Thu, Aug 28 · 06:15 PM CDTCVE-2025-58048
9.9/10 · Must read/watchNVDvuln
Summary
Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files
CVECVE-2025-58048
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 28 · 06:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-1999-0199
9.8/10 · Must read/watchNVDvuln
Summary
manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.
CVECVE-1999-0199
SeverityCRITICAL
TypeUPDATED
PublishedTue, Oct 06 · 01:15 PM CDT
ModifiedFri, Sep 25 · 08:10 PM CDT
CVE-2025-10220
9.8/10 · Must read/watchNVDvuln
Summary
Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages such as Google.Protobuf, DynamicData, Syst
CVECVE-2025-10220
SeverityCRITICAL
TypeUPDATED
PublishedWed, Sep 10 · 01:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-34520
9.8/10 · Must read/watchNVDvuln
Summary
An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts. By manipulating specific request parameters or exploiting a logic flaw, an attacker can bypass login mechanisms without valid credent
CVECVE-2025-34520
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 27 · 10:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-34522
9.8/10 · Must read/watchNVDvuln
Summary
A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without authentication by sending specially crafted input to the target system. Improper bounds checking allows an attacker to overwrite heap memory, potentially leading to
CVECVE-2025-34522
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 27 · 10:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-34523
9.8/10 · Must read/watchNVDvuln
Summary
A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted data, a remote attack
CVECVE-2025-34523
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 27 · 10:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-54725
9.8/10 · Must read/watchNVDvuln
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through <= 1.7.0.
CVECVE-2025-54725
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 28 · 01:16 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-54738
9.8/10 · Must read/watchNVDvuln
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Jobmonster: from n/a through <= 4.7.9.
CVECVE-2025-54738
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 28 · 01:16 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-57819
9.8/10 · Must read/watchNVDvuln
Summary
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in e
CVECVE-2025-57819
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 28 · 05:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9994
9.8/10 · Must read/watchNVDvuln
Summary
The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access.
CVECVE-2025-9994
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-54720
9.3/10 · Must read/watchNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons nest-addons allows SQL Injection.This issue affects Nest Addons: from n/a through <= 1.6.3.
CVECVE-2025-54720
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 28 · 01:16 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9943
9.1/10 · Must read/watchNVDvuln
Summary
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of
CVECVE-2025-9943
SeverityCRITICAL
TypeUPDATED
PublishedWed, Sep 10 · 07:15 AM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-30264
8.8/10 · Worth your timeNVDvuln
Summary
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and lat
CVECVE-2025-30264
SeverityHIGH
TypeUPDATED
PublishedFri, Aug 29 · 06:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-54742
8.8/10 · Worth your timeNVDvuln
Summary
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 4.4.8.
CVECVE-2025-54742
SeverityHIGH
TypeUPDATED
PublishedThu, Aug 28 · 01:16 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9779
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was detected in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this vulnerability is the function sub_4162DC of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVECVE-2025-9779
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 01 · 01:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9780
8.8/10 · Worth your timeNVDvuln
Summary
A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the function sub_419BE0 of the file /boafrm/formIpQoS. This manipulation of the argument mac causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
CVECVE-2025-9780
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 01 · 01:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9781
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability has been found in TOTOLINK A702R 4.0.0-B20211108.1423. This affects the function sub_4162DC of the file /boafrm/formFilter. Such manipulation of the argument ip6addr leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVECVE-2025-9781
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 01 · 02:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9782
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was found in TOTOLINK A702R 4.0.0-B20211108.1423. This vulnerability affects the function sub_4466F8 of the file /boafrm/formOneKeyAccessButton. Performing manipulation of the argument submit-url results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could
CVECVE-2025-9782
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 01 · 02:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9783
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423. This issue affects the function sub_418030 of the file /boafrm/formParentControl. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be
CVECVE-2025-9783
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 01 · 03:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9791
8.8/10 · Worth your timeNVDvuln
Summary
A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of the argument wanMTU causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and cou
CVECVE-2025-9791
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 01 · 07:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9812
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVECVE-2025-9812
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 02 · 03:15 AM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9813
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVECVE-2025-9813
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 02 · 05:15 AM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9866
8.8/10 · Worth your timeNVDvuln
Summary
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2025-9866
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 03 · 05:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-9872
8.8/10 · Worth your timeNVDvuln
Summary
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.
CVECVE-2025-9872
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 09 · 04:15 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
CVE-2025-8067
8.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifyi
CVECVE-2025-8067
SeverityHIGH
TypeUPDATED
PublishedThu, Aug 28 · 03:16 PM CDT
ModifiedSat, Sep 26 · 12:10 AM CDT
