVE-2025-47887 Works The vulnerability in Jenkins Cadence vManager Plugin (v4.0.1-286.v9e25a_740b_a_48 and earlier) stems from insufficient permission validation. Attackers with

How CVE-2025-47889 Works The vulnerability exists in the WSO2 OAuth Plugin (v1.0 and earlier) for Jenkins, where the security realm

How the CVE Works CVE-2025-48051 exploits an insecure `innerHTML` usage in `powertip.ts` within Lila (Lichess’s framework). The vulnerability occurs when

How CVE-2025-46052 Works This vulnerability exists in WebERP v4.15.2 due to improper input sanitization in the `StockCounts.php` script. Attackers can

How CVE-2025-4541 Works The vulnerability exists in the `manageZt` function within `c\admin\ZtAction.class.php` of LmxCMS 1.41. The `sortid` parameter passed via

How the Vulnerability Works CVE-2025-46053 is a critical SQL Injection flaw in WebERP v4.15.2, allowing attackers to manipulate database queries

How CVE-2025-32354 Works CVE-2025-32354 exploits Zimbra Collaboration Suite (ZCS) versions 9.0 to 10.1 via a missing CSRF token validation in

How the CVE Works The vulnerability in Erlang/OTP’s SSH server (CVE-2025-XXXX) allows unauthenticated attackers to execute arbitrary code due to

How CVE-2025-24016 Works The vulnerability exists in Wazuh’s DistributedAPI due to unsafe deserialization of JSON data in framework/wazuh/core/cluster/common.py. When processing

How the CVE Works CVE-2025-25065 is an SSRF vulnerability in Zimbra Collaboration’s RSS feed parser, affecting versions 9.0.0 (before Patch

How the Vulnerability Works The Citizen skin for MediaWiki fails to properly sanitize multiple system messages before inserting them into

How the CVE Works The vulnerability (CVE-2025-XXXX) in Drupal Lightgallery arises from improper input sanitization in the image gallery module.

How the CVE Works: The CVE-2025-XXXX vulnerability in Drupal’s Quick Node Block module (versions before 2.0.0) stems from improper access