Instruction: Please provide detailed information about CVE-2025-23581

CVE:CVE-2025-23581
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Zoom Studio Demo User DZS allows Stored XSS. This issue affects Demo User DZS: from n/a through 1.1.0.
published:2025-02-03T15:15:21.107


Instruction: Please provide detailed information about CVE-2025-23582

CVE:CVE-2025-23582
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haider Ali Bulk Categories Assign allows Reflected XSS. This issue affects Bulk Categories Assign: from n/a through 1.0.
published:2025-02-03T15:15:21.247


Instruction: Please provide detailed information about CVE-2025-23588

CVE:CVE-2025-23588
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WOW WordPress WOW Best CSS Compiler allows Reflected XSS. This issue affects WOW Best CSS Compiler: from n/a through 2.0.2.
published:2025-02-03T15:15:21.387


Instruction: Please provide detailed information about CVE-2025-23590

CVE:CVE-2025-23590
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Burtay Arat Dezdy allows Reflected XSS. This issue affects Dezdy: from n/a through 1.0.
published:2025-02-03T15:15:21.530


Instruction: Please provide detailed information about CVE-2025-23591

CVE:CVE-2025-23591
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blu Logistics Pte. Ltd. blu Logistics allows Reflected XSS. This issue affects blu Logistics: from n/a through 1.0.0.
published:2025-02-03T15:15:21.680


Instruction: Please provide detailed information about CVE-2025-23593

CVE:CVE-2025-23593
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound EmailPress allows Reflected XSS. This issue affects EmailPress: from n/a through 1.0.
published:2025-02-03T15:15:21.827


Instruction: Please provide detailed information about CVE-2025-23594

CVE:CVE-2025-23594
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uzzal mondal Google Map With Fancybox allows Reflected XSS. This issue affects Google Map With Fancybox: from n/a through 2.1.0.
published:2025-02-03T15:15:21.980


Instruction: Please provide detailed information about CVE-2025-23599

CVE:CVE-2025-23599
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound eMarksheet allows Reflected XSS. This issue affects eMarksheet: from n/a through 5.0.
published:2025-02-03T15:15:22.127


Instruction: Please provide detailed information about CVE-2025-23614

CVE:CVE-2025-23614
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nik Sudan WordPress Additional Logins allows Reflected XSS. This issue affects WordPress Additional Logins: from n/a through 1.0.0.
published:2025-02-03T15:15:22.270


Instruction: Please provide detailed information about CVE-2025-23685

CVE:CVE-2025-23685
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound RomanCart allows Reflected XSS. This issue affects RomanCart: from n/a through 0.0.2.
published:2025-02-03T15:15:22.420


Instruction: Please provide detailed information about CVE-2025-23747

CVE:CVE-2025-23747
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitesh Singh Awesome Timeline allows Stored XSS. This issue affects Awesome Timeline: from n/a through 1.0.1.
published:2025-02-03T15:15:22.557


Instruction: Please provide detailed information about CVE-2025-23755

CVE:CVE-2025-23755
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PAFacile allows Reflected XSS. This issue affects PAFacile: from n/a through 2.6.1.
published:2025-02-03T15:15:22.697


Instruction: Please provide detailed information about CVE-2025-23799

CVE:CVE-2025-23799
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in .TUBE gTLD .TUBE Video Curator allows Reflected XSS. This issue affects .TUBE Video Curator: from n/a through 1.1.9.
published:2025-02-03T15:15:22.843


Instruction: Please provide detailed information about CVE-2025-23819

CVE:CVE-2025-23819
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound WP Cloud allows Absolute Path Traversal. This issue affects WP Cloud: from n/a through 1.4.3.
published:2025-02-03T15:15:23.020


Instruction: Please provide detailed information about CVE-2025-23920

CVE:CVE-2025-23920
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApplicantPro ApplicantPro allows Reflected XSS. This issue affects ApplicantPro: from n/a through 1.3.9.
published:2025-02-03T15:15:23.173


Instruction: Please provide detailed information about CVE-2025-23923

CVE:CVE-2025-23923
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Lockets allows Reflected XSS. This issue affects Lockets: from n/a through 0.999.
published:2025-02-03T15:15:23.333


Instruction: Please provide detailed information about CVE-2025-23984

CVE:CVE-2025-23984
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainvireinfo Dynamic URL SEO allows Reflected XSS. This issue affects Dynamic URL SEO: from n/a through 1.0.
published:2025-02-03T15:15:23.480


Instruction: Please provide detailed information about CVE-2025-24536

CVE:CVE-2025-24536
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThriveDesk ThriveDesk allows Reflected XSS. This issue affects ThriveDesk: from n/a through 2.0.6.
published:2025-02-03T15:15:23.640


Instruction: Please provide detailed information about CVE-2025-24541

CVE:CVE-2025-24541
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emili Castells DK White Label allows Reflected XSS. This issue affects DK White Label: from n/a through 1.0.
published:2025-02-03T15:15:23.810


Instruction: Please provide detailed information about CVE-2025-24544

CVE:CVE-2025-24544
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandros Georgiou Bitcoin and Altcoin Wallets allows Reflected XSS. This issue affects Bitcoin and Altcoin Wallets: from n/a through 6.3.1.
published:2025-02-03T15:15:23.990


Instruction: Please provide detailed information about CVE-2025-24545

CVE:CVE-2025-24545
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BannerSky.com BSK Forms Validation allows Reflected XSS. This issue affects BSK Forms Validation: from n/a through 1.7.
published:2025-02-03T15:15:24.177


Instruction: Please provide detailed information about CVE-2025-24556

CVE:CVE-2025-24556
Description:Insertion of Sensitive Information into Log File vulnerability in DualCube MooWoodle allows Retrieve Embedded Sensitive Data. This issue affects MooWoodle: from n/a through 3.2.4.
published:2025-02-03T15:15:24.360


Instruction: Please provide detailed information about CVE-2025-24557

CVE:CVE-2025-24557
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware.com PlainInventory allows Reflected XSS. This issue affects PlainInventory: from n/a through 3.1.5.
published:2025-02-03T15:15:24.660


Instruction: Please provide detailed information about CVE-2025-24559

CVE:CVE-2025-24559
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster allows Reflected XSS. This issue affects WP Mailster: from n/a through 1.8.15.0.
published:2025-02-03T15:15:25.093


Instruction: Please provide detailed information about CVE-2025-24569

CVE:CVE-2025-24569
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RedefiningTheWeb PDF Generator Addon for Elementor Page Builder allows Path Traversal. This issue affects PDF Generator Addon for Elementor Page Builder: from n/a through 1.7.5.
published:2025-02-03T15:15:25.590


Instruction: Please provide detailed information about CVE-2025-24574

CVE:CVE-2025-24574
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev WooCommerce Receipt Uploader allows Reflected XSS. This issue affects PeproDev WooCommerce Receipt Uploader: from n/a through 2.6.9.
published:2025-02-03T15:15:26.013


Instruction: Please provide detailed information about CVE-2025-24576

CVE:CVE-2025-24576
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fatcat Apps Landing Page Cat allows Reflected XSS. This issue affects Landing Page Cat: from n/a through 1.7.7.
published:2025-02-03T15:15:26.310


Instruction: Please provide detailed information about CVE-2025-24605

CVE:CVE-2025-24605
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in realmag777 WOLF allows Path Traversal. This issue affects WOLF: from n/a through 1.0.8.5.
published:2025-02-03T15:15:26.473


Instruction: Please provide detailed information about CVE-2025-24620

CVE:CVE-2025-24620
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound AIO Shortcodes allows Stored XSS. This issue affects AIO Shortcodes: from n/a through 1.3.
published:2025-02-03T15:15:26.697


Instruction: Please provide detailed information about CVE-2025-24629

CVE:CVE-2025-24629
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPGear Import Excel to Gravity Forms allows Reflected XSS. This issue affects Import Excel to Gravity Forms: from n/a through 1.18.
published:2025-02-03T15:15:27.163


Instruction: Please provide detailed information about CVE-2025-24630

CVE:CVE-2025-24630
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Sikshya LMS allows Reflected XSS. This issue affects Sikshya LMS: from n/a through 0.0.21.
published:2025-02-03T15:15:27.730


Instruction: Please provide detailed information about CVE-2025-24631

CVE:CVE-2025-24631
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PhiloPress BP Email Assign Templates allows Reflected XSS. This issue affects BP Email Assign Templates: from n/a through 1.5.
published:2025-02-03T15:15:28.023


Instruction: Please provide detailed information about CVE-2025-24639

CVE:CVE-2025-24639
Description:Insertion of Sensitive Information Into Sent Data vulnerability in GREYS Korea for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects Korea for WooCommerce: from n/a through 1.1.11.
published:2025-02-03T15:15:28.190


Instruction: Please provide detailed information about CVE-2025-24642

CVE:CVE-2025-24642
Description:Missing Authorization vulnerability in theme funda Setup Default Featured Image allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Setup Default Featured Image: from n/a through 1.2.
published:2025-02-03T15:15:28.370


Instruction: Please provide detailed information about CVE-2025-24643

CVE:CVE-2025-24643
Description:Missing Authorization vulnerability in Amento Tech Pvt ltd WPGuppy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPGuppy: from n/a through 1.1.0.
published:2025-02-03T15:15:28.537


Instruction: Please provide detailed information about CVE-2025-24646

CVE:CVE-2025-24646
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maxim Glazunov XML for Avito allows Reflected XSS. This issue affects XML for Avito: from n/a through 2.5.2.
published:2025-02-03T15:15:28.703


Instruction: Please provide detailed information about CVE-2025-24656

CVE:CVE-2025-24656
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Realtyna Realtyna Provisioning allows Reflected XSS. This issue affects Realtyna Provisioning: from n/a through 1.2.2.
published:2025-02-03T15:15:28.880


Instruction: Please provide detailed information about CVE-2025-24660

CVE:CVE-2025-24660
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages allows Reflected XSS. This issue affects Simple Membership Custom Messages: from n/a through 2.4.
published:2025-02-03T15:15:29.287


Instruction: Please provide detailed information about CVE-2025-24661

CVE:CVE-2025-24661
Description:Deserialization of Untrusted Data vulnerability in MagePeople Team Taxi Booking Manager for WooCommerce allows Object Injection. This issue affects Taxi Booking Manager for WooCommerce: from n/a through 1.1.8.
published:2025-02-03T15:15:29.547


Instruction: Please provide detailed information about CVE-2025-24676

CVE:CVE-2025-24676
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metatagg Inc Custom WP Store Locator allows Reflected XSS. This issue affects Custom WP Store Locator: from n/a through 1.4.7.
published:2025-02-03T15:15:29.750


Instruction: Please provide detailed information about CVE-2025-24684

CVE:CVE-2025-24684
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader allows Reflected XSS. This issue affects Media Downloader: from n/a through 0.4.7.5.
published:2025-02-03T15:15:29.913


Instruction: Please provide detailed information about CVE-2025-24697

CVE:CVE-2025-24697
Description:Missing Authorization vulnerability in Realwebcare Image Gallery – Responsive Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Gallery – Responsive Photo Gallery: from n/a through 1.0.5.
published:2025-02-03T15:15:30.090


Instruction: Please provide detailed information about CVE-2025-24707

CVE:CVE-2025-24707
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3 Photo Gallery Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery allows Reflected XSS. This issue affects Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery: from n/a through 2.7.7.24.
published:2025-02-03T15:15:30.253


Instruction: Please provide detailed information about CVE-2025-24781

CVE:CVE-2025-24781
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WPJobBoard allows Reflected XSS. This issue affects WPJobBoard: from n/a through 5.10.1.
published:2025-02-03T15:15:30.410


Instruction: Please provide detailed information about CVE-2025-24898

CVE:CVE-2025-24898
Description:rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.
published:2025-02-03T18:15:43.077


Instruction: Please provide detailed information about CVE-2025-22978

CVE:CVE-2025-22978
Description:eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.
published:2025-02-03T20:15:36.720


Instruction: Please provide detailed information about CVE-2025-25064

CVE:CVE-2025-25064
Description:SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.
published:2025-02-03T20:15:37.257


Instruction: Please provide detailed information about CVE-2025-25065

CVE:CVE-2025-25065
Description:SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints.
published:2025-02-03T20:15:37.370


Instruction: Please provide detailed information about CVE-2025-25181

CVE:CVE-2025-25181
Description:A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
published:2025-02-03T20:15:37.477


Instruction: Please provide detailed information about CVE-2025-22918

CVE:CVE-2025-22918
Description:Polycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting in the leakage of sensitive user information.
published:2025-02-03T21:15:15.400


Instruction: Please provide detailed information about CVE-2025-24370

CVE:CVE-2025-24370
Description:Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality `set_property_value`, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of second and third parameter to the vulnerable function, leading to arbitrary changes to the python runtime status. With this finding at least five ways of vulnerability exploitation have been observed, stably resulting in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. This issue has been addressed in version 0.62.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T21:15:15.547


Instruction: Please provide detailed information about CVE-2025-24899

CVE:CVE-2025-24899
Description:reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as `username`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request to `/api/listVulnerability/`. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T21:15:15.703


Instruction: Please provide detailed information about CVE-2025-24959

CVE:CVE-2025-24959
Description:zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.env`. This can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for security-sensitive operations. Applications that process untrusted input and pass it through `dotenv.stringify` are particularly vulnerable. This issue has been patched in version 8.3.2. Users should immediately upgrade to this version to mitigate the vulnerability. If upgrading is not feasible, users can mitigate the vulnerability by sanitizing user-controlled environment variable values before passing them to `dotenv.stringify`. Specifically, avoid using `"`, `'`, and backticks in values, or enforce strict validation of environment variables before usage.
published:2025-02-03T21:15:15.853


Instruction: Please provide detailed information about CVE-2025-24960

CVE:CVE-2025-24960
Description:Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admin(s), there is very little scope for abuse. However, the `DELETE` `files/:filename` can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T21:15:16.020


Instruction: Please provide detailed information about CVE-2025-24961

CVE:CVE-2025-24961
Description:org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T21:15:16.170


Instruction: Please provide detailed information about CVE-2025-24962

CVE:CVE-2025-24962
Description:reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advised to filter user input and monitor the project for a new release.
published:2025-02-03T21:15:16.317


Instruction: Please provide detailed information about CVE-2025-22129

CVE:CVE-2025-22129
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to restricted information. This issue has been addressed in Tuleap Community Edition 16.3.99.1736242932, Tuleap Enterprise Edition 16.2-5, and Tuleap Enterprise Edition 16.3-2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:28.040


Instruction: Please provide detailed information about CVE-2025-23210

CVE:CVE-2025-23210
Description:phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:28.187


Instruction: Please provide detailed information about CVE-2025-24029

CVE:CVE-2025-24029
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:28.320


Instruction: Please provide detailed information about CVE-2025-24371

CVE:CVE-2025-24371
Description:CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround.
published:2025-02-03T22:15:28.460


Instruction: Please provide detailed information about CVE-2025-24901

CVE:CVE-2025-24901
Description:WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:28.590


Instruction: Please provide detailed information about CVE-2025-24902

CVE:CVE-2025-24902
Description:WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:28.723


Instruction: Please provide detailed information about CVE-2025-24905

CVE:CVE-2025-24905
Description:WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:28.840


Instruction: Please provide detailed information about CVE-2025-24906

CVE:CVE-2025-24906
Description:WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:28.963


Instruction: Please provide detailed information about CVE-2025-24957

CVE:CVE-2025-24957
Description:WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socio.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:29.087


Instruction: Please provide detailed information about CVE-2025-24958

CVE:CVE-2025-24958
Description:WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-03T22:15:29.210


Instruction: Please provide detailed information about CVE-2025-0148

CVE:CVE-2025-0148
Description:Missing password field masking in the Zoom Jenkins Marketplace plugin before version 1.6 may allow an unauthenticated user to conduct a disclosure of information via adjacent network access.
published:2025-02-03T23:15:08.217


Instruction: Please provide detailed information about CVE-2025-1003

CVE:CVE-2025-1003
Description:A potential vulnerability has been identified in HP Anyware Agent for Linux which might allow for authentication bypass which may result in escalation of privilege. HP is releasing a software update to mitigate this potential vulnerability.
published:2025-02-04T00:15:33.940


Instruction: Please provide detailed information about CVE-2025-22475

CVE:CVE-2025-22475
Description:Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Implementation vulnerability. A remote attacker could potentially exploit this vulnerability, leading to Information tampering.
published:2025-02-04T03:15:07.240


Instruction: Please provide detailed information about CVE-2025-24982

CVE:CVE-2025-24982
Description:Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted.
published:2025-02-04T05:15:10.543


Instruction: Please provide detailed information about CVE-2025-0368

CVE:CVE-2025-0368
Description:The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users.
published:2025-02-04T06:15:30.037


Instruction: Please provide detailed information about CVE-2025-0466

CVE:CVE-2025-0466
Description:The Sensei LMS  WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.
published:2025-02-04T06:15:30.160


Instruction: Please provide detailed information about CVE-2025-20881

CVE:CVE-2025-20881
Description:Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
published:2025-02-04T08:15:28.957


Instruction: Please provide detailed information about CVE-2025-20882

CVE:CVE-2025-20882
Description:Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
published:2025-02-04T08:15:29.097


Instruction: Please provide detailed information about CVE-2025-20883

CVE:CVE-2025-20883
Description:Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.
published:2025-02-04T08:15:29.210


Instruction: Please provide detailed information about CVE-2025-20884

CVE:CVE-2025-20884
Description:Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data across multiple user profiles.
published:2025-02-04T08:15:29.340


Instruction: Please provide detailed information about CVE-2025-20885

CVE:CVE-2025-20885
Description:Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memory corruption.
published:2025-02-04T08:15:29.463


Instruction: Please provide detailed information about CVE-2025-20886

CVE:CVE-2025-20886
Description:Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key.
published:2025-02-04T08:15:29.597


Instruction: Please provide detailed information about CVE-2025-20887

CVE:CVE-2025-20887
Description:Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
published:2025-02-04T08:15:29.720


Instruction: Please provide detailed information about CVE-2025-20888

CVE:CVE-2025-20888
Description:Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
published:2025-02-04T08:15:29.847


Instruction: Please provide detailed information about CVE-2025-20889

CVE:CVE-2025-20889
Description:Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
published:2025-02-04T08:15:29.983


Instruction: Please provide detailed information about CVE-2025-20890

CVE:CVE-2025-20890
Description:Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to execute arbitrary code with privilege. User interaction is required for triggering this vulnerability.
published:2025-02-04T08:15:30.140


Instruction: Please provide detailed information about CVE-2025-20891

CVE:CVE-2025-20891
Description:Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to read arbitrary memory. User interaction is required for triggering this vulnerability.
published:2025-02-04T08:15:30.283


Instruction: Please provide detailed information about CVE-2025-20892

CVE:CVE-2025-20892
Description:Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execute fastboot command. User interaction is required for triggering this vulnerability.
published:2025-02-04T08:15:30.407


Instruction: Please provide detailed information about CVE-2025-20893

CVE:CVE-2025-20893
Description:Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the configuration of notifications.
published:2025-02-04T08:15:30.537


Instruction: Please provide detailed information about CVE-2025-20894

CVE:CVE-2025-20894
Description:Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.
published:2025-02-04T08:15:30.673


Instruction: Please provide detailed information about CVE-2025-20895

CVE:CVE-2025-20895
Description:Authentication Bypass Using an Alternate Path in Galaxy Store prior to version 4.5.87.6 allows physical attackers to install arbitrary applications to bypass restrictions of Setupwizard.
published:2025-02-04T08:15:30.827


Instruction: Please provide detailed information about CVE-2025-20896

CVE:CVE-2025-20896
Description:Use of implicit intent for sensitive communication in EasySetup prior to version 11.1.18 allows local attackers to access sensitive information.
published:2025-02-04T08:15:30.973


Instruction: Please provide detailed information about CVE-2025-20897

CVE:CVE-2025-20897
Description:Improper access control in Secure Folder prior to version 1.9.20.50 in Android 14, 1.8.11.0 in Android 13, and 1.7.04.0 in Android 12 allows local attacker to access data in Secure Folder.
published:2025-02-04T08:15:31.123


Instruction: Please provide detailed information about CVE-2025-20898

CVE:CVE-2025-20898
Description:Improper input validation in Samsung Members prior to version 5.2.00.12 allows physical attackers to access data across multiple user profiles.
published:2025-02-04T08:15:31.270


Instruction: Please provide detailed information about CVE-2025-20899

CVE:CVE-2025-20899
Description:Improper access control in PushNotification prior to version 13.0.00.15 in Android 12, 14.0.00.7 in Android 13, and 15.1.00.5 in Android 14 allows local attackers to access sensitive information.
published:2025-02-04T08:15:31.407


Instruction: Please provide detailed information about CVE-2025-20900

CVE:CVE-2025-20900
Description:Out-of-bounds write in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to write out-of-bounds memory.
published:2025-02-04T08:15:31.573


Instruction: Please provide detailed information about CVE-2025-20901

CVE:CVE-2025-20901
Description:Out-of-bounds read in Blockchain Keystore prior to version 1.3.16.5 allows local privileged attackers to read out-of-bounds memory.
published:2025-02-04T08:15:31.707


Instruction: Please provide detailed information about CVE-2025-20902

CVE:CVE-2025-20902
Description:Improper access control in Media Controller prior to version 1.0.24.5282 allows local attacker to launch activities in MediaController's privilege.
published:2025-02-04T08:15:31.857


Instruction: Please provide detailed information about CVE-2025-20904

CVE:CVE-2025-20904
Description:Out-of-bounds write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to cause memory corruption.
published:2025-02-04T08:15:32.010


Instruction: Please provide detailed information about CVE-2025-20905

CVE:CVE-2025-20905
Description:Out-of-bounds read and write in mPOS TUI trustlet prior to SMR Feb-2025 Release 1 allows local privileged attackers to read and write out-of-bounds memory.
published:2025-02-04T08:15:32.130


Instruction: Please provide detailed information about CVE-2025-20906

CVE:CVE-2025-20906
Description:Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB.
published:2025-02-04T08:15:32.263


Instruction: Please provide detailed information about CVE-2025-20907

CVE:CVE-2025-20907
Description:Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find.
published:2025-02-04T08:15:32.403


Instruction: Please provide detailed information about CVE-2025-22204

CVE:CVE-2025-22204
Description:Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability.
published:2025-02-04T08:15:32.563


Instruction: Please provide detailed information about CVE-2025-22205

CVE:CVE-2025-22205
Description:Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x.
published:2025-02-04T08:15:32.703


Instruction: Please provide detailed information about CVE-2025-23015

CVE:CVE-2025-23015
Description:Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.  This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.  Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
published:2025-02-04T10:15:09.097


Instruction: Please provide detailed information about CVE-2025-0890

CVE:CVE-2025-0890
Description:**UNSUPPORTED WHEN ASSIGNED** Insecure default credentials for the Telnet function in the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an attacker to log in to the management interface if the administrators have the option to change the default credentials but fail to do so.
published:2025-02-04T11:15:08.880


Instruction: Please provide detailed information about CVE-2025-24860

CVE:CVE-2025-24860
Description:Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer.  Users with restricted data center access can update their own permissions via data control language (DCL) statements on affected versions.     This issue affects Apache Cassandra: from 4.0.0 through 4.0.15 and from 4.1.0 through 4.1.7 for CassandraNetworkAuthorizer, and from 5.0.0 through 5.0.2 for both CassandraNetworkAuthorizer and CassandraCIDRAuthorizer.     Operators using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer on affected versions should review data access rules for potential breaches. Users are recommended to upgrade to versions 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
published:2025-02-04T11:15:09.107


Instruction: Please provide detailed information about CVE-2025-0510

CVE:CVE-2025-0510
Description:Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135.
published:2025-02-04T14:15:31.550


Instruction: Please provide detailed information about CVE-2025-1009

CVE:CVE-2025-1009
Description:An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
published:2025-02-04T14:15:31.653


Instruction: Please provide detailed information about CVE-2025-1010

CVE:CVE-2025-1010
Description:An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
published:2025-02-04T14:15:31.767


Instruction: Please provide detailed information about CVE-2025-1011

CVE:CVE-2025-1011
Description:A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
published:2025-02-04T14:15:31.887


Instruction: Please provide detailed information about CVE-2025-1012

CVE:CVE-2025-1012
Description:A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
published:2025-02-04T14:15:32.000


Instruction: Please provide detailed information about CVE-2025-1013

CVE:CVE-2025-1013
Description:A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
published:2025-02-04T14:15:32.123


Instruction: Please provide detailed information about CVE-2025-1014

CVE:CVE-2025-1014
Description:Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
published:2025-02-04T14:15:32.237


Instruction: Please provide detailed information about CVE-2025-1015

CVE:CVE-2025-1015
Description:The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability affects Thunderbird < 128.7 and Thunderbird < 135.
published:2025-02-04T14:15:32.363


Instruction: Please provide detailed information about CVE-2025-1016

CVE:CVE-2025-1016
Description:Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
published:2025-02-04T14:15:32.467


Instruction: Please provide detailed information about CVE-2025-1017

CVE:CVE-2025-1017
Description:Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
published:2025-02-04T14:15:32.600


Instruction: Please provide detailed information about CVE-2025-1018

CVE:CVE-2025-1018
Description:The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability affects Firefox < 135 and Thunderbird < 135.
published:2025-02-04T14:15:32.727


Instruction: Please provide detailed information about CVE-2025-1019

CVE:CVE-2025-1019
Description:The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability affects Firefox < 135 and Thunderbird < 135.
published:2025-02-04T14:15:32.850


Instruction: Please provide detailed information about CVE-2025-1020

CVE:CVE-2025-1020
Description:Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135 and Thunderbird < 135.
published:2025-02-04T14:15:32.953


Instruction: Please provide detailed information about CVE-2025-0825

CVE:CVE-2025-0825
Description:cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.
published:2025-02-04T15:15:19.420


Instruction: Please provide detailed information about CVE-2025-22206

CVE:CVE-2025-22206
Description:A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature.
published:2025-02-04T15:15:19.797


Instruction: Please provide detailed information about CVE-2025-22641

CVE:CVE-2025-22641
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prem Tiwari FM Notification Bar allows Stored XSS. This issue affects FM Notification Bar: from n/a through 1.0.2.
published:2025-02-04T15:15:19.923


Instruction: Please provide detailed information about CVE-2025-22642

CVE:CVE-2025-22642
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RTO GmbH Dynamic Conditions allows Stored XSS. This issue affects Dynamic Conditions: from n/a through 1.7.4.
published:2025-02-04T15:15:20.120


Instruction: Please provide detailed information about CVE-2025-22643

CVE:CVE-2025-22643
Description:Missing Authorization vulnerability in FameThemes OnePress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OnePress: from n/a through 2.3.11.
published:2025-02-04T15:15:20.350


Instruction: Please provide detailed information about CVE-2025-22653

CVE:CVE-2025-22653
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in templaza Music Press Pro allows Stored XSS. This issue affects Music Press Pro: from n/a through 1.4.6.
published:2025-02-04T15:15:20.557


Instruction: Please provide detailed information about CVE-2025-22662

CVE:CVE-2025-22662
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter allows Stored XSS. This issue affects SendPulse Email Marketing Newsletter: from n/a through 2.1.5.
published:2025-02-04T15:15:20.780


Instruction: Please provide detailed information about CVE-2025-22664

CVE:CVE-2025-22664
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS. This issue affects Survey Maker: from n/a through 5.1.3.5.
published:2025-02-04T15:15:21.003


Instruction: Please provide detailed information about CVE-2025-22674

CVE:CVE-2025-22674
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Product Blocks for WooCommerce allows Stored XSS. This issue affects Product Blocks for WooCommerce: from n/a through 1.9.1.
published:2025-02-04T15:15:21.227


Instruction: Please provide detailed information about CVE-2025-22675

CVE:CVE-2025-22675
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Alert Box Block – Display notice/alerts in the front end allows Stored XSS. This issue affects Alert Box Block – Display notice/alerts in the front end: from n/a through 1.1.0.
published:2025-02-04T15:15:21.433


Instruction: Please provide detailed information about CVE-2025-22696

CVE:CVE-2025-22696
Description:Missing Authorization vulnerability in EmbedPress Document Block – Upload & Embed Docs. This issue affects Document Block – Upload & Embed Docs: from n/a through 1.1.0.
published:2025-02-04T15:15:21.643


Instruction: Please provide detailed information about CVE-2025-22697

CVE:CVE-2025-22697
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks allows Reflected XSS. This issue affects Responsive Blocks: from n/a through 1.9.9.
published:2025-02-04T15:15:21.793


Instruction: Please provide detailed information about CVE-2025-22699

CVE:CVE-2025-22699
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Traveler Code. This issue affects Traveler Code: from n/a through 3.1.0.
published:2025-02-04T15:15:21.947


Instruction: Please provide detailed information about CVE-2025-22700

CVE:CVE-2025-22700
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Traveler Code. This issue affects Traveler Code: from n/a through 3.1.0.
published:2025-02-04T15:15:22.140


Instruction: Please provide detailed information about CVE-2025-22730

CVE:CVE-2025-22730
Description:Missing Authorization vulnerability in Ksher Ksher allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ksher: from n/a through 1.1.2.
published:2025-02-04T15:15:22.293


Instruction: Please provide detailed information about CVE-2025-22794

CVE:CVE-2025-22794
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Landoweb Programador World Cup Predictor allows Reflected XSS. This issue affects World Cup Predictor: from n/a through 1.9.6.
published:2025-02-04T15:15:22.503


Instruction: Please provide detailed information about CVE-2025-23645

CVE:CVE-2025-23645
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs allows Reflected XSS. This issue affects Find Content IDs: from n/a through 1.0.
published:2025-02-04T15:15:22.873


Instruction: Please provide detailed information about CVE-2025-24598

CVE:CVE-2025-24598
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster allows Reflected XSS. This issue affects WP Mailster: from n/a through 1.8.17.0.
published:2025-02-04T15:15:23.027


Instruction: Please provide detailed information about CVE-2025-24599

CVE:CVE-2025-24599
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Newsletters allows Reflected XSS. This issue affects Newsletters: from n/a through 4.9.9.6.
published:2025-02-04T15:15:23.177


Instruction: Please provide detailed information about CVE-2025-24602

CVE:CVE-2025-24602
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check allows Reflected XSS. This issue affects WP24 Domain Check: from n/a through 1.10.14.
published:2025-02-04T15:15:23.320


Instruction: Please provide detailed information about CVE-2025-24648

CVE:CVE-2025-24648
Description:Incorrect Privilege Assignment vulnerability in wpase.com Admin and Site Enhancements (ASE) allows Privilege Escalation. This issue affects Admin and Site Enhancements (ASE): from n/a through 7.6.2.1.
published:2025-02-04T15:15:23.460


Instruction: Please provide detailed information about CVE-2025-24677

CVE:CVE-2025-24677
Description:Improper Control of Generation of Code ('Code Injection') vulnerability in WPSpins Post/Page Copying Tool allows Remote Code Inclusion. This issue affects Post/Page Copying Tool: from n/a through 2.0.3.
published:2025-02-04T15:15:23.603


Instruction: Please provide detailed information about CVE-2025-0364

CVE:CVE-2025-0364
Description:BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticated remote attacker can create an administrative user through the default exposed SaaS registration mechanism. Once an administrator, the attacker can upload and execute arbitrary PHP code using the "Cloud Storage Addin," leading to unauthenticated code execution.
published:2025-02-04T18:15:35.067


Instruction: Please provide detailed information about CVE-2025-23058

CVE:CVE-2025-23058
Description:A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an escalation of privileges.
published:2025-02-04T18:15:35.423


Instruction: Please provide detailed information about CVE-2025-23059

CVE:CVE-2025-23059
Description:A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privileges to access and retrieve sensitive data, potentially compromising the integrity and security of the entire system.
published:2025-02-04T18:15:35.570


Instruction: Please provide detailed information about CVE-2025-23060

CVE:CVE-2025-23060
Description:A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unauthorized access to network resources as well as enabling data tampering.
published:2025-02-04T18:15:35.717


Instruction: Please provide detailed information about CVE-2025-0444

CVE:CVE-2025-0444
Description:Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
published:2025-02-04T19:15:32.237


Instruction: Please provide detailed information about CVE-2025-0445

CVE:CVE-2025-0445
Description:Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
published:2025-02-04T19:15:32.353


Instruction: Please provide detailed information about CVE-2025-0451

CVE:CVE-2025-0451
Description:Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Medium)
published:2025-02-04T19:15:32.477


Instruction: Please provide detailed information about CVE-2025-24373

CVE:CVE-2025-24373
Description:woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce orders. This vulnerability allows unauthorized users to access any PDF document from a store if they: 1. Have access to a guest document link and 2. Replace the URL variable `my-account` with `bulk`. The issue occurs when: 1. The store's document access is set to "guest." and 2. The user is logged out. This vulnerability compromises the confidentiality of sensitive documents, affecting all stores using the plugin with the guest access option enabled. This issue has been addressed in version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-04T19:15:33.680


Instruction: Please provide detailed information about CVE-2025-24971

CVE:CVE-2025-24971
Description:DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was discovered in the DumbDrop application, `/upload/init` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely when the **Apprise Notification** enabled. This issue has been addressed in commit `4ff8469d` and all users are advised to patch. There are no known workarounds for this vulnerability.
published:2025-02-04T19:15:33.827


Instruction: Please provide detailed information about CVE-2025-25039

CVE:CVE-2025-25039
Description:A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system.
published:2025-02-04T19:15:33.977


Instruction: Please provide detailed information about CVE-2025-0509

CVE:CVE-2025-0509
Description:A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.
published:2025-02-04T20:15:49.763


Instruction: Please provide detailed information about CVE-2025-0630

CVE:CVE-2025-0630
Description:Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authenticated user has privileged access to files on the device's filesystem.
published:2025-02-04T20:15:49.940


Instruction: Please provide detailed information about CVE-2025-0960

CVE:CVE-2025-0960
Description:AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a denial-of-service condition or achieving remote code execution on the affected device.
published:2025-02-04T20:15:50.103


Instruction: Please provide detailed information about CVE-2025-24963

CVE:CVE-2025-24963
Description:Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-04T20:15:50.330


Instruction: Please provide detailed information about CVE-2025-24964

CVE:CVE-2025-24964
Description:Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking (CSWSH) attacks. When `api` option is enabled (Vitest UI enables it), Vitest starts a WebSocket server. This WebSocket server did not check Origin header and did not have any authorization mechanism and was vulnerable to CSWSH attacks. This WebSocket server has `saveTestFile` API that can edit a test file and `rerun` API that can rerun the tests. An attacker can execute arbitrary code by injecting a code in a test file by the `saveTestFile` API and then running that file by calling the `rerun` API. This vulnerability can result in remote code execution for users that are using Vitest serve API. This issue has been patched in versions 1.6.1, 2.1.9 and 3.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-04T20:15:50.483


Instruction: Please provide detailed information about CVE-2025-24966

CVE:CVE-2025-24966
Description:reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs, allowing attackers to inject arbitrary HTML code. In this scenario, the vulnerability exists in the "Add Target" functionality of the application, where the Target Organization and Target Description fields accept HTML payloads. The injected HTML is rendered and executed in the target area, potentially leading to malicious actions. Exploitation of HTML Injection can compromise the application's integrity and user trust. Attackers can execute unauthorized actions, steal sensitive information, or trick users into performing harmful actions. The organization's reputation, customer trust, and regulatory compliance could be negatively affected. This issue affects all versions up to and including 2.2.0. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
published:2025-02-04T20:15:50.627


Instruction: Please provide detailed information about CVE-2025-24967

CVE:CVE-2025-24967
Description:reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user management functionality. An attacker can exploit this issue by injecting malicious payloads into the username field during user creation. This vulnerability allows unauthorized script execution whenever the admin views or interacts with the affected user entry, posing a significant risk to sensitive admin functionalities. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
published:2025-02-04T20:15:50.813


Instruction: Please provide detailed information about CVE-2025-24968

CVE:CVE-2025-24968
Description:reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as `penetration_tester` or `auditor` to delete all projects in the system. This can lead to a complete system takeover by redirecting the attacker to the onboarding page, where they can add or modify users, including Sys Admins, and configure critical settings like API keys and user preferences. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
published:2025-02-04T20:15:50.997


Instruction: Please provide detailed information about CVE-2025-22601

CVE:CVE-2025-22601
Description:Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username via carefully crafted link using the `activate-account` route. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-04T21:15:27.800


Instruction: Please provide detailed information about CVE-2025-22602

CVE:CVE-2025-22602
Description:Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should enable CSP.
published:2025-02-04T21:15:27.950


Instruction: Please provide detailed information about CVE-2025-23023

CVE:CVE-2025-23023
Description:Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache (for example, the cache may have a response with missing  preloaded data). This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade may disable anonymous cache by setting the `DISCOURSE_DISABLE_ANON_CACHE` environment variable to a non-empty value.
published:2025-02-04T21:15:28.083


Instruction: Please provide detailed information about CVE-2025-0413

CVE:CVE-2025-0413
Description:Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability.  This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.  The specific flaw exists within the Technical Data Reporter component. By creating a symbolic link, an attacker can abuse the service to change the permissions of arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-25014.
published:2025-02-05T00:15:28.173


Instruction: Please provide detailed information about CVE-2025-23114

CVE:CVE-2025-23114
Description:A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.
published:2025-02-05T02:15:28.610


Instruction: Please provide detailed information about CVE-2025-1028

CVE:CVE-2025-1028
Description:The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in specific configurations where the first extension is processed over the final. This vulnerability also requires successfully exploiting a race condition in order to exploit.
published:2025-02-05T04:15:06.543


Instruction: Please provide detailed information about CVE-2025-1022

CVE:CVE-2025-1022
Description:Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), which can be bypassed by omitting the slashes in the file URI (e.g., file:../../../../etc/passwd). This is due to missing validations of the user input that should be blocking file URI schemes (e.g., file:// and file:/) in the HTML content.
published:2025-02-05T05:15:10.337


Instruction: Please provide detailed information about CVE-2025-1025

CVE:CVE-2025-1025
Description:Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upload filter.
published:2025-02-05T05:15:10.517


Instruction: Please provide detailed information about CVE-2025-1026

CVE:CVE-2025-1026
Description:Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, which results in a Local File Inclusion allowing the attacker to read sensitive files.

**Note:**

This is a bypass of the fix for [CVE-2024-21549](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023).
published:2025-02-05T05:15:10.687


Instruction: Please provide detailed information about CVE-2025-25246

CVE:CVE-2025-25246
Description:NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users.
published:2025-02-05T05:15:11.663


Instruction: Please provide detailed information about CVE-2025-0167

CVE:CVE-2025-0167
Description:When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.  This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
published:2025-02-05T10:15:22.710


Instruction: Please provide detailed information about CVE-2025-0665

CVE:CVE-2025-0665
Description:libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.
published:2025-02-05T10:15:22.857


Instruction: Please provide detailed information about CVE-2025-0725

CVE:CVE-2025-0725
Description:When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
published:2025-02-05T10:15:22.980


Instruction: Please provide detailed information about CVE-2025-21117

CVE:CVE-2025-21117
Description:Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vulnerability, leading to fully impersonating the user.
published:2025-02-05T14:15:27.417


Instruction: Please provide detailed information about CVE-2025-0858

CVE:CVE-2025-0858
Description:A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does not properly prevent path traversal and could lead to information disclosure.
published:2025-02-05T15:15:21.580


Instruction: Please provide detailed information about CVE-2025-20124

CVE:CVE-2025-20124
Description:A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device.

 This vulnerability is due to insecure deserialization of user-supplied Java byte streams by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object to an affected API. A successful exploit could allow the attacker to execute arbitrary commands on the device and elevate privileges.
 Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.
published:2025-02-05T17:15:22.457


Instruction: Please provide detailed information about CVE-2025-20125

CVE:CVE-2025-20125
Description:A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node.

 This vulnerability is due to a lack of authorization in a specific API and improper validation of user-supplied data. An attacker could exploit this vulnerability by sending a crafted HTTP request to a specific API on the device. A successful exploit could allow the attacker to attacker to obtain information, modify system configuration, and reload the device.
 Note: To successfully exploit this vulnerability, the attacker must have valid read-only administrative credentials. In a single-node deployment, new devices will not be able to authenticate during the reload time.
published:2025-02-05T17:15:22.610


Instruction: Please provide detailed information about CVE-2025-20169

CVE:CVE-2025-20169
Description:A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

 This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
published:2025-02-05T17:15:22.777


Instruction: Please provide detailed information about CVE-2025-20170

CVE:CVE-2025-20170
Description:A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

 This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
published:2025-02-05T17:15:23.283


Instruction: Please provide detailed information about CVE-2025-20171

CVE:CVE-2025-20171
Description:A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

 This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
published:2025-02-05T17:15:23.753


Instruction: Please provide detailed information about CVE-2025-20172

CVE:CVE-2025-20172
Description:A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

 This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. For Cisco IOS and IOS XE Software, a successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. For Cisco IOS XR Software, a successful exploit could allow the attacker to cause the SNMP process to restart, resulting in an interrupted SNMP response from an affected device. Devices that are running Cisco IOS XR Software will not reload.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
published:2025-02-05T17:15:24.020


Instruction: Please provide detailed information about CVE-2025-20173

CVE:CVE-2025-20173
Description:A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

 This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
published:2025-02-05T17:15:24.263


Instruction: Please provide detailed information about CVE-2025-20174

CVE:CVE-2025-20174
Description:A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

 This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
published:2025-02-05T17:15:24.513


Instruction: Please provide detailed information about CVE-2025-20175

CVE:CVE-2025-20175
Description:A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

 This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
published:2025-02-05T17:15:24.720


Instruction: Please provide detailed information about CVE-2025-20176

CVE:CVE-2025-20176
Description:A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.

 This vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
 This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.
published:2025-02-05T17:15:24.997


Instruction: Please provide detailed information about CVE-2025-20179

CVE:CVE-2025-20179
Description:A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

 This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
 Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
published:2025-02-05T17:15:25.210


Instruction: Please provide detailed information about CVE-2025-20180

CVE:CVE-2025-20180
Description:A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.

 This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Operator.
published:2025-02-05T17:15:25.370


Instruction: Please provide detailed information about CVE-2025-20183

CVE:CVE-2025-20183
Description:A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to evade the antivirus scanner and download a malicious file onto an endpoint.

 The vulnerability is due to improper handling of a crafted range request header. An attacker could exploit this vulnerability by sending an HTTP request with a crafted range request header through the affected device. A successful exploit could allow the attacker to evade the antivirus scanner and download malware onto the endpoint without detection by Cisco Secure Web Appliance.
published:2025-02-05T17:15:25.527


Instruction: Please provide detailed information about CVE-2025-20184

CVE:CVE-2025-20184
Description:A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an authenticated, remote attacker to perform command injection attacks against an affected device. The attacker must authenticate with valid administrator credentials.

 This vulnerability is due to insufficient validation of XML configuration files by an affected device. An attacker could exploit this vulnerability by uploading a crafted XML configuration file. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
published:2025-02-05T17:15:25.697


Instruction: Please provide detailed information about CVE-2025-20185

CVE:CVE-2025-20185
Description:A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials.

 This vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this vulnerability by generating a temporary password for the service account. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system.
 Note: The Security Impact Rating (SIR) for this vulnerability is Medium due to the unrestricted scope of information that is accessible to an attacker.
published:2025-02-05T17:15:25.883


Instruction: Please provide detailed information about CVE-2025-20204

CVE:CVE-2025-20204
Description:A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

 This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
published:2025-02-05T17:15:26.077


Instruction: Please provide detailed information about CVE-2025-20205

CVE:CVE-2025-20205
Description:A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

 This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
published:2025-02-05T17:15:26.243


Instruction: Please provide detailed information about CVE-2025-20207

CVE:CVE-2025-20207
Description:A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, remote attacker to obtain confidential information about the underlying operating system.

 This vulnerability exists because the appliances do not protect confidential information at rest in response to SNMP poll requests. An attacker could exploit this vulnerability by sending a crafted SNMP poll request to the affected appliance. A successful exploit could allow the attacker to discover confidential information that should be restricted. To exploit this vulnerability, an attacker must have the configured SNMP credentials.
published:2025-02-05T17:15:26.410


Instruction: Please provide detailed information about CVE-2025-20029

CVE:CVE-2025-20029
Description:Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands.      Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:29.573


Instruction: Please provide detailed information about CVE-2025-20045

CVE:CVE-2025-20045
Description:When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:29.760


Instruction: Please provide detailed information about CVE-2025-20058

CVE:CVE-2025-20058
Description:When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
published:2025-02-05T18:15:29.943


Instruction: Please provide detailed information about CVE-2025-21087

CVE:CVE-2025-21087
Description:When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization.      Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
published:2025-02-05T18:15:30.430


Instruction: Please provide detailed information about CVE-2025-21091

CVE:CVE-2025-21091
Description:When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization.      Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
published:2025-02-05T18:15:30.613


Instruction: Please provide detailed information about CVE-2025-22846

CVE:CVE-2025-22846
Description:When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.      Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:31.000


Instruction: Please provide detailed information about CVE-2025-22891

CVE:CVE-2025-22891
Description:When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:31.190


Instruction: Please provide detailed information about CVE-2025-23239

CVE:CVE-2025-23239
Description:When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.      Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:31.373


Instruction: Please provide detailed information about CVE-2025-23412

CVE:CVE-2025-23412
Description:When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate.        Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:31.580


Instruction: Please provide detailed information about CVE-2025-23413

CVE:CVE-2025-23413
Description:When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files.    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:31.930


Instruction: Please provide detailed information about CVE-2025-23415

CVE:CVE-2025-23415
Description:An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN client for Windows, macOS and Linux.        Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:32.573


Instruction: Please provide detailed information about CVE-2025-23419

CVE:CVE-2025-23419
Description:When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when  TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key  are used and/or the  SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache  are used in the default server and the default server is performing client certificate authentication.    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:33.347


Instruction: Please provide detailed information about CVE-2025-24312

CVE:CVE-2025-24312
Description:When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU resource utilization.    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:34.060


Instruction: Please provide detailed information about CVE-2025-24319

CVE:CVE-2025-24319
Description:When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate.        Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:34.557


Instruction: Please provide detailed information about CVE-2025-24320

CVE:CVE-2025-24320
Description:A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for  CVE-2024-31156 https://my.f5.com/manage/s/article/K000138636 .   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:34.960


Instruction: Please provide detailed information about CVE-2025-24326

CVE:CVE-2025-24326
Description:When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilization.      Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:35.420


Instruction: Please provide detailed information about CVE-2025-24497

CVE:CVE-2025-24497
Description:When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-02-05T18:15:35.613


Instruction: Please provide detailed information about CVE-2025-24372

CVE:CVE-2025-24372
Description:CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the `ckan.upload.user.mimetypes` / `ckan.upload.user.types` and `ckan.upload.group.mimetypes` / `ckan.upload.group.types` config options. To entirely disable file uploads users can use: `ckan.upload.user.types = none`
published:2025-02-05T19:15:46.010


Instruction: Please provide detailed information about CVE-2025-24803

CVE:CVE-2025-24803
Description:Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. The `dynamic_analysis.html` file does not sanitize the received bundle value from Corellium and as a result, it is possible to break the HTML context and achieve Stored XSS. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
published:2025-02-05T19:15:46.207