Instruction: Please provide detailed information about CVE-2025-21996

CVE:CVE-2025-21996
Description:In the Linux kernel, the following vulnerability has been resolved:  drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()  On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value.  Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these.  Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.  (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)
published:2025-04-03T08:15:15.007


Instruction: Please provide detailed information about CVE-2025-21997

CVE:CVE-2025-21997
Description:In the Linux kernel, the following vulnerability has been resolved:  xsk: fix an integer overflow in xp_create_and_assign_umem()  Since the i and pool->chunk_size variables are of type 'u32', their product can wrap around and then be cast to 'u64'. This can lead to two different XDP buffers pointing to the same memory area.  Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
published:2025-04-03T08:15:15.127


Instruction: Please provide detailed information about CVE-2025-21998

CVE:CVE-2025-21998
Description:In the Linux kernel, the following vulnerability has been resolved:  firmware: qcom: uefisecapp: fix efivars registration race  Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access.  Make sure that all resources have been set up before registering the efivars.
published:2025-04-03T08:15:15.243


Instruction: Please provide detailed information about CVE-2025-21999

CVE:CVE-2025-21999
Description:In the Linux kernel, the following vulnerability has been resolved:  proc: fix UAF in proc_get_inode()  Fix race between rmmod and /proc/XXX's inode instantiation.  The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless use_pde/unuse_pde() pair has been used.  use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops never changes so information necessary for inode instantiation can be saved _before_ proc_register() in PDE itself and used later, avoiding pde->proc_ops->...  dereference.        rmmod                         lookup sys_delete_module                          proc_lookup_de 			   pde_get(de); 			   proc_get_inode(dir->i_sb, de);   mod->exit()     proc_remove       remove_proc_subtree        proc_entry_rundown(de);   free_module(mod);                                 if (S_ISREG(inode->i_mode)) 	                         if (de->proc_ops->proc_read_iter)                            --> As module is already freed, will trigger UAF  BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:proc_get_inode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS:  00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  <TASK>  proc_lookup_de+0x11f/0x2e0  __lookup_slow+0x188/0x350  walk_component+0x2ab/0x4f0  path_lookupat+0x120/0x660  filename_lookup+0x1ce/0x560  vfs_statx+0xac/0x150  __do_sys_newstat+0x96/0x110  do_syscall_64+0x5f/0x170  entry_SYSCALL_64_after_hwframe+0x76/0x7e  [adobriyan@gmail.com: don't do 2 atomic ops on the common path]
published:2025-04-03T08:15:15.360


Instruction: Please provide detailed information about CVE-2025-22000

CVE:CVE-2025-22000
Description:In the Linux kernel, the following vulnerability has been resolved:  mm/huge_memory: drop beyond-EOF folios with the right number of refs  When an after-split folio is large and needs to be dropped due to EOF, folio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all page cache refs.  Otherwise, the folio will not be freed, causing memory leak.  This leak would happen on a filesystem with blocksize > page_size and a truncate is performed, where the blocksize makes folios split to >0 order ones, causing truncated folios not being freed.
published:2025-04-03T08:15:15.483


Instruction: Please provide detailed information about CVE-2025-22001

CVE:CVE-2025-22001
Description:In the Linux kernel, the following vulnerability has been resolved:  accel/qaic: Fix integer overflow in qaic_validate_req()  These are u64 variables that come from the user via qaic_attach_slice_bo_ioctl().  Use check_add_overflow() to ensure that the math doesn't have an integer wrapping bug.
published:2025-04-03T08:15:15.603


Instruction: Please provide detailed information about CVE-2025-22002

CVE:CVE-2025-22002
Description:In the Linux kernel, the following vulnerability has been resolved:  netfs: Call `invalidate_cache` only if implemented  Many filesystems such as NFS and Ceph do not implement the `invalidate_cache` method.  On those filesystems, if writing to the cache (`NETFS_WRITE_TO_CACHE`) fails for some reason, the kernel crashes like this:   BUG: kernel NULL pointer dereference, address: 0000000000000000  #PF: supervisor instruction fetch in kernel mode  #PF: error_code(0x0010) - not-present page  PGD 0 P4D 0  Oops: Oops: 0010 [#1] SMP PTI  CPU: 9 UID: 0 PID: 3380 Comm: kworker/u193:11 Not tainted 6.13.3-cm4all1-hp #437  Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018  Workqueue: events_unbound netfs_write_collection_worker  RIP: 0010:0x0  Code: Unable to access opcode bytes at 0xffffffffffffffd6.  RSP: 0018:ffff9b86e2ca7dc0 EFLAGS: 00010202  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 7fffffffffffffff  RDX: 0000000000000001 RSI: ffff89259d576a18 RDI: ffff89259d576900  RBP: ffff89259d5769b0 R08: ffff9b86e2ca7d28 R09: 0000000000000002  R10: ffff89258ceaca80 R11: 0000000000000001 R12: 0000000000000020  R13: ffff893d158b9338 R14: ffff89259d576900 R15: ffff89259d5769b0  FS:  0000000000000000(0000) GS:ffff893c9fa40000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: ffffffffffffffd6 CR3: 000000054442e003 CR4: 00000000001706f0  Call Trace:   <TASK>   ? __die+0x1f/0x60   ? page_fault_oops+0x15c/0x460   ? try_to_wake_up+0x2d2/0x530   ? exc_page_fault+0x5e/0x100   ? asm_exc_page_fault+0x22/0x30   netfs_write_collection_worker+0xe9f/0x12b0   ? xs_poll_check_readable+0x3f/0x80   ? xs_stream_data_receive_workfn+0x8d/0x110   process_one_work+0x134/0x2d0   worker_thread+0x299/0x3a0   ? __pfx_worker_thread+0x10/0x10   kthread+0xba/0xe0   ? __pfx_kthread+0x10/0x10   ret_from_fork+0x30/0x50   ? __pfx_kthread+0x10/0x10   ret_from_fork_asm+0x1a/0x30   </TASK>  Modules linked in:  CR2: 0000000000000000  This patch adds the missing `NULL` check.
published:2025-04-03T08:15:15.723


Instruction: Please provide detailed information about CVE-2025-22003

CVE:CVE-2025-22003
Description:In the Linux kernel, the following vulnerability has been resolved:  can: ucan: fix out of bound read in strscpy() source  Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()") unintentionally introduced a one byte out of bound read on strscpy()'s source argument (which is kind of ironic knowing that strscpy() is meant to be a more secure alternative :)).  Let's consider below buffers:    dest[len + 1]; /* will be NUL terminated */   src[len]; /* may not be NUL terminated */  When doing:    strncpy(dest, src, len);   dest[len] = '\0';  strncpy() will read up to len bytes from src.  On the other hand:    strscpy(dest, src, len + 1);  will read up to len + 1 bytes from src, that is to say, an out of bound read of one byte will occur on src if it is not NUL terminated. Note that the src[len] byte is never copied, but strscpy() still needs to read it to check whether a truncation occurred or not.  This exact pattern happened in ucan.  The root cause is that the source is not NUL terminated. Instead of doing a copy in a local buffer, directly NUL terminate it as soon as usb_control_msg() returns. With this, the local firmware_str[] variable can be removed.  On top of this do a couple refactors:    - ucan_ctl_payload->raw is only used for the firmware string, so     rename it to ucan_ctl_payload->fw_str and change its type from u8 to     char.    - ucan_device_request_in() is only used to retrieve the firmware     string, so rename it to ucan_get_fw_str() and refactor it to make it     directly handle all the string termination logic.
published:2025-04-03T08:15:15.840


Instruction: Please provide detailed information about CVE-2025-22004

CVE:CVE-2025-22004
Description:In the Linux kernel, the following vulnerability has been resolved:  net: atm: fix use after free in lec_send()  The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.
published:2025-04-03T08:15:15.960


Instruction: Please provide detailed information about CVE-2025-22005

CVE:CVE-2025-22005
Description:In the Linux kernel, the following vulnerability has been resolved:  ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().  fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails.  Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak.  Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the error path.  Note that we can remove the fib6_nh_release() call in nh_create_ipv6() later in net-next.git.
published:2025-04-03T08:15:16.087


Instruction: Please provide detailed information about CVE-2025-22006

CVE:CVE-2025-22006
Description:In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence  Registering the interrupts for TX or RX DMA Channels prior to registering their respective NAPI callbacks can result in a NULL pointer dereference. This is seen in practice as a random occurrence since it depends on the randomness associated with the generation of traffic by Linux and the reception of traffic from the wire.
published:2025-04-03T08:15:16.220


Instruction: Please provide detailed information about CVE-2025-22007

CVE:CVE-2025-22007
Description:In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: Fix error code in chan_alloc_skb_cb()  The chan_alloc_skb_cb() function is supposed to return error pointers on error.  Returning NULL will lead to a NULL dereference.
published:2025-04-03T08:15:16.347


Instruction: Please provide detailed information about CVE-2025-2874

CVE:CVE-2025-2874
Description:The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
published:2025-04-03T08:15:16.470


Instruction: Please provide detailed information about CVE-2025-3149

CVE:CVE-2025-3149
Description:A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an unknown function of the file /shw_war/fileupload of the component Edit Job Page. The manipulation of the argument Course leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-04-03T08:15:16.643


Instruction: Please provide detailed information about CVE-2025-3150

CVE:CVE-2025-3150
Description:A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected.
published:2025-04-03T08:15:16.863


Instruction: Please provide detailed information about CVE-2025-3151

CVE:CVE-2025-3151
Description:A vulnerability was found in SourceCodester Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /signup.php. The manipulation of the argument user_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T08:15:17.070


Instruction: Please provide detailed information about CVE-2025-3152

CVE:CVE-2025-3152
Description:A vulnerability classified as problematic has been found in caipeichao ThinkOX 1.0. This affects an unknown part of the file /ThinkOX-master/index.php?s=/Weibo/Index/search.html of the component Search. The manipulation of the argument keywords leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T08:15:17.277


Instruction: Please provide detailed information about CVE-2025-2299

CVE:CVE-2025-2299
Description:The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the 'ajaxEdit' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-04-03T12:15:14.920


Instruction: Please provide detailed information about CVE-2025-22927

CVE:CVE-2025-22927
Description:An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
published:2025-04-03T13:15:42.773


Instruction: Please provide detailed information about CVE-2025-22928

CVE:CVE-2025-22928
Description:OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.
published:2025-04-03T13:15:42.883


Instruction: Please provide detailed information about CVE-2025-2945

CVE:CVE-2025-2945
Description:Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).  The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.   This issue affects pgAdmin 4: before 9.2.
published:2025-04-03T13:15:43.240


Instruction: Please provide detailed information about CVE-2025-2946

CVE:CVE-2025-2946
Description:pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
published:2025-04-03T13:15:43.377


Instruction: Please provide detailed information about CVE-2025-22926

CVE:CVE-2025-22926
Description:An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
published:2025-04-03T14:15:29.267


Instruction: Please provide detailed information about CVE-2025-22929

CVE:CVE-2025-22929
Description:OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.
published:2025-04-03T14:15:29.467


Instruction: Please provide detailed information about CVE-2025-22930

CVE:CVE-2025-22930
Description:OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.
published:2025-04-03T14:15:29.650


Instruction: Please provide detailed information about CVE-2025-22931

CVE:CVE-2025-22931
Description:An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.
published:2025-04-03T14:15:29.823


Instruction: Please provide detailed information about CVE-2025-29369

CVE:CVE-2025-29369
Description:Code-Projects Matrimonial Site V1.0 is vulnerable to SQL Injection in /view_profile.php?id=1.
published:2025-04-03T14:15:31.950


Instruction: Please provide detailed information about CVE-2025-30596

CVE:CVE-2025-30596
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound include-file allows Path Traversal. This issue affects include-file: from n/a through 1.
published:2025-04-03T14:15:33.450


Instruction: Please provide detailed information about CVE-2025-30611

CVE:CVE-2025-30611
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Wptobe-signinup allows Reflected XSS. This issue affects Wptobe-signinup: from n/a through 1.1.2.
published:2025-04-03T14:15:33.640


Instruction: Please provide detailed information about CVE-2025-30616

CVE:CVE-2025-30616
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Latest Custom Post Type Updates allows Reflected XSS. This issue affects Latest Custom Post Type Updates: from n/a through 1.3.0.
published:2025-04-03T14:15:33.803


Instruction: Please provide detailed information about CVE-2025-30858

CVE:CVE-2025-30858
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Snow Storm allows Reflected XSS. This issue affects Snow Storm: from n/a through 1.4.6.
published:2025-04-03T14:15:33.973


Instruction: Please provide detailed information about CVE-2025-30889

CVE:CVE-2025-30889
Description:Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider allows Object Injection. This issue affects Testimonial Slider: from n/a through 2.0.13.
published:2025-04-03T14:15:34.150


Instruction: Please provide detailed information about CVE-2025-30908

CVE:CVE-2025-30908
Description:Cross-Site Request Forgery (CSRF) vulnerability in Shamalli Web Directory Free allows Stored XSS. This issue affects Web Directory Free: from n/a through 1.7.6.
published:2025-04-03T14:15:34.330


Instruction: Please provide detailed information about CVE-2025-30915

CVE:CVE-2025-30915
Description:Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through 5.2.19.
published:2025-04-03T14:15:34.623


Instruction: Please provide detailed information about CVE-2025-30916

CVE:CVE-2025-30916
Description:Missing Authorization vulnerability in enituretechnology Residential Address Detection allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Residential Address Detection: from n/a through 2.5.4.
published:2025-04-03T14:15:34.790


Instruction: Please provide detailed information about CVE-2025-31091

CVE:CVE-2025-31091
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Header and Footer allows Stored XSS. This issue affects CM Header and Footer: from n/a through 1.2.4.
published:2025-04-03T14:15:34.963


Instruction: Please provide detailed information about CVE-2025-31098

CVE:CVE-2025-31098
Description:Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in debounce DeBounce Email Validator allows PHP Local File Inclusion. This issue affects DeBounce Email Validator: from n/a through 5.7.
published:2025-04-03T14:15:35.133


Instruction: Please provide detailed information about CVE-2025-31436

CVE:CVE-2025-31436
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Angelo Mandato Blubrry PowerPress Podcasting plugin MultiSite add-on allows Reflected XSS. This issue affects Blubrry PowerPress Podcasting plugin MultiSite add-on: from n/a through 0.1.1.
published:2025-04-03T14:15:35.367


Instruction: Please provide detailed information about CVE-2025-31442

CVE:CVE-2025-31442
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Search engine keywords highlighter allows Reflected XSS. This issue affects Search engine keywords highlighter: from n/a through 0.1.3.
published:2025-04-03T14:15:35.547


Instruction: Please provide detailed information about CVE-2025-31467

CVE:CVE-2025-31467
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Flickr Photostream allows Reflected XSS. This issue affects Flickr Photostream: from n/a through 3.1.8.
published:2025-04-03T14:15:35.697


Instruction: Please provide detailed information about CVE-2025-31468

CVE:CVE-2025-31468
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP_Identicon allows Reflected XSS. This issue affects WP_Identicon: from n/a through 2.0.
published:2025-04-03T14:15:35.863


Instruction: Please provide detailed information about CVE-2025-31536

CVE:CVE-2025-31536
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets allows Reflected XSS. This issue affects CF7 Spreadsheets: from n/a through 2.3.2.
published:2025-04-03T14:15:36.417


Instruction: Please provide detailed information about CVE-2025-31541

CVE:CVE-2025-31541
Description:Missing Authorization vulnerability in turitop TuriTop Booking System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TuriTop Booking System: from n/a through 1.0.10.
published:2025-04-03T14:15:36.597


Instruction: Please provide detailed information about CVE-2025-31554

CVE:CVE-2025-31554
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in docxpresso Docxpresso allows Absolute Path Traversal. This issue affects Docxpresso: from n/a through 2.6.
published:2025-04-03T14:15:36.793


Instruction: Please provide detailed information about CVE-2025-31558

CVE:CVE-2025-31558
Description:Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Greg TailPress allows Retrieve Embedded Sensitive Data. This issue affects TailPress: from n/a through 0.4.4.
published:2025-04-03T14:15:37.090


Instruction: Please provide detailed information about CVE-2025-31573

CVE:CVE-2025-31573
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev CF7 Database allows Stored XSS. This issue affects PeproDev CF7 Database: from n/a through 2.0.0.
published:2025-04-03T14:15:37.313


Instruction: Please provide detailed information about CVE-2025-31581

CVE:CVE-2025-31581
Description:Missing Authorization vulnerability in Sandeep Kumar WP Video Playlist allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Video Playlist: from n/a through 1.1.2.
published:2025-04-03T14:15:37.550


Instruction: Please provide detailed information about CVE-2025-31582

CVE:CVE-2025-31582
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator allows Stored XSS. This issue affects Contact Form vCard Generator: from n/a through 2.4.
published:2025-04-03T14:15:37.720


Instruction: Please provide detailed information about CVE-2025-31622

CVE:CVE-2025-31622
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Utkarsh Kukreti Advanced Typekit allows Stored XSS. This issue affects Advanced Typekit: from n/a through 1.0.1.
published:2025-04-03T14:15:37.887


Instruction: Please provide detailed information about CVE-2025-31626

CVE:CVE-2025-31626
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite allows Reflected XSS. This issue affects Support Helpdesk Ticket System Lite: from n/a through 4.5.2.
published:2025-04-03T14:15:38.067


Instruction: Please provide detailed information about CVE-2025-31729

CVE:CVE-2025-31729
Description:Missing Authorization vulnerability in jeffikus WooTumblog allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooTumblog: from n/a through 2.1.4.
published:2025-04-03T14:15:38.397


Instruction: Please provide detailed information about CVE-2025-31736

CVE:CVE-2025-31736
Description:Missing Authorization vulnerability in richtexteditor Rich Text Editor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rich Text Editor: from n/a through 1.0.1.
published:2025-04-03T14:15:38.550


Instruction: Please provide detailed information about CVE-2025-31739

CVE:CVE-2025-31739
Description:Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Minimalistic Event Manager: from n/a through 1.1.1.
published:2025-04-03T14:15:38.710


Instruction: Please provide detailed information about CVE-2025-31746

CVE:CVE-2025-31746
Description:Missing Authorization vulnerability in Think201 Clients allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Clients: from n/a through 1.1.4.
published:2025-04-03T14:15:38.870


Instruction: Please provide detailed information about CVE-2025-31758

CVE:CVE-2025-31758
Description:Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Free Woocommerce Product Table View: from n/a through 1.78.
published:2025-04-03T14:15:39.030


Instruction: Please provide detailed information about CVE-2025-31768

CVE:CVE-2025-31768
Description:Missing Authorization vulnerability in OTWthemes Widget Manager Light allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Widget Manager Light: from n/a through 1.18.
published:2025-04-03T14:15:39.223


Instruction: Please provide detailed information about CVE-2025-31789

CVE:CVE-2025-31789
Description:Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TextMe SMS: from n/a through 1.9.1.
published:2025-04-03T14:15:39.417


Instruction: Please provide detailed information about CVE-2025-31794

CVE:CVE-2025-31794
Description:Missing Authorization vulnerability in Web Ready Now WR Price List Manager For Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WR Price List Manager For Woocommerce: from n/a through 1.0.8.
published:2025-04-03T14:15:39.610


Instruction: Please provide detailed information about CVE-2025-31795

CVE:CVE-2025-31795
Description:Missing Authorization vulnerability in Plugin Devs Shopify to WooCommerce Migration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shopify to WooCommerce Migration: from n/a through 1.3.0.
published:2025-04-03T14:15:39.803


Instruction: Please provide detailed information about CVE-2025-31800

CVE:CVE-2025-31800
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in publitio Publitio allows Path Traversal. This issue affects Publitio: from n/a through 2.1.8.
published:2025-04-03T14:15:40.020


Instruction: Please provide detailed information about CVE-2025-31825

CVE:CVE-2025-31825
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon allows Path Traversal. This issue affects Category Icon: from n/a through 1.0.0.
published:2025-04-03T14:15:40.190


Instruction: Please provide detailed information about CVE-2025-31827

CVE:CVE-2025-31827
Description:Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vlad.olaru Fonto allows Path Traversal. This issue affects Fonto: from n/a through 1.2.2.
published:2025-04-03T14:15:40.360


Instruction: Please provide detailed information about CVE-2025-31841

CVE:CVE-2025-31841
Description:Missing Authorization vulnerability in Frank P. Walentynowicz FPW Category Thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FPW Category Thumbnails: from n/a through 1.9.5.
published:2025-04-03T14:15:40.720


Instruction: Please provide detailed information about CVE-2025-31858

CVE:CVE-2025-31858
Description:Missing Authorization vulnerability in matthewrubin Local Magic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Local Magic: from n/a through 2.6.0.
published:2025-04-03T14:15:41.167


Instruction: Please provide detailed information about CVE-2025-31876

CVE:CVE-2025-31876
Description:Missing Authorization vulnerability in gunnarpayday Payday allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Payday: from n/a through 3.3.12.
published:2025-04-03T14:15:41.413


Instruction: Please provide detailed information about CVE-2025-31893

CVE:CVE-2025-31893
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker allows Stored XSS. This issue affects Botnet Attack Blocker: from n/a through 2.0.0.
published:2025-04-03T14:15:41.570


Instruction: Please provide detailed information about CVE-2025-31896

CVE:CVE-2025-31896
Description:Missing Authorization vulnerability in istmoplugins GetBookingsWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GetBookingsWP: from n/a through 1.1.27.
published:2025-04-03T14:15:41.717


Instruction: Please provide detailed information about CVE-2025-31898

CVE:CVE-2025-31898
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound MediaView allows Reflected XSS. This issue affects MediaView: from n/a through 1.1.2.
published:2025-04-03T14:15:41.873


Instruction: Please provide detailed information about CVE-2025-31899

CVE:CVE-2025-31899
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpshopee Awesome Logos allows Reflected XSS. This issue affects Awesome Logos: from n/a through 1.2.
published:2025-04-03T14:15:42.023


Instruction: Please provide detailed information about CVE-2025-31900

CVE:CVE-2025-31900
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lexicata Lexicata allows Reflected XSS. This issue affects Lexicata: from n/a through 1.0.16.
published:2025-04-03T14:15:42.177


Instruction: Please provide detailed information about CVE-2025-31901

CVE:CVE-2025-31901
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digihood Digihood HTML Sitemap allows Reflected XSS. This issue affects Digihood HTML Sitemap: from n/a through 3.1.1.
published:2025-04-03T14:15:42.327


Instruction: Please provide detailed information about CVE-2025-31902

CVE:CVE-2025-31902
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Social Share And Social Locker allows Reflected XSS. This issue affects Social Share And Social Locker: from n/a through 1.4.1.
published:2025-04-03T14:15:42.483


Instruction: Please provide detailed information about CVE-2025-31903

CVE:CVE-2025-31903
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound XV Random Quotes allows Reflected XSS. This issue affects XV Random Quotes: from n/a through 1.37.
published:2025-04-03T14:15:42.647


Instruction: Please provide detailed information about CVE-2025-31905

CVE:CVE-2025-31905
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Team Rosters allows Reflected XSS. This issue affects Team Rosters: from n/a through 4.7.
published:2025-04-03T14:15:42.790


Instruction: Please provide detailed information about CVE-2025-31907

CVE:CVE-2025-31907
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Team Builder allows Reflected XSS. This issue affects Team Builder: from n/a through 1.3.
published:2025-04-03T14:15:42.953


Instruction: Please provide detailed information about CVE-2025-31909

CVE:CVE-2025-31909
Description:Missing Authorization vulnerability in NotFound Apptivo Business Site CRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Apptivo Business Site CRM: from n/a through 5.3.
published:2025-04-03T14:15:43.107


Instruction: Please provide detailed information about CVE-2025-31911

CVE:CVE-2025-31911
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Social Share And Social Locker allows Blind SQL Injection. This issue affects Social Share And Social Locker: from n/a through 1.4.2.
published:2025-04-03T14:15:43.257


Instruction: Please provide detailed information about CVE-2025-32049

CVE:CVE-2025-32049
Description:A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).
published:2025-04-03T14:15:43.410


Instruction: Please provide detailed information about CVE-2025-32050

CVE:CVE-2025-32050
Description:A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read.
published:2025-04-03T14:15:43.690


Instruction: Please provide detailed information about CVE-2025-32051

CVE:CVE-2025-32051
Description:A flaw was found in libsoup. The libsoup soup_uri_decode_data_uri() function may crash when processing malformed data URI. This flaw allows an attacker to cause a denial of service (DoS).
published:2025-04-03T14:15:43.903


Instruction: Please provide detailed information about CVE-2025-32052

CVE:CVE-2025-32052
Description:A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.
published:2025-04-03T14:15:44.077


Instruction: Please provide detailed information about CVE-2025-32053

CVE:CVE-2025-32053
Description:A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a heap buffer over-read.
published:2025-04-03T14:15:44.233


Instruction: Please provide detailed information about CVE-2025-3155

CVE:CVE-2025-3155
Description:A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
published:2025-04-03T14:15:46.413


Instruction: Please provide detailed information about CVE-2025-3157

CVE:CVE-2025-3157
Description:A vulnerability was found in Intelbras WRN 150 1.0.15_pt_ITB01. It has been rated as problematic. This issue affects some unknown processing of the component Wireless Menu. The manipulation of the argument SSID leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor was contacted early about this issue and explains that the latest version is not affected.
published:2025-04-03T14:15:46.590


Instruction: Please provide detailed information about CVE-2025-3158

CVE:CVE-2025-3158
Description:A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
published:2025-04-03T14:15:46.783


Instruction: Please provide detailed information about CVE-2025-3159

CVE:CVE-2025-3159
Description:A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is e8a6286542924e628e02749c4f5ac4f91fdae71b. It is recommended to apply a patch to fix this issue.
published:2025-04-03T14:15:46.983


Instruction: Please provide detailed information about CVE-2025-0272

CVE:CVE-2025-0272
Description:HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
published:2025-04-03T15:15:47.560


Instruction: Please provide detailed information about CVE-2025-3160

CVE:CVE-2025-3160
Description:A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as a0993658f40d8e13ff5823990c30b43c82a5daf0. It is recommended to apply a patch to fix this issue.
published:2025-04-03T15:15:52.867


Instruction: Please provide detailed information about CVE-2025-3161

CVE:CVE-2025-3161
Description:A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. This issue affects the function ShutdownSetAdd of the file /goform/ShutdownSetAdd. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T15:15:53.080


Instruction: Please provide detailed information about CVE-2025-3162

CVE:CVE-2025-3162
Description:A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the file lmdeploy/lmdeploy/vl/model/utils.py of the component PT File Handler. The manipulation leads to deserialization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
published:2025-04-03T15:15:53.277


Instruction: Please provide detailed information about CVE-2025-3190

CVE:CVE-2025-3190
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-04-03T15:15:53.467


Instruction: Please provide detailed information about CVE-2025-22457

CVE:CVE-2025-22457
Description:A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
published:2025-04-03T16:15:35.370


Instruction: Please provide detailed information about CVE-2025-29987

CVE:CVE-2025-29987
Description:Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root privileges.
published:2025-04-03T16:15:36.420


Instruction: Please provide detailed information about CVE-2025-3163

CVE:CVE-2025-3163
Description:A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
published:2025-04-03T16:15:37.133


Instruction: Please provide detailed information about CVE-2025-3164

CVE:CVE-2025-3164
Description:A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/semantic/database/testConnect of the component H2 Database Connection Handler. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T16:15:37.337


Instruction: Please provide detailed information about CVE-2025-3165

CVE:CVE-2025-3165
Description:A vulnerability classified as critical has been found in thu-pacman chitu 0.1.0. This affects the function torch.load of the file chitu/chitu/backend.py. The manipulation of the argument ckpt_path/quant_ckpt_dir leads to deserialization. An attack has to be approached locally.
published:2025-04-03T16:15:37.530


Instruction: Please provide detailed information about CVE-2025-31115

CVE:CVE-2025-31115
Description:XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.
published:2025-04-03T17:15:30.540


Instruction: Please provide detailed information about CVE-2025-32054

CVE:CVE-2025-32054
Description:In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file
published:2025-04-03T17:15:30.947


Instruction: Please provide detailed information about CVE-2025-3166

CVE:CVE-2025-3166
Description:A vulnerability classified as critical was found in code-projects Product Management System 1.0. This vulnerability affects the function search_item of the component Search Product Menu. The manipulation of the argument target leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
published:2025-04-03T17:15:31.150


Instruction: Please provide detailed information about CVE-2025-3167

CVE:CVE-2025-3167
Description:A vulnerability, which was classified as problematic, has been found in Tenda AC23 16.03.07.52. This issue affects some unknown processing of the file /goform/VerAPIMant of the component API Interface. The manipulation of the argument getuid leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T17:15:31.390


Instruction: Please provide detailed information about CVE-2025-3168

CVE:CVE-2025-3168
Description:A vulnerability was found in PHPGurukul Time Table Generator System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-class.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T17:15:31.823


Instruction: Please provide detailed information about CVE-2025-3169

CVE:CVE-2025-3169
Description:A vulnerability was found in Projeqtor up to 12.0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tool/saveAttachment.php. The manipulation of the argument attachmentFiles leads to unrestricted upload. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 12.0.3 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains, that "this vulnerability can be exploited only on not securely installed instances, as it is adviced during product install: attachment directory should be out of web reach, so that even if executable file can be uploaded, it cannot be executed through the web."
published:2025-04-03T17:15:32.080


Instruction: Please provide detailed information about CVE-2025-31126

CVE:CVE-2025-31126
Description:Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8.
published:2025-04-03T18:15:45.803


Instruction: Please provide detailed information about CVE-2025-31127

CVE:CVE-2025-31127
Description:Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.4.
published:2025-04-03T18:15:46.037


Instruction: Please provide detailed information about CVE-2025-31483

CVE:CVE-2025-31483
Description:Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.
published:2025-04-03T18:15:47.270


Instruction: Please provide detailed information about CVE-2025-3170

CVE:CVE-2025-3170
Description:A vulnerability classified as critical has been found in Project Worlds Online Lawyer Management System 1.0. This affects an unknown part of the file /admin_user.php. The manipulation of the argument block_id/unblock_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T18:15:48.360


Instruction: Please provide detailed information about CVE-2025-3171

CVE:CVE-2025-3171
Description:A vulnerability classified as critical was found in Project Worlds Online Lawyer Management System 1.0. This vulnerability affects unknown code of the file /approve_lawyer.php. The manipulation of the argument unblock_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T18:15:48.540


Instruction: Please provide detailed information about CVE-2025-3172

CVE:CVE-2025-3172
Description:A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyer_booking.php. The manipulation of the argument unblock_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T18:15:48.723


Instruction: Please provide detailed information about CVE-2025-29647

CVE:CVE-2025-29647
Description:SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
published:2025-04-03T19:15:39.580


Instruction: Please provide detailed information about CVE-2025-31486

CVE:CVE-2025-31486
Description:Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
published:2025-04-03T19:15:39.890


Instruction: Please provide detailed information about CVE-2025-31487

CVE:CVE-2025-31487
Description:The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). The vulnerability has been patched in the JIRA Extension v8.6.5.
published:2025-04-03T19:15:40.047


Instruction: Please provide detailed information about CVE-2025-3173

CVE:CVE-2025-3173
Description:A vulnerability, which was classified as critical, was found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the file /save_booking.php. The manipulation of the argument lawyer_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T19:15:40.853


Instruction: Please provide detailed information about CVE-2025-3174

CVE:CVE-2025-3174
Description:A vulnerability has been found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T19:15:41.060


Instruction: Please provide detailed information about CVE-2025-3175

CVE:CVE-2025-3175
Description:A vulnerability was found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /save_user_edit_profile.php. The manipulation of the argument first_Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T19:15:41.277


Instruction: Please provide detailed information about CVE-2025-26817

CVE:CVE-2025-26817
Description:Netwrix Password Secure 9.2.0.32454 allows OS command injection.
published:2025-04-03T20:15:23.837


Instruction: Please provide detailed information about CVE-2025-26818

CVE:CVE-2025-26818
Description:Netwrix Password Secure through 9.2 allows command injection.
published:2025-04-03T20:15:23.980


Instruction: Please provide detailed information about CVE-2025-29064

CVE:CVE-2025-29064
Description:An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.
published:2025-04-03T20:15:24.117


Instruction: Please provide detailed information about CVE-2025-29462

CVE:CVE-2025-29462
Description:A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socketRead function to process HTTP request messages, resulting in the overwriting of a buffer on the stack.
published:2025-04-03T20:15:24.383


Instruction: Please provide detailed information about CVE-2025-29504

CVE:CVE-2025-29504
Description:Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification.
published:2025-04-03T20:15:24.560


Instruction: Please provide detailed information about CVE-2025-29570

CVE:CVE-2025-29570
Description:An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binary named rc.
published:2025-04-03T20:15:24.723


Instruction: Please provide detailed information about CVE-2025-30406

CVE:CVE-2025-30406
Description:Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
published:2025-04-03T20:15:24.987


Instruction: Please provide detailed information about CVE-2025-31119

CVE:CVE-2025-31119
Description:generator-jhipster-entity-audit is a JHipster module to enable entity audit and audit log page. Prior to 5.9.1, generator-jhipster-entity-audit allows unsafe reflection when having Javers selected as Entity Audit Framework. If an attacker manages to place some malicious classes into the classpath and also has access to these REST interface for calling the mentioned REST endpoints, using these lines of code can lead to unintended remote code execution. This vulnerability is fixed in 5.9.1.
published:2025-04-03T20:15:25.223


Instruction: Please provide detailed information about CVE-2025-31161

CVE:CVE-2025-31161
Description:CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
published:2025-04-03T20:15:25.373


Instruction: Please provide detailed information about CVE-2025-31481

CVE:CVE-2025-31481
Description:API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17.
published:2025-04-03T20:15:25.543


Instruction: Please provide detailed information about CVE-2025-31485

CVE:CVE-2025-31485
Description:API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17.
published:2025-04-03T20:15:25.740


Instruction: Please provide detailed information about CVE-2025-31489

CVE:CVE-2025-31489
Description:MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.
published:2025-04-03T20:15:25.897


Instruction: Please provide detailed information about CVE-2025-3176

CVE:CVE-2025-3176
Description:A vulnerability was found in Project Worlds Online Lawyer Management System 1.0. It has been classified as critical. This affects an unknown part of the file /single_lawyer.php. The manipulation of the argument u_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T20:15:27.317


Instruction: Please provide detailed information about CVE-2025-3177

CVE:CVE-2025-3177
Description:A vulnerability was found in FastCMS 0.1.5. It has been declared as critical. This vulnerability affects unknown code of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key
 . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
published:2025-04-03T20:15:27.507


Instruction: Please provide detailed information about CVE-2025-3178

CVE:CVE-2025-3178
Description:A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /doctor/deleteappointment.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T21:15:42.000


Instruction: Please provide detailed information about CVE-2025-3179

CVE:CVE-2025-3179
Description:A vulnerability classified as critical has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected is an unknown function of the file /doctor/deletepatient.php. The manipulation of the argument ic leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T21:15:42.183


Instruction: Please provide detailed information about CVE-2025-3180

CVE:CVE-2025-3180
Description:A vulnerability classified as critical was found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /doctor/deleteschedule.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T21:15:42.370


Instruction: Please provide detailed information about CVE-2025-0278

CVE:CVE-2025-0278
Description:HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file paths, in error messages, debug logs, or responses to user requests.
published:2025-04-03T22:15:16.563


Instruction: Please provide detailed information about CVE-2025-0279

CVE:CVE-2025-0279
Description:HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces.  Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.
published:2025-04-03T22:15:16.700


Instruction: Please provide detailed information about CVE-2025-30370

CVE:CVE-2025-30370
Description:jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix. This vulnerability is fixed in 0.51.1.
published:2025-04-03T22:15:21.190


Instruction: Please provide detailed information about CVE-2025-3181

CVE:CVE-2025-3181
Description:A vulnerability, which was classified as critical, has been found in projectworlds Online Doctor Appointment Booking System 1.0. Affected by this issue is some unknown functionality of the file /patient/appointment.php?scheduleDate=1&appid=1. The manipulation of the argument scheduleDate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T22:15:21.350


Instruction: Please provide detailed information about CVE-2025-3182

CVE:CVE-2025-3182
Description:A vulnerability, which was classified as critical, was found in projectworlds Online Doctor Appointment Booking System 1.0. This affects an unknown part of the file /patient/getschedule.php. The manipulation of the argument q leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-03T22:15:21.533


Instruction: Please provide detailed information about CVE-2025-3183

CVE:CVE-2025-3183
Description:A vulnerability has been found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /patient/patientupdateprofile.php. The manipulation of the argument patientFirstName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-03T22:15:21.723


Instruction: Please provide detailed information about CVE-2025-3184

CVE:CVE-2025-3184
Description:A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0 and classified as critical. This issue affects some unknown processing of the file /patient/profile.php?patientId=1. The manipulation of the argument patientFirstName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-03T23:15:38.170


Instruction: Please provide detailed information about CVE-2025-3185

CVE:CVE-2025-3185
Description:A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been classified as critical. Affected is an unknown function of the file /patient/patientupdateprofile.php. The manipulation of the argument patientFirstName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-03T23:15:38.350


Instruction: Please provide detailed information about CVE-2025-3186

CVE:CVE-2025-3186
Description:A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /patient/invoice.php. The manipulation of the argument appid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T00:15:15.347


Instruction: Please provide detailed information about CVE-2025-25000

CVE:CVE-2025-25000
Description:Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
published:2025-04-04T01:15:38.070


Instruction: Please provide detailed information about CVE-2025-25001

CVE:CVE-2025-25001
Description:Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
published:2025-04-04T01:15:39.153


Instruction: Please provide detailed information about CVE-2025-29796

CVE:CVE-2025-29796
Description:User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
published:2025-04-04T01:15:39.310


Instruction: Please provide detailed information about CVE-2025-29815

CVE:CVE-2025-29815
Description:Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
published:2025-04-04T01:15:39.487


Instruction: Please provide detailed information about CVE-2025-3187

CVE:CVE-2025-3187
Description:A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument logindetail leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T01:15:40.197


Instruction: Please provide detailed information about CVE-2025-3188

CVE:CVE-2025-3188
Description:A vulnerability classified as critical has been found in PHPGurukul e-Diary Management System 1.0. This affects an unknown part of the file /add-notes.php. The manipulation of the argument Category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T01:15:40.407


Instruction: Please provide detailed information about CVE-2025-24310

CVE:CVE-2025-24310
Description:Improper restriction of rendered UI layers or frames issue exists in HMI ViewJet C-more series, which may allow a remote unauthenticated attacker to trick the product user to perform operations on the product's web pages.
published:2025-04-04T02:15:17.463


Instruction: Please provide detailed information about CVE-2025-24317

CVE:CVE-2025-24317
Description:Allocation of resources without limits or throttling issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to cause a denial-of-service (DoS) condition.
published:2025-04-04T02:15:17.757


Instruction: Please provide detailed information about CVE-2025-25061

CVE:CVE-2025-25061
Description:Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack.
published:2025-04-04T02:15:17.910


Instruction: Please provide detailed information about CVE-2025-26401

CVE:CVE-2025-26401
Description:Weak encoding for password vulnerability exists in HMI ViewJet C-more series. If this vulnerability is exploited, authentication information may be obtained by a local authenticated attacker.
published:2025-04-04T02:15:18.047


Instruction: Please provide detailed information about CVE-2025-3195

CVE:CVE-2025-3195
Description:A vulnerability, which was classified as critical, has been found in itsourcecode Online Blood Bank Management System 1.0. This issue affects some unknown processing of the file /bbms.php. The manipulation of the argument Search leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T02:15:18.423


Instruction: Please provide detailed information about CVE-2025-3196

CVE:CVE-2025-3196
Description:A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
published:2025-04-04T02:15:18.627


Instruction: Please provide detailed information about CVE-2025-3198

CVE:CVE-2025-3198
Description:A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.
published:2025-04-04T02:15:18.803


Instruction: Please provide detailed information about CVE-2025-3199

CVE:CVE-2025-3199
Description:A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelController.java of the component API Interface. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.2 is able to address this issue. The name of the patch is c0daf641fb25b244591b7a6c3affa35c69d321fe. It is recommended to upgrade the affected component.
published:2025-04-04T02:15:19.013


Instruction: Please provide detailed information about CVE-2025-3202

CVE:CVE-2025-3202
Description:A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysNoticeController.java. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 6382e177bf90cc56ff70521842409e35c50df32d. It is recommended to upgrade the affected component.
published:2025-04-04T03:15:13.997


Instruction: Please provide detailed information about CVE-2025-3203

CVE:CVE-2025-3203
Description:A vulnerability classified as problematic was found in Tenda W18E 16.01.0.11. Affected by this vulnerability is the function formSetAccountList of the file /goform/setModules. The manipulation of the argument Password leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T03:15:14.207


Instruction: Please provide detailed information about CVE-2025-3204

CVE:CVE-2025-3204
Description:A vulnerability, which was classified as critical, has been found in CodeAstro Car Rental System 1.0. Affected by this issue is some unknown functionality of the file /returncar.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T03:15:14.413


Instruction: Please provide detailed information about CVE-2025-3205

CVE:CVE-2025-3205
Description:A vulnerability, which was classified as critical, was found in CodeAstro Student Grading System 1.0. This affects an unknown part of the file studentsubject.php. The manipulation of the argument studentId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T03:15:14.613


Instruction: Please provide detailed information about CVE-2025-3206

CVE:CVE-2025-3206
Description:A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T04:15:39.357


Instruction: Please provide detailed information about CVE-2025-3207

CVE:CVE-2025-3207
Description:A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /birthing_form.php. The manipulation of the argument birth_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T04:15:39.603


Instruction: Please provide detailed information about CVE-2025-2075

CVE:CVE-2025-2075
Description:The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.
published:2025-04-04T05:15:45.400


Instruction: Please provide detailed information about CVE-2025-3191

CVE:CVE-2025-3191
Description:All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in the <iframe> tag.
published:2025-04-04T05:15:45.577


Instruction: Please provide detailed information about CVE-2025-3192

CVE:CVE-2025-3192
Description:Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.
published:2025-04-04T05:15:45.743


Instruction: Please provide detailed information about CVE-2025-3194

CVE:CVE-2025-3194
Description:Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the application.
published:2025-04-04T05:15:45.927


Instruction: Please provide detailed information about CVE-2025-3197

CVE:CVE-2025-3197
Description:Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.
published:2025-04-04T05:15:46.103


Instruction: Please provide detailed information about CVE-2025-3208

CVE:CVE-2025-3208
Description:A vulnerability was found in code-projects Patient Record Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /xray_print.php. The manipulation of the argument itr_no leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T05:15:46.367


Instruction: Please provide detailed information about CVE-2025-3209

CVE:CVE-2025-3209
Description:A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /add_patient.php. The manipulation of the argument itr_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T05:15:46.600


Instruction: Please provide detailed information about CVE-2025-3210

CVE:CVE-2025-3210
Description:A vulnerability was found in code-projects Patient Record Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /birthing_pending.php. The manipulation of the argument birth_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T05:15:46.817


Instruction: Please provide detailed information about CVE-2025-2159

CVE:CVE-2025-2159
Description:Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI
published:2025-04-04T06:15:40.347


Instruction: Please provide detailed information about CVE-2025-2270

CVE:CVE-2025-2270
Description:The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific filenames on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in some cases.
published:2025-04-04T06:15:40.540


Instruction: Please provide detailed information about CVE-2025-2279

CVE:CVE-2025-2279
Description:The Maps  WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
published:2025-04-04T06:15:40.757


Instruction: Please provide detailed information about CVE-2025-2317

CVE:CVE-2025-2317
Description:The Product Filter by WBW plugin for WordPress is vulnerable to time-based SQL Injection via the filtersDataBackend parameter in all versions up to, and including, 2.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-04-04T06:15:40.890


Instruction: Please provide detailed information about CVE-2025-2836

CVE:CVE-2025-2836
Description:The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-04-04T06:15:41.070


Instruction: Please provide detailed information about CVE-2025-3211

CVE:CVE-2025-3211
Description:A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /birthing_print.php. The manipulation of the argument itr_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T06:15:41.247


Instruction: Please provide detailed information about CVE-2025-3213

CVE:CVE-2025-3213
Description:A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. This vulnerability affects unknown code of the file /view-note.php?noteid=11. The manipulation of the argument remark leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T06:15:41.480


Instruction: Please provide detailed information about CVE-2025-3214

CVE:CVE-2025-3214
Description:A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of the file /readTemplate. The manipulation of the argument template leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains that this is not a bug but a feature.
published:2025-04-04T06:15:41.740


Instruction: Please provide detailed information about CVE-2025-2780

CVE:CVE-2025-2780
Description:The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
published:2025-04-04T07:15:40.807


Instruction: Please provide detailed information about CVE-2025-2797

CVE:CVE-2025-2797
Description:The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'woffice_handle_user_approval_actions' function. This makes it possible for unauthenticated attackers to approve registration for any user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-04-04T07:15:42.380


Instruction: Please provide detailed information about CVE-2025-32111

CVE:CVE-2025-32111
Description:The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.
published:2025-04-04T07:15:42.580


Instruction: Please provide detailed information about CVE-2025-3086

CVE:CVE-2025-3086
Description:Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial of service
published:2025-04-04T07:15:42.797


Instruction: Please provide detailed information about CVE-2025-3087

CVE:CVE-2025-3087
Description:Stored XSS in M-Files Web versions from 25.1.14445.5 to 25.2.14524.4 allows an authenticated user to run scripts
published:2025-04-04T07:15:42.993


Instruction: Please provide detailed information about CVE-2025-3215

CVE:CVE-2025-3215
Description:A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php. The manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-04T07:15:43.143


Instruction: Please provide detailed information about CVE-2025-3216

CVE:CVE-2025-3216
Description:A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been classified as critical. This affects an unknown part of the file /password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T07:15:43.400


Instruction: Please provide detailed information about CVE-2025-3217

CVE:CVE-2025-3217
Description:A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /registration.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T07:15:43.707


Instruction: Please provide detailed information about CVE-2025-3105

CVE:CVE-2025-3105
Description:The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator.
published:2025-04-04T08:15:14.190


Instruction: Please provide detailed information about CVE-2025-3219

CVE:CVE-2025-3219
Description:A vulnerability was found in CodeCanyon Perfex CRM 3.2.1. It has been classified as problematic. Affected is an unknown function of the file /perfex/clients/project/2 of the component Project Discussions Module. The manipulation of the argument description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T08:15:14.543


Instruction: Please provide detailed information about CVE-2025-3220

CVE:CVE-2025-3220
Description:A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T08:15:14.767


Instruction: Please provide detailed information about CVE-2025-3229

CVE:CVE-2025-3229
Description:A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /edit-subadmin.php. The manipulation of the argument fullname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-04-04T09:15:17.357


Instruction: Please provide detailed information about CVE-2025-3231

CVE:CVE-2025-3231
Description:A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /aboutus.php. The manipulation of the argument pagetitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T09:15:17.677


Instruction: Please provide detailed information about CVE-2025-1865

CVE:CVE-2025-1865
Description:The kernel driver, accessible to low-privileged users, exposes a function that fails to properly validate the privileges of the calling process. This allows creating files at arbitrary locations with full user control, ultimately allowing for privilege escalation to SYSTEM.
published:2025-04-04T10:15:15.277


Instruction: Please provide detailed information about CVE-2025-2243

CVE:CVE-2025-2243
Description:A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.
published:2025-04-04T10:15:16.313


Instruction: Please provide detailed information about CVE-2025-2244

CVE:CVE-2025-2244
Description:A vulnerability in the sendMailFromRemoteSource method in Emails.php  as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.
published:2025-04-04T10:15:16.580


Instruction: Please provide detailed information about CVE-2025-2245

CVE:CVE-2025-2245
Description:A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.
published:2025-04-04T10:15:16.740


Instruction: Please provide detailed information about CVE-2025-3235

CVE:CVE-2025-3235
Description:A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/profile.php. The manipulation of the argument adminname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T10:15:16.900


Instruction: Please provide detailed information about CVE-2025-3236

CVE:CVE-2025-3236
Description:A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been declared as critical. This vulnerability affects unknown code of the file /goform/VirSerDMZ of the component Web Management Interface. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T10:15:17.177


Instruction: Please provide detailed information about CVE-2025-3237

CVE:CVE-2025-3237
Description:A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the file /goform/wrlwpsset. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T10:15:17.383


Instruction: Please provide detailed information about CVE-2025-3238

CVE:CVE-2025-3238
Description:A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. Affected is an unknown function of the file /search-request.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T10:15:17.577


Instruction: Please provide detailed information about CVE-2025-22282

CVE:CVE-2025-22282
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EPC ez Form Calculator - WordPress plugin allows Reflected XSS.This issue affects ez Form Calculator - WordPress plugin: from n/a through 2.14.1.2.
published:2025-04-04T11:15:39.680


Instruction: Please provide detailed information about CVE-2025-3239

CVE:CVE-2025-3239
Description:A vulnerability classified as critical was found in PHPGurukul Online Fire Reporting System 1.2. Affected by this vulnerability is an unknown functionality of the file /admin/edit-guard-detail.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T11:15:40.393


Instruction: Please provide detailed information about CVE-2025-3240

CVE:CVE-2025-3240
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Online Fire Reporting System 1.2. Affected by this issue is some unknown functionality of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T11:15:40.603


Instruction: Please provide detailed information about CVE-2025-3241

CVE:CVE-2025-3241
Description:A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of the component XML Document Handler. The manipulation of the argument routercontent leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T11:15:40.783


Instruction: Please provide detailed information about CVE-2025-3242

CVE:CVE-2025-3242
Description:A vulnerability has been found in PHPGurukul e-Diary Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /search-result.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T11:15:40.980


Instruction: Please provide detailed information about CVE-2025-3243

CVE:CVE-2025-3243
Description:A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dental_form.php. The manipulation of the argument itr_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T12:15:15.530


Instruction: Please provide detailed information about CVE-2025-3244

CVE:CVE-2025-3244
Description:A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /add-admin.php of the component Create User Page. The manipulation of the argument Avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T12:15:16.217


Instruction: Please provide detailed information about CVE-2025-3245

CVE:CVE-2025-3245
Description:A vulnerability was found in itsourcecode Library Management System 1.0. It has been rated as critical. Affected by this issue is the function Search of the file library_management/src/Library_Management/Forgot.java. The manipulation of the argument txtuname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-04-04T12:15:16.400


Instruction: Please provide detailed information about CVE-2025-31420

CVE:CVE-2025-31420
Description:Incorrect Privilege Assignment vulnerability in Tomdever wpForo Forum allows Privilege Escalation.This issue affects wpForo Forum: from n/a through 2.4.2.
published:2025-04-04T13:15:46.630


Instruction: Please provide detailed information about CVE-2025-31421

CVE:CVE-2025-31421
Description:Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Oblak Studio Srbtranslatin allows Retrieve Embedded Sensitive Data.This issue affects Srbtranslatin: from n/a through 3.2.0.
published:2025-04-04T13:15:46.780


Instruction: Please provide detailed information about CVE-2025-3189

CVE:CVE-2025-3189
Description:Stored Cross-Site Scripting (XSS) in DoWISP in versions prior to 1.16.2.50, which consists of an stored XSS through the upload of a profile picture in SVG format with malicious Javascript code in it.
published:2025-04-04T13:15:46.940


Instruction: Please provide detailed information about CVE-2025-22281

CVE:CVE-2025-22281
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in joshix Simplish allows Stored XSS.This issue affects Simplish: from n/a through 2.6.4.
published:2025-04-04T14:15:21.297