cve,poc_name,poc_description,poc_url,poc_source,poc_stars,poc_date_discovered,cve_url,cve_title,cve_description,cve_vendor,cve_products,cve_cvssv3_base_score,cve_cvssv3_base_severity,cve_epss
CVE-2023-1698,CVE-2023-1698,CVE-2023-1698 Proof of Concept (PoC),https://github.com/X3RX3SSec/CVE-2023-1698,github,0,2025-02-22T00:38:24.000Z,https://securityvulnerability.io/vulnerability/CVE-2023-1698,WAGO: WBM Command Injection in multiple products,"A vulnerability in multiple WAGO products enables an unauthenticated remote attacker to create new user accounts and modify device configurations. This can lead to unintended behaviors, potential denial of service, and significant risks to system integrity and security.",Wago,"Compact Controller Cc100,Edge Controller,Pfc100,Pfc200,Touch Panel 600 Advanced Line,Touch Panel 600 Marine Line,Touch Panel 600 Standard Line",9.8,CRITICAL,0.17976999282836914
CVE-2025-1555,CVE-2025-1555 - Proof of Concept,,https://github.com/Rain1er/report/blob/main/CDG/bnhiMg%3D%3D.md,refferences,,2025-02-21T21:00:12.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1555,Unrestricted File Upload Vulnerability in hzmanyun Education and Training System,"The hzmanyun Education and Training System 3.1.1 contains a vulnerability in the saveImage function that allows attackers to upload arbitrary files without proper restrictions. This issue can be exploited remotely, potentially leading to severe compromises in web application integrity and security. Despite the vulnerability being disclosed publicly, the vendor has yet to respond to reports, which raises concerns about the ongoing risk for users of the system. Organizations utilizing this software should take urgent action to assess their exposure and implement protective measures.",Hzmanyun,Education And Training System,6.9,MEDIUM,0.01
CVE-2025-26465,patch-manual-CVE-2025-26465-e-CVE-2025-26466,"Patch Manual para a correção das  CVE-2025-26465-e-CVE-2025-26466, para sistemas sem update do OpenSSH",https://github.com/dolutech/patch-manual-CVE-2025-26465-e-CVE-2025-26466,github,0,2025-02-21T18:19:54.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-26465,OpenSSH Vulnerability Allows Man-in-the-Middle Attack via Host Key Verification Flaw,"A significant vulnerability has been identified in OpenSSH when the VerifyHostKeyDNS option is activated. This flaw allows a malicious actor to conduct a man-in-the-middle attack by impersonating a legitimate server. The crux of the issue lies in the mishandling of error codes by OpenSSH during the host key verification process under certain conditions. For the attack to be successful, the attacker must first exhaust the client’s memory resources, which adds considerable complexity to the execution of the attack. It is crucial for users and administrators to be aware of this flaw and apply necessary mitigations to safeguard their systems.",Red Hat,"Red Hat Enterprise Linux 6,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Red Hat Openshift Container Platform 4",6.8,MEDIUM,0.0004299999854993075
CVE-2025-1548,CVE-2025-1548 - Proof of Concept,,https://github.com/cydtseng/Vulnerability-Research/blob/main/dreamercms/RemoteFileInclusion-ArticleEditorImageUpload.md,refferences,,2025-02-21T17:00:10.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1548,Cross-Site Scripting Vulnerability in iteachyou Dreamer CMS,"A cross-site scripting vulnerability exists in iteachyou Dreamer CMS version 4.1.3, specifically affecting the /admin/archives/edit file. This vulnerability is triggered by manipulating the editorValue/answer/content parameters. The flaw allows remote attackers to inject malicious scripts into web pages viewed by users, potentially compromising sensitive information or user sessions. Despite early notification, the vendor has not provided a response regarding this security concern, increasing the urgency for users to anticipate and mitigate potential attacks.",Iteachyou,Dreamer Cms,5.1,MEDIUM,0.01
CVE-2025-1546,CVE-2025-1546 - Proof of Concept,,https://github.com/koishi0x01/CVE/blob/main/CVE_2.md,refferences,,2025-02-21T16:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1546,OS Command Injection in BDCOM Behavior Management and Auditing System,"A vulnerability exists in the BDCOM Behavior Management and Auditing System, specifically in the log_operate_clear function located in /webui/modules/log/operate.mds. This issue arises due to improper handling of user-supplied arguments, notably the start_code parameter, which can be exploited to execute arbitrary OS commands. The vulnerability allows for remote attacks, making it a significant risk. Despite the vendor being informed about this vulnerability, no response was received, making it imperative for users to take immediate action to mitigate the risks associated with this security flaw.",Bdcom,Behavior Management And Auditing System,6.9,MEDIUM,0.01
CVE-2025-1544,CVE-2025-1544 - Proof of Concept,,https://github.com/XinCaoZ/cve/blob/main/dingfanzu/dingfanzu-CMS%20loadShopInfo.php%20shopId%20SQL%20inject.md,refferences,,2025-02-21T16:00:11.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1544,SQL Injection Flaw in dingfanzu CMS Affects Remote Functionality,"A critical SQL injection vulnerability affects the dingfanzu CMS, specifically at the /ajax/loadShopInfo.php endpoint. This flaw arises due to improper handling of the shopId parameter, allowing remote attackers to execute arbitrary SQL queries. The risk is heightened as the vulnerability has been publicly disclosed, with no response from the vendor despite early notification. Immediate action is advised to mitigate potential exploitation.",Dingfanzu,Cms,5.3,MEDIUM,0.01
CVE-2025-1543,CVE-2025-1543 - Proof of Concept,,https://github.com/cydtseng/Vulnerability-Research/blob/main/dreamercms/PathTraversal-UeditorResource.md,refferences,,2025-02-21T16:00:08.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1543,Path Traversal Vulnerability in iteachyou Dreamer CMS 4.1.3,"A path traversal vulnerability has been identified in iteachyou Dreamer CMS version 4.1.3, affecting the processing of the /resource/js/ueditor-1.4.3.3 file. This issue can be exploited remotely, allowing attackers to manipulate file paths and potentially access restricted directories. The vulnerability has been publicly disclosed, but the vendor has not provided any response regarding the matter. Users of this CMS should take immediate action to secure their installations and mitigate related risks.",Iteachyou,Dreamer Cms,5.3,MEDIUM,0.01
CVE-2025-1539,CVE-2025-1539 - Proof of Concept,,https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-replace_special_char-Vulnerability-1960448e6195809c94f9fd2ff1f59bcf?pvs=4,refferences,,2025-02-21T15:00:14.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1539,Stack-based Buffer Overflow Vulnerability in D-Link DAP-1320 Products,"A security vulnerability has been identified in D-Link DAP-1320 version 1.00, specifically within the function replace_special_char in the file /storagein.pd-XXXXXX. This flaw allows for a stack-based buffer overflow, which can be exploited remotely by attackers. Notably, this vulnerability affects devices that are no longer supported by D-Link, further emphasizing the significance of maintaining updated and secure products. The exploit method has already been disclosed, raising concerns for users of the affected devices. It is crucial for D-Link DAP-1320 users to be aware of potential threats and take necessary precautions to safeguard their network.",D-link,Dap-1320,8.7,HIGH,0.01
CVE-2025-1538,CVE-2025-1538 - Proof of Concept,,https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-set_ws_action-Vulnerability-1950448e61958049be3cc606d434bc9d,refferences,,2025-02-21T15:00:08.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1538,Heap-based Buffer Overflow in D-Link DAP-1320 Vulnerable Function,"A significant vulnerability has been identified in the D-Link DAP-1320 version 1.00, specifically within the set_ws_action function of the /dws/api/ file. This flaw results in a heap-based buffer overflow, which could be exploited remotely, potentially allowing attackers to manipulate system behavior or gain unauthorized access. This vulnerability primarily affects devices that are no longer supported by D-Link, making it critical for users to assess their risk and consider necessary mitigations.",D-link,Dap-1320,8.7,HIGH,0.01
CVE-2025-1537,CVE-2025-1537 - Proof of Concept,,https://drive.google.com/file/d/10IspKbYh7TYmxRPRIQZ7oRg6Xise8ykJ/view?usp=sharing,refferences,,2025-02-21T14:31:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1537,SQL Injection Vulnerability in Harpia DiagSystem 12,"An SQL injection vulnerability exists in Harpia DiagSystem 12, specifically within the file /diagsystem/PACS/atualatendimento_jpeg.php. The flaw arises from improper handling of the input parameter 'codexame', allowing attackers to manipulate SQL queries. This vulnerability can be exploited remotely, posing significant risks to users if successfully targeted. The exploit has been publicized, and attempts to notify the vendor regarding the issue have gone unanswered.",Harpia,Diagsystem,5.3,MEDIUM,0.01
CVE-2025-1536,CVE-2025-1536 - Proof of Concept,,https://github.com/koishi0x01/CVE/blob/main/CVE_1.md,refferences,,2025-02-21T14:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1536,OS Command Injection Vulnerability in Raisecom Multi-Service Intelligent Gateway,"A vulnerability has been identified in the Raisecom Multi-Service Intelligent Gateway, specifically within the Request Parameter Handler of the /vpn/vpn_template_style.php file. This flaw allows for OS command injection due to improper handling of the 'stylenum' argument. Attackers can exploit this issue remotely, potentially leading to unauthorized command execution on the affected system. The vulnerability has been publicly disclosed, and despite attempts to inform Raisecom, no response has been received regarding a resolution.",Raisecom,Multi-service Intelligent Gateway,6.9,MEDIUM,0.01
CVE-2025-1535,CVE-2025-1535 - Proof of Concept,,https://github.com/sekaino-sakura/CVE/blob/main/CVE_2.md,refferences,,2025-02-21T12:00:14.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1535,SQL Injection Vulnerability in Baiyi Cloud Asset Management System by Hunan Zhonghe Baiyi Information Technology,"A SQL injection vulnerability exists in the Baiyi Cloud Asset Management System, specifically in the /wuser/admin.ticket.close.php file. This vulnerability enables attackers to manipulate the ticket_id parameter, which can lead to unauthorized access to the database. The exploit can be executed remotely, posing significant risks to data integrity and confidentiality. This vulnerability has been publicly disclosed, and the vendor has not responded to inquiries regarding its mitigation.",Baiyi,Cloud Asset Management System,6.9,MEDIUM,0.01
CVE-2024-13585,CVE-2024-13585 - Proof of Concept,,https://wpscan.com/vulnerability/270f213a-2fde-471c-ad09-2b44d11891ec/,refferences,,2025-02-21T06:00:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13585,Stored Cross-Site Scripting Vulnerability in Ajax Search Lite Plugin by WordPress,"The Ajax Search Lite WordPress plugin prior to version 4.12.5 is susceptible to Stored Cross-Site Scripting due to improper sanitization and escaping of certain settings. This vulnerability allows users with elevated privileges, including administrators, to execute malicious scripts, even in environments where the unfiltered_html capability is restricted, such as multisite installations. This poses a significant risk as it can compromise site security and user data.",WordPress,Ajax Search Lite,3.5,LOW,0.01
CVE-2024-13314,CVE-2024-13314 - Proof of Concept,,https://wpscan.com/vulnerability/ae234bbe-a4af-49f5-8e0a-4fb960821e05/,refferences,,2025-02-21T06:00:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13314,"Stored Cross-Site Scripting Vulnerability in Carousel, Slider, Gallery by WP Carousel Plugin","The Carousel, Slider, Gallery by WP Carousel WordPress plugin prior to version 2.7.4 is vulnerable due to inadequate sanitization and escaping of certain settings. This flaw allows users with elevated privileges, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks, even in environments where the unfiltered_html capability is restricted, such as multisite configurations. This vulnerability poses a significant risk for site integrity and user data security.",WordPress,"Carousel, Slider, Gallery By WP Carousel",3.5,LOW,0.01
CVE-2025-24971,CVE-2025-24971,CVE-2025-24971 exploit,https://github.com/be4zad/CVE-2025-24971,github,0,2025-02-21T01:59:27.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-24971,OS Command Injection Vulnerability in DumpDrop File Upload Application,"The DumpDrop file upload application has exposed an OS Command Injection vulnerability in its `/upload/init` endpoint. This issue arises when the Apprise Notification feature is enabled, allowing attackers to execute arbitrary code remotely. Users of affected DumpDrop versions are strongly advised to apply the security patch noted in the update commit `4ff8469d` to mitigate this risk, as no workarounds are available.",Dumbwareio,Dumbdrop,9.5,CRITICAL,0.0004299999854993075
CVE-2024-13481,CVE-2024-13481,LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injection,https://github.com/RandomRobbieBF/CVE-2024-13481,github,0,2025-02-21T00:52:41.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13481,SQL Injection Vulnerability in LTL Freight Quotes – R+L Carriers Edition Plugin for WordPress,"The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit the 'edit_id' and 'dropship_edit_id' parameters. Due to insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries, attackers can inject additional SQL statements. This can lead to the unauthorized extraction of sensitive data from the database, posing significant security risks for WordPress users utilizing this plugin.",Enituretechnology,Ltl Freight Quotes – R+l Carriers Edition,7.5,HIGH,0.0008699999889358878
CVE-2024-13479,CVE-2024-13479,LTL Freight Quotes – SEFL Edition <= 3.2.4 - Unauthenticated SQL Injection,https://github.com/RandomRobbieBF/CVE-2024-13479,github,0,2025-02-21T00:51:34.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13479,SQL Injection Vulnerability in LTL Freight Quotes Plugin for WordPress,"The LTL Freight Quotes – SEFL Edition plugin for WordPress is susceptible to SQL Injection through the 'dropship_edit_id' and 'edit_id' parameters. This vulnerability arises from inadequate escaping of user-supplied parameters and insufficient query preparation, allowing unauthenticated attackers to inject arbitrary SQL queries into existing queries. Consequently, this could lead to unauthorized access and extraction of sensitive data from the database, posing a significant security risk for WordPress site administrators and users.",Enituretechnology,Ltl Freight Quotes – Sefl Edition,7.5,HIGH,0.0008699999889358878
CVE-2024-13478,CVE-2024-13478,LTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL Injection,https://github.com/RandomRobbieBF/CVE-2024-13478,github,0,2025-02-21T00:50:10.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13478,SQL Injection Vulnerability in LTL Freight Quotes Plugin for WordPress,"The LTL Freight Quotes – TForce Edition plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit SQL Injection through the 'dropship_edit_id' and 'edit_id' parameters. This arises from inadequate input escaping and improper handling of SQL queries, enabling attackers to inject their own SQL commands. This flaw could lead to unauthorized access and extraction of sensitive data from the database, posing serious risks to the integrity of the affected WordPress installations.",Enituretechnology,Ltl Freight Quotes – Tforce Edition,7.5,HIGH,0.0008699999889358878
CVE-2024-13483,CVE-2024-13483,LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection,https://github.com/RandomRobbieBF/CVE-2024-13483,github,0,2025-02-21T00:48:57.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13483,SQL Injection Vulnerability in LTL Freight Quotes – SAIA Edition Plugin for WordPress,"The LTL Freight Quotes – SAIA Edition plugin for WordPress is susceptible to SQL Injection through the 'edit_id' and 'dropship_edit_id' parameters. This vulnerability is present in all versions up to and including 2.2.10 due to inadequate escaping of user-supplied input and the absence of proper preparation for the SQL query. Consequently, this flaw enables unauthorized attackers to inject additional SQL commands into existing queries, potentially leading to unauthorized access to sensitive data stored in the database.",Enituretechnology,Ltl Freight Quotes – Saia Edition,7.5,HIGH,0.0008699999889358878
CVE-2024-13485,CVE-2024-13485,LTL Freight Quotes – ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injection,https://github.com/RandomRobbieBF/CVE-2024-13485,github,0,2025-02-21T00:47:47.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13485,SQL Injection Vulnerability in LTL Freight Quotes – ABF Freight Edition Plugin for WordPress,"The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is susceptible to SQL Injection through the 'edit_id' and 'dropship_edit_id' parameters. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation in the SQL query, enabling unauthenticated attackers to inject and execute arbitrary SQL commands. By exploiting this flaw, attackers can potentially access sensitive information stored in the database, posing a significant risk to data confidentiality.",Enituretechnology,Ltl Freight Quotes – Abf Freight Edition,7.5,HIGH,0.0008699999889358878
CVE-2024-13489,CVE-2024-13489,LTL Freight Quotes – Old Dominion Edition <= 4.2.10 - Unauthenticated SQL Injection,https://github.com/RandomRobbieBF/CVE-2024-13489,github,0,2025-02-21T00:46:01.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13489,SQL Injection Risk in LTL Freight Quotes Plugin by WordPress,"The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is affected by a SQL Injection vulnerability through the 'edit_id' and 'dropship_edit_id' parameters. This flaw arises from inadequate escaping of user-supplied data and insufficient preparation of SQL queries. As a result, unauthenticated attackers could manipulate these parameters to inject malicious SQL queries, potentially gaining access to sensitive data stored within the database. All versions up to and including 4.2.10 are susceptible, necessitating immediate updates for mitigation.",Enituretechnology,Ltl Freight Quotes – Old Dominion Edition,7.5,HIGH,0.0008699999889358878
CVE-2024-13488,CVE-2024-13488,LTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injection,https://github.com/RandomRobbieBF/CVE-2024-13488,github,0,2025-02-21T00:33:26.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13488,SQL Injection Vulnerability in Estes Edition Plugin for WordPress,"The Estes Edition plugin for WordPress is susceptible to an SQL Injection vulnerability through the 'dropship_edit_id' and 'edit_id' parameters. Due to insufficient escaping of user-supplied inputs and the absence of adequate preparation of SQL queries, this flaw allows unauthenticated attackers to insert malicious SQL queries. This could lead to unauthorized access to sensitive information within the database, posing a significant security risk.",Enituretechnology,Ltl Freight Quotes – Estes Edition,7.5,HIGH,0.0006099999882280827
CVE-2024-2961,PHP-file-read-to-RCE-CVE-2024-2961-,"To use, implement the Remote class, which tells the exploit how to send the payload.",https://github.com/regantemudo/PHP-file-read-to-RCE-CVE-2024-2961-,github,0,2025-02-20T18:41:37.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-2961,Buffer Overflow Vulnerability in GNU C Library's iconv() Function,"The iconv() function in the GNU C Library (glibc) has a vulnerability that can cause a buffer overflow when converting strings to the ISO-2022-CN-EXT character set. This flaw occurs due to the function's failure to adequately check the size of the output buffer, allowing it to overflow by up to 4 bytes. Exploitation of this vulnerability could lead to unintended behavior in applications, such as crashing or overwriting adjacent memory locations. Applications utilizing glibc versions 2.39 and older are particularly at risk, highlighting the importance of updating to secure versions to mitigate potential attacks.",The Gnu C Library,Glibc,7.3,HIGH,0.0007099999929778278
CVE-2025-0108,CVE-2025-0108,PAN-OS CVE POC SCRIPT,https://github.com/sohaibeb/CVE-2025-0108,github,0,2025-02-20T01:00:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-0108,Authentication Bypass in Palo Alto Networks PAN-OS Software,"An authentication bypass vulnerability in Palo Alto Networks PAN-OS allows unauthenticated attackers with network access to the management web interface to bypass necessary authentication. This issue enables potential manipulation of certain PHP scripts by attackers, which could compromise the integrity and confidentiality of PAN-OS operations. To mitigate risks associated with this vulnerability, it is crucial to restrict access to the management web interface to trusted internal IP addresses, following recommended best practices.",Palo Alto Networks,"Cloud Ngfw,Pan-os,Prisma Access",5.9,MEDIUM,0.9553700089454651
CVE-2021-26291,MinimalReproducer,Context of CVE-2021-26291 minimal replicator,https://github.com/jpmartins/MinimalReproducer,github,0,2025-02-20T00:33:37.000Z,https://securityvulnerability.io/vulnerability/CVE-2021-26291,block repositories using http by default,"Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html",Apache,Apache Maven,9.1,CRITICAL,0.003530000103637576
CVE-2025-22654,CVE-2025-22654,Unrestricted Upload of File with Dangerous Type (CWE-434),https://github.com/McTavishSue/CVE-2025-22654,github,3,2025-02-19T23:18:33.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-22654,Arbitrary File Upload Vulnerability in Simplified by Kodeshpa,"The Simplified plugin by Kodeshpa contains a vulnerability that allows for the unrestricted upload of files with dangerous types. This flaw could enable attackers to upload malicious files to the server, posing significant security risks. Versions affected include all releases from n/a to 1.0.6, emphasizing the importance of timely updates and security patching to mitigate potential exploitation.",KodesHPa,Simplified,10,CRITICAL,0.0004299999854993075
CVE-2024-45870,Bandiview-7.05-Vuln-PoC,"CVE-2024-45870, CVE-2024-45871, CVE-2024-45872 | Bandiview 7.05 Vuln PoC",https://github.com/bshyuunn/Bandiview-7.05-Vuln-PoC,github,0,2025-02-19T21:21:40.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-45870,Incorrect Access Control Vulnerability Affects BandiView 7.05,Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.,Bandisoft,,,,0.0004299999854993075
CVE-2023-44487,CVE-2023-44487,POC for CVE-2023-44487,https://github.com/BMG-Black-Magic/CVE-2023-44487,github,0,2025-02-19T17:13:41.000Z,https://securityvulnerability.io/vulnerability/CVE-2023-44487,HTTP/2 Protocol Vulnerability Allows for Rapid Stream Cancellation and Denial of Service Attacks,"The HTTP/2 protocol is susceptible to a denial of service vulnerability that can be exploited via rapid stream resets. This allows attackers to overwhelm servers by rapidly canceling requests, leading to significant resource consumption and potential service disruption. Exploitation of this vulnerability has been observed in real-world scenarios between August and October 2023, prompting urgent response measures across multiple platforms and server technologies. Organizations utilizing affected products must evaluate their configurations to implement mitigations and safeguard against potential attacks.",Ietf,Http,7.5,HIGH,0.8008999824523926
CVE-2025-1465,CVE-2025-1465 - Proof of Concept,,https://github.com/NeoVuln/CVE/issues/6,refferences,,2025-02-19T15:31:05.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1465,Code Injection Vulnerability in LMXCMS Maintenance Component,"A code injection vulnerability has been identified in the maintenance component of LMXCMS version 1.41, specifically within the 'db.inc.php' file. This flaw allows an attacker to manipulate the system remotely, potentially injecting malicious code. Although the attack's complexity is notably high, the exploit has been made public, heightening the urgency for remediating this issue. Despite early disclosures to the vendor, no response or fix has been provided, leaving systems potentially exposed to attacks leveraging this vulnerability.",LMXCMS,Lmxcms,2.1,LOW,0.0006799999973736703
CVE-2025-1464,CVE-2025-1464 - Proof of Concept,,https://github.com/stevenchen0x01/CVE/issues/2,refferences,,2025-02-19T13:31:03.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1464,SQL Injection Vulnerability in Baiyi Cloud Asset Management System,"A vulnerability has been identified in the Baiyi Cloud Asset Management System affecting the admin.house.collect.php file. The flaw arises from inadequate validation of the project_id argument, allowing attackers to execute arbitrary SQL commands remotely. This weakness poses a significant risk as it can lead to unauthorized access to sensitive data. Despite being notified, the vendor has not issued any response regarding this disclosure. The vulnerability details have been made public, raising concerns about potential exploitation in the wild.",Baiyi,Cloud Asset Management System,6.9,MEDIUM,0.0005200000014156103
CVE-2024-12173,CVE-2024-12173 - Proof of Concept,,https://wpscan.com/vulnerability/0f35be0e-0f63-4e33-aa4d-c47b1f1e0595/,refferences,,2025-02-19T06:00:03.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-12173,Stored Cross-Site Scripting in Master Slider WordPress Plugin,"The Master Slider WordPress plugin prior to version 3.10.5 is susceptible to stored cross-site scripting vulnerabilities due to improper sanitization and escaping of its settings. This flaw can be exploited by users with high privileges, such as Editors and above, potentially allowing them to execute scripts in the context of affected pages, leading to unauthorized access or data leakage, even in configurations where the unfiltered_html capability is restricted.",WordPress,Master Slider,3.5,LOW,0.0004299999854993075
CVE-2024-13159,Ivanti-EPM-Coercion-Vulnerabilities,Proof of concept exploit for Ivanti EPM CVE-2024-13159 and others,https://github.com/horizon3ai/Ivanti-EPM-Coercion-Vulnerabilities,github,0,2025-02-19T05:14:34.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13159,Path Traversal Vulnerability in Ivanti Endpoint Manager Products,Ivanti Endpoint Manager is impacted by an absolute path traversal vulnerability that enables remote unauthenticated attackers to access and leak sensitive information. This issue affects Ivanti EPM versions released prior to the January 2025 security update. It is crucial for users of these products to apply the necessary security updates to mitigate the risks associated with this vulnerability.,Ivanti,Endpoint Manager,9.8,CRITICAL,0.0004299999854993075
CVE-2024-31903,ibm-sterling-b2b-integrator-poc,PoC code for the LPE and RCE (CVE-2024-31903) attacks against the IBM Sterling B2B Integrator,https://github.com/WithSecureLabs/ibm-sterling-b2b-integrator-poc,github,0,2025-02-19T04:08:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-31903,Arbitrary Code Execution Vulnerability in IBM Sterling B2B Integrator,"A vulnerability exists in IBM Sterling B2B Integrator Standard Edition that allows an attacker within the local network to execute arbitrary code on the system. This is due to improper deserialization of untrusted data, which can lead to exploitation of the affected versions. Proper validation of data is critical to preventing such security risks.",IBM,Sterling B2b Integrator Standard Edition,8.8,HIGH,0.0005300000193528831
CVE-2025-26465,CVE-2025-26465,MitM attack allowing a malicious interloper to impersonate a legitimate server when a client attempts to connect to it,https://github.com/rxerium/CVE-2025-26465,github,0,2025-02-19T01:53:27.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-26465,OpenSSH Vulnerability Allows Man-in-the-Middle Attack via Host Key Verification Flaw,"A significant vulnerability has been identified in OpenSSH when the VerifyHostKeyDNS option is activated. This flaw allows a malicious actor to conduct a man-in-the-middle attack by impersonating a legitimate server. The crux of the issue lies in the mishandling of error codes by OpenSSH during the host key verification process under certain conditions. For the attack to be successful, the attacker must first exhaust the client’s memory resources, which adds considerable complexity to the execution of the attack. It is crucial for users and administrators to be aware of this flaw and apply necessary mitigations to safeguard their systems.",Red Hat,"Red Hat Enterprise Linux 6,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Red Hat Openshift Container Platform 4",6.8,MEDIUM,0.0004299999854993075
CVE-2025-1448,CVE-2025-1448 - Proof of Concept,,https://github.com/stevenchen0x01/CVE/issues/1,refferences,,2025-02-19T01:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1448,Command Injection Vulnerability in Synway SMG Gateway Management Software,"A command injection vulnerability has been identified in Synway SMG Gateway Management Software that affects versions up to 20250204. This flaw arises from improper handling of the 'retry' argument in the file 9-12ping.php, allowing an attacker to execute arbitrary commands on the server remotely. The vulnerability has been publicly disclosed, increasing the risk of exploitation. Prompt attention to this issue is crucial for users of the affected software to mitigate potential security threats.",Synway,Smg Gateway Management Software,6.9,MEDIUM,0.0005200000014156103
CVE-2023-4911,CVE-2023-4911,CVE-2023-4911-Looney-Tunables,https://github.com/Billar42/CVE-2023-4911,github,0,2025-02-18T21:49:12.000Z,https://securityvulnerability.io/vulnerability/CVE-2023-4911,Buffer Overflow in GNU C Library's Dynamic Loader ld.so Could Allow Local Attacker to Execute Code with Elevated Privileges,"The first article discusses two different critical vulnerabilities in the GNU C Library (glibc) that allow unprivileged attackers to gain root access on multiple major Linux distributions. The vulnerabilities are tracked as CVE-2023-4911 and CVE-2023-6246 and both can lead to local privilege escalation. CVE-2023-4911 was already exploited by ransomware groups to steal cloud service provider (CSP) credentials in Kinsing malware attacks. The second vulnerability, CVE-2023-6246, was found in glibc's __vsyslog_internal() function and allows any unprivileged user to escalate privileges to full root access on default installations of various Linux distributions. The impact of these vulnerabilities is significant due to the widespread use of the affected library, and organizations are urged to ensure their systems are secure against these vulnerabilities.",Gnu,",Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 8.6 Extended Update Support,Red Hat Enterprise Linux 9,Red Hat Enterprise Linux 9.0 Extended Update Support,Red Hat Virtualization 4 For Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 6,Red Hat Enterprise Linux 7",7.8,HIGH,0.24763000011444092
CVE-2025-25163,CVE-2025-25163,Plugin A/B Image Optimizer <= 3.3 - Authenticated (Subscriber+) Arbitrary File Download,https://github.com/RandomRobbieBF/CVE-2025-25163,github,0,2025-02-18T19:25:40.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-25163,Path Traversal Vulnerability in A/B Image Optimizer Plugin by Zach Swetz,"A path traversal vulnerability has been identified in the A/B Image Optimizer plugin developed by Zach Swetz. This flaw allows attackers to access files outside the intended directory structure by manipulating file paths, potentially leading to unauthorized access to sensitive data on the server. Users of the affected plugin versions are advised to apply necessary security measures and consider updating to mitigate potential risks associated with this vulnerability.",Zach Swetz,Plugin A/b Image Optimizer,9.8,CRITICAL,0.000910000002477318
CVE-2021-3560,exploit_CVE-2021-3560,Exploitation Script for CVE-2021-3560,https://github.com/arcslash/exploit_CVE-2021-3560,github,0,2025-02-18T18:35:40.000Z,https://securityvulnerability.io/vulnerability/CVE-2021-3560,Privilege Escalation Vulnerability in Polkit Affecting Linux Systems,"A flaw in Polkit allows an unprivileged local attacker to bypass credential checks for D-Bus requests. This can lead to the elevation of privileges to that of the root user, enabling the attacker to execute commands with elevated permissions. This vulnerability poses a significant threat to the confidentiality of sensitive data, the integrity of system configurations, and can affect overall system availability.",Polkit Project,Polkit,7.8,HIGH,0.013690000399947166
CVE-2024-4367,CVE-2024-4367-PoC,"This Proof of Concept (PoC) demonstrates the exploitation of the CVE-2024-4367 vulnerability, which involves Cross-Site Scripting (XSS) attacks.",https://github.com/inpentest/CVE-2024-4367-PoC,github,0,2025-02-18T01:40:21.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-4367,Arbitrary JavaScript Execution Vulnerability in Firefox,"A vulnerability has been identified in PDF.js, specifically related to a missing type check when processing fonts. This oversight permits arbitrary JavaScript execution within the PDF.js environment. As a result, users of affected versions of Mozilla Firefox and Thunderbird could be vulnerable to potential attacks, where maliciously crafted PDF files may execute unintended scripts. The vulnerability impacts Firefox versions prior to 126, as well as Firefox ESR and Thunderbird versions earlier than 115.11. Users are urged to update to the latest versions to mitigate any risks associated with this issue.",Mozilla,"Firefox,Firefox Esr,Thunderbird",8.8,HIGH,0.0007399999885819852
CVE-2025-21420,CVE-2025-21420-PoC,We found a way to DLL sideload with cleanmgr.exe,https://github.com/Network-Sec/CVE-2025-21420-PoC,github,2,2025-02-17T17:59:22.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-21420,Elevation of Privilege Vulnerability in Windows Disk Cleanup Tool by Microsoft,"A vulnerability has been identified in the Windows Disk Cleanup Tool that may allow attackers to escalate privileges on affected systems. By exploiting this flaw, an unauthorized user could gain elevated access to system functions and potentially compromise the integrity of the system. It is crucial for users and administrators to apply the latest security updates to safeguard against such threats and ensure protection of sensitive data.",Microsoft,"Windows Server 2022,Windows Server 2019 (server Core Installation),Windows 10 Version 21h2,Windows 11 Version 22h2,Windows Server 2019,Windows 10 Version 22h2,Windows 10 Version 1809,Windows Server 2025 (server Core Installation),Windows 11 Version 22h3,Windows 11 Version 23h2,Windows Server 2022, 23h2 Edition (server Core Installation),Windows Server 2025,Windows 10 Version 1507,Windows 11 Version 24h2,Windows Server 2016,Windows 10 Version 1607,Windows Server 2016 (server Core Installation),Windows Server 2012 R2,Windows Server 2012 (server Core Installation),Windows Server 2012,Windows Server 2012 R2 (server Core Installation)",7.8,HIGH,0.0014600000577047467
CVE-2021-44967,CVE-2021-44967,POC for CVE-2021-44967: LimeSurvey RCE,https://github.com/godylockz/CVE-2021-44967,github,0,2025-02-17T13:55:23.000Z,https://securityvulnerability.io/vulnerability/CVE-2021-44967,Remote Code Execution Vulnerability in LimeSurvey by LimeSurvey Development Team,"A vulnerability exists in LimeSurvey 5.2.4 that permits remote code execution via the plugin upload and installation process. Attackers can exploit this weakness to upload arbitrary PHP code files, potentially compromising the integrity and security of the affected installation. This vulnerability highlights the importance of securing upload functionalities and ensuring that only authenticated users can perform such actions.",Limesurvey,Limesurvey,8.8,HIGH,0.08218000084161758
CVE-2025-1381,CVE-2025-1381 - Proof of Concept,,https://github.com/Lonpeak/cve/blob/main/upload-1.md,refferences,,2025-02-17T08:00:11.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1381,SQL Injection Vulnerability in Real Estate Property Management System by Code-Projects,"A serious vulnerability has been identified in the Real Estate Property Management System version 1.0 developed by Code-Projects, specifically within the /ajax_city.php file. This vulnerability allows for SQL injection through the manipulation of the CityName argument, enabling attackers to execute arbitrary SQL code. The attack can be carried out remotely, posing significant risk to the integrity of the database and potentially revealing sensitive data. Publicly disclosed exploits highlight the urgency for users to patch their systems to prevent unauthorized access.",Code-projects,Real Estate Property Management System,5.3,MEDIUM,0.00044999999227002263
CVE-2025-1380,CVE-2025-1380 - Proof of Concept,,https://www.yuque.com/polaris-pisym/aevk1q/fdkeqw2a2ug9zohn,refferences,,2025-02-17T07:00:15.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1380,SQL Injection Vulnerability in Codezips Gym Management System by Codezips,"A vulnerability exists in the Codezips Gym Management System 1.0, specifically related to the functionality in the file /dashboard/admin/del_plan.php. This security flaw stemmed from improper handling of input parameters, allowing an attacker to manipulate the 'name' argument to execute SQL injection attacks. Such vulnerabilities enable remote attackers to access, manipulate, or delete data within the database, potentially leading to severe impacts on data integrity and confidentiality. The exploit for this vulnerability has been publicly disclosed, raising concerns regarding the potential for widespread abuse.",Codezips,Gym Management System,5.3,MEDIUM,0.00044999999227002263
CVE-2025-1379,CVE-2025-1379 - Proof of Concept,,https://github.com/1337g/realestatepropertymanagement_poc/blob/main/gu3.pdf,refferences,,2025-02-17T06:31:04.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1379,SQL Injection Vulnerability in Code-Projects Real Estate Property Management System,"A vulnerability exists in the Code-Projects Real Estate Property Management System's /Admin/CustomerReport.php file due to improper handling of user input in the 'city' parameter. This weakness allows attackers to perform SQL injection attacks, enabling them to manipulate database queries and potentially access sensitive information. The exploit is accessible remotely, heightening the risk to users. Details of the exploit have been publicly disclosed, increasing the urgency for remediation.",Code-projects,Real Estate Property Management System,5.3,MEDIUM,0.00044999999227002263
CVE-2024-48990,CVE-2024-48990_needrestart,Exploit for CVE-2024-48990 - Privilege Escalation in Needrestart 3.7-3. For eductional purposes only,https://github.com/ten-ops/CVE-2024-48990_needrestart,github,0,2025-02-17T06:26:51.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-48990,Qualys: Needrestart Zero-Day Vulnerability Allows Root Access with PYTHONPATH Manipulation,"A vulnerability has been identified in Needrestart, the tool developed by Qualys, which prior to version 3.8, can be exploited by local attackers. This flaw allows attackers to execute arbitrary code with root privileges by manipulating the PYTHONPATH environment variable when Needrestart runs the Python interpreter. By taking advantage of this vulnerability, attackers can potentially execute malicious code due to insufficient validation of user-controlled environment variables.",Needrestart,Needrestart,7.8,HIGH,0.002529999939724803
CVE-2025-1378,CVE-2025-1378 - Proof of Concept,,https://github.com/radareorg/radare2/issues/23953#issue-2844325926,refferences,,2025-02-17T06:00:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2025-1378,Memory Corruption Vulnerability in radare2 Library by Radare.org,"A vulnerability exists in the radare2 toolset, specifically in the rasm2 component. This issue, found in the function located in /libr/main/rasm2.c, results in memory corruption that can be exploited through local access. Exploitation of this vulnerability may compromise system integrity, making it crucial for users of version 5.9.9 to upgrade to version 6.0.0 immediately to mitigate potential risks. Details of the patch, identified as c6c772d2eab692ce7ada5a4227afd50c355ad545, are available for review.",Radare.org,Radare2,4.8,MEDIUM,0.0004400000034365803
CVE-2024-13726,CVE-2024-13726 - Proof of Concept,,https://wpscan.com/vulnerability/ec226d22-0c09-4e7c-86ec-b64819089b60/,refferences,,2025-02-17T06:00:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13726,SQL Injection Vulnerability in Coder WordPress Plugin Affects Multiple Versions,"The Coder plugin for WordPress, up to version 1.3.4, allows unauthenticated users to execute arbitrary SQL code through an AJAX action, due to insufficient sanitization and escaping of parameters. This vulnerability can lead to unauthorized access and manipulation of the database, posing significant risks to website integrity and security.",WordPress,Themes Coder,8.6,HIGH,0.0005300000193528831
CVE-2024-13627,CVE-2024-13627 - Proof of Concept,,https://wpscan.com/vulnerability/f7e425a1-ae49-4ea6-abe4-42ba2713af8f/,refferences,,2025-02-17T06:00:09.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13627,Reflected Cross-Site Scripting Vulnerability in OWL Carousel Slider Plugin by WordPress,"The OWL Carousel Slider plugin for WordPress, up to version 2.2, contains a vulnerability that allows for reflected cross-site scripting. This occurs because the plugin fails to properly sanitize and escape a specific parameter when it is outputted back to the page. Attackers can exploit this flaw, potentially targeting high privilege users, such as administrators, to execute malicious scripts within the context of the affected site. Website administrators are strongly urged to update to the latest version of the plugin to mitigate risks.",WordPress,Owl Carousel Slider,4.7,MEDIUM,0.0004299999854993075
CVE-2024-13626,CVE-2024-13626 - Proof of Concept,,https://wpscan.com/vulnerability/511c6e7a-087f-41ef-9009-2525f332f8c6/,refferences,,2025-02-17T06:00:07.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13626,Reflected Cross-Site Scripting Vulnerability in VR-Frases WordPress Plugin,"The VR-Frases plugin for WordPress, up to version 3.0.1, is susceptible to a reflected cross-site scripting attack due to insufficient sanitization and escaping of user-supplied parameters. This vulnerability could allow attackers to execute scripts in the context of high-privilege users, such as administrators, potentially leading to unauthorized actions or data exposure directly through the affected web application. Proper input validation and escaping mechanisms are critical for securing user interactions.",WordPress,Vr-frases (collect & Share Quotes),7.1,HIGH,0.0004299999854993075
CVE-2024-13625,CVE-2024-13625 - Proof of Concept,,https://wpscan.com/vulnerability/6bfabf1d-86f2-4d29-bc55-d618d757dcc6/,refferences,,2025-02-17T06:00:06.000Z,https://securityvulnerability.io/vulnerability/CVE-2024-13625,Reflected Cross-Site Scripting in Tube Video Ads Lite Plugin by WordPress,"The Tube Video Ads Lite plugin for WordPress, versions up to 1.5.7, contains a vulnerability that allows for reflected cross-site scripting. This is due to the failure to properly sanitize and escape user-inputted parameters before rendering them on the webpage. Exploitation of this vulnerability could allow attackers to execute arbitrary JavaScript in the context of the user's browser, particularly affecting users with high privilege roles, such as administrators. Proper mitigation and updates are crucial to ensure the security of the application and its users.",WordPress,Tube Video Ads Lite,7.1,HIGH,0.0004299999854993075