Protégez vos données, renforcez Votre Cybersécurité

CVE-2024-13418 - HIGH
02/05/2025

Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the d...

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-3708 - CRITICAL
02/05/2025

Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-3709 - CRITICAL
02/05/2025

Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to perform password brute force attack.

OWSAP: A07

>> Plus d'informations avec CVE Find

CVE-2025-3746 - CRITICAL
02/05/2025

The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the plugin not properly validating a user's identity prior to updating their details, like email. This makes it possible for unauthenticated attackers to change arbitrary users' email addresses, including administrators, and leverage that to rese...

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-43595 - HIGH
01/05/2025

An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22).

OWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-24522 - CRITICAL
01/05/2025

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system.

CVE-2025-32011 - CRITICAL
01/05/2025

KUNBUS PiCtory versions 2.5.0 through 2.11.1 have an authentication bypass vulnerability where a remote attacker can bypass authentication to get access due to a path traversal.

CVE-2025-35975 - HIGH
01/05/2025

MicroDicom DICOM Viewer is vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code. The user must open a malicious DCM file for exploitation.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-35996 - HIGH
01/05/2025

KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due to a missing escape or sanitization, the filename could be executed as HTML script tag resulting in a cross-site-scripting attack.

OWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-36521 - HIGH
01/05/2025

MicroDicom DICOM Viewer is vulnerable to an out-of-bounds read which may allow an attacker to cause memory corruption within the application. The user must open a malicious DCM file for exploitation.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-46337 - CRITICAL
01/05/2025

ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9.

sqlinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

CVE-2025-23254 - HIGH
01/05/2025

NVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an attacker may cause a data validation issue by local access to the TRTLLM server. A successful exploit of this vulnerability may lead to code execution, information disclosure and data tampering.

OWSAP: A08

>> Plus d'informations avec CVE Find

CVE-2025-27007 - CRITICAL
01/05/2025

Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82.

priviliegemanagementOWSAP: A04

>> Plus d'informations avec CVE Find

CVE-2025-47154 - CRITICAL
01/05/2025

LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing remote attackers to execute arbitrary code via a crafted .js file. NOTE: the GitHub README says "Ladybird is in a pre-alpha state, and only suitable for use by developers."

CVE-2025-4150 - HIGH
01/05/2025

A vulnerability was found in Netgear EX6200 1.0.3.94. It has been declared as critical. This vulnerability affects the function sub_54340. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-1304 - HIGH
01/05/2025

The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin() function in all versions up to, and including, 0.2.5.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution ...

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-1305 - HIGH
01/05/2025

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a si...

csrfOWSAP: A01

>> Plus d'informations avec CVE Find

CVE-2025-4149 - HIGH
01/05/2025

A vulnerability was found in Netgear EX6200 1.0.3.94. It has been classified as critical. This affects the function sub_54014. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-4148 - HIGH
01/05/2025

A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this issue is the function sub_503FC. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

overflow

>> Plus d'informations avec CVE Find

CVE-2025-4147 - HIGH
01/05/2025

A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this vulnerability is the function sub_47F7C. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

overflow

>> Plus d'informations avec CVE Find