## Updated at UTC 2025-07-06T23:13:28.206080

Access data as JSON

CVE CVSS EPSS Posts Repos Nuclei Updated Description
CVE-2025-7096 8.1 0.00% 2 0 2025-07-06T22:15:25.067000 A vulnerability classified as critical was found in Comodo Internet Security Pre
CVE-2025-5333 0 0.00% 2 0 2025-07-06T14:15:27.573000 Remote attackers can execute arbitrary code in the context of the vulnerable ser
CVE-2025-7079 3.7 0.00% 4 0 2025-07-06T13:15:35.413000 A vulnerability, which was classified as problematic, has been found in mao888 b
CVE-2025-7077 8.8 0.04% 1 0 2025-07-06T07:15:35.383000 A vulnerability classified as critical has been found in Shenzhen Libituo Techno
CVE-2025-27446 0 0.01% 3 0 2025-07-06T06:15:21.587000 Incorrect Permission Assignment for Critical Resource vulnerability in Apache AP
CVE-2025-53603 7.5 0.04% 1 0 2025-07-05T01:15:27.360000 In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m all
CVE-2025-53366 0 0.04% 1 0 2025-07-04T22:15:22.300000 The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Mode
CVE-2025-49809 7.8 0.01% 1 0 2025-07-04T13:15:25.780000 mtr through 0.95, in certain privileged contexts, mishandles execution of a prog
CVE-2025-52833 9.3 0.03% 1 0 2025-07-04T12:30:38 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2025-52831 9.3 0.03% 1 0 2025-07-04T12:30:38 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2025-52832 9.3 0.03% 1 0 2025-07-04T12:30:37 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2025-52830 9.3 0.03% 1 0 2025-07-04T12:30:37 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2025-49417 9.8 0.04% 1 0 2025-07-04T12:30:33 Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce P
CVE-2025-49414 10.0 0.04% 1 0 2025-07-04T12:30:33 Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW
CVE-2025-49867 9.8 0.04% 1 0 2025-07-04T12:30:33 Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes allows P
CVE-2025-28983 9.8 0.03% 1 0 2025-07-04T12:30:33 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2025-49302 10.0 0.05% 1 0 2025-07-04T12:30:32 Improper Control of Generation of Code ('Code Injection') vulnerability in Scott
CVE-2025-30933 10.0 0.04% 1 0 2025-07-04T12:30:32 Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes Lo
CVE-2025-23970 9.8 0.04% 1 0 2025-07-04T12:30:24 Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking
CVE-2025-5372 5.0 0.04% 1 0 2025-07-04T06:30:28 A flaw was found in libssh versions built with OpenSSL versions older than 3.0,
CVE-2025-49826 7.5 0.01% 1 0 2025-07-03T22:15:21.010000 Next.js is a React framework for building full-stack web applications. From vers
CVE-2025-43713 6.5 0.07% 1 0 2025-07-03T15:31:21 ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks a
CVE-2025-49618 5.8 0.03% 1 0 2025-07-03T15:31:20 In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal
CVE-2025-32463 9.3 0.01% 17 26 2025-07-03T15:14:12.767000 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswi
CVE-2025-4689 9.8 0.15% 1 0 2025-07-03T15:14:12.767000 The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for Word
CVE-2025-53107 7.5 0.13% 1 0 2025-07-03T15:14:12.767000 @cyanheads/git-mcp-server is an MCP server designed to interact with Git reposit
CVE-2025-53100 0 0.69% 1 0 2025-07-03T15:14:12.767000 RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform.
CVE-2025-37097 7.5 0.04% 1 0 2025-07-03T15:14:12.767000 A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may all
CVE-2025-34060 0 0.19% 1 0 2025-07-03T15:14:12.767000 A PHP objection injection vulnerability exists in the Monero Project’s Laravel-b
CVE-2025-49490 5.4 0.04% 1 0 2025-07-03T15:14:12.767000 Resource leak vulnerability in ASR180x in router allows Resource Leak Exposure.
CVE-2025-49483 5.4 0.04% 1 0 2025-07-03T15:14:12.767000 Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069
CVE-2025-49491 5.4 0.04% 1 0 2025-07-03T15:14:12.767000 Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、
CVE-2025-49521 8.8 0.09% 1 0 2025-07-03T15:14:12.767000 A flaw was found in the EDA component of the Ansible Automation Platform, where
CVE-2025-53110 0 0.06% 2 0 2025-07-03T15:13:53.147000 Model Context Protocol Servers is a collection of reference implementations for
CVE-2025-20310 6.1 0.04% 1 0 2025-07-03T15:13:53.147000 A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could all
CVE-2025-34072 0 0.08% 1 0 2025-07-03T15:13:53.147000 A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model C
CVE-2025-24329 6.4 0.02% 1 0 2025-07-03T15:13:53.147000 Sending a crafted SOAP "provision" operation message archive field within the Mo
CVE-2025-24335 2.0 0.02% 1 0 2025-07-03T15:13:53.147000 Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain
CVE-2025-24331 6.4 0.01% 1 0 2025-07-03T15:13:53.147000 The Single RAN baseband OAM service is intended to run as an unprivileged servic
CVE-2025-27025 8.8 0.36% 1 0 2025-07-03T15:13:53.147000 The target device exposes a service on a specific TCP port with a configured en
CVE-2025-1708 8.6 0.04% 1 0 2025-07-03T12:35:09 The application is vulnerable to SQL injection attacks. An attacker is able to d
CVE-2025-53109 None 0.06% 2 0 2025-07-02T18:56:41 Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintende
CVE-2025-53106 None 0.04% 1 0 2025-07-02T18:55:46 ### Impact Graylog users can gain elevated privileges by creating and using API
CVE-2025-20309 10.0 0.13% 9 0 2025-07-02T18:30:42 A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco U
CVE-2025-20307 4.8 0.03% 1 0 2025-07-02T18:30:42 A vulnerability in the web-based management interface of Cisco BroadWorks Applic
CVE-2025-20308 6.0 0.02% 1 0 2025-07-02T18:30:42 A vulnerability in Cisco Spaces Connector could allow an authenticated, local at
CVE-2025-48928 4.0 8.89% 3 0 2025-07-02T17:55:06.963000 The TeleMessage service through 2025-05-05 is based on a JSP application in whic
CVE-2025-24333 6.4 0.02% 1 0 2025-07-02T15:31:43 Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administ
CVE-2025-24332 7.1 0.02% 1 0 2025-07-02T15:31:43 Nokia Single RAN AirScale baseband allows an authenticated administrative user a
CVE-2025-24334 3.3 0.01% 1 0 2025-07-02T15:31:43 The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made t
CVE-2025-27021 7.0 0.01% 1 0 2025-07-02T15:31:43 The misconfiguration in the sudoers configuration of the operating system in In
CVE-2025-24330 6.4 0.02% 1 0 2025-07-02T15:31:42 Sending a crafted SOAP "provision" operation message PlanId field within the Mob
CVE-2025-24328 4.2 0.01% 1 0 2025-07-02T15:31:37 Sending a crafted SOAP "set" operation message within the Mobile Network Operato
CVE-2025-34067 None 0.38% 2 0 2025-07-02T15:30:44 An unauthenticated remote command execution vulnerability exists in the applyCT
CVE-2025-34071 None 0.28% 1 0 2025-07-02T15:30:44 A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attacker
CVE-2025-34069 None 0.14% 1 0 2025-07-02T15:30:44 An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to
CVE-2025-34070 None 0.12% 1 0 2025-07-02T15:30:37 A missing authentication vulnerability in the GFIAgent component of GFI Kerio Co
CVE-2025-48379 7.1 0.01% 1 0 2025-07-02T14:20:25 There is a heap buffer overflow when writing a sufficiently large (>64k encoded
CVE-2025-27022 7.5 0.06% 1 0 2025-07-02T12:33:13 Path traversal in WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows re
CVE-2025-4679 6.5 0.05% 1 0 2025-07-02T12:33:13 A vulnerability in Synology Active Backup for Microsoft 365 allows remote authen
CVE-2025-27024 6.5 0.04% 1 0 2025-07-02T12:32:17 Unrestricted access to OS file system in SFTP service in Infinera G42 version R
CVE-2025-27023 6.5 0.07% 1 0 2025-07-02T12:32:17 Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version
CVE-2024-13786 9.8 0.11% 1 0 2025-07-02T09:30:34 The education theme for WordPress is vulnerable to PHP Object Injection in all v
CVE-2025-6463 8.8 0.14% 4 0 2025-07-02T06:30:42 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f
CVE-2025-37099 9.8 0.18% 1 0 2025-07-01T18:30:47 A remote code execution vulnerability exists in HPE Insight Remote Support (IRS)
CVE-2025-6543 9.8 16.12% 4 3 2025-07-01T18:19:45.547000 Memory overflow vulnerability leading to unintended control flow and Denial of S
CVE-2025-47176 7.8 0.06% 3 0 2025-07-01T16:50:53.030000 '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute
CVE-2025-6897 5.5 0.23% 1 0 2025-07-01T16:30:28.957000 A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1.
CVE-2025-6554 8.1 6.66% 24 3 2025-07-01T15:32:11 Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote at
CVE-2025-34064 None 0.04% 1 0 2025-07-01T15:31:16 A cloud infrastructure misconfiguration in OneLogin AD Connector results in log
CVE-2025-37098 7.5 0.04% 1 0 2025-07-01T15:31:16 A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior
CVE-2025-34063 None 0.10% 1 0 2025-07-01T15:31:10 A cryptographic authentication bypass vulnerability exists in OneLogin AD Connec
CVE-2025-49480 7.4 0.04% 1 0 2025-07-01T12:31:05 Out-of-bounds access in ASR180x 、ASR190x in lte-telephony, This vulnerability
CVE-2025-49481 5.4 0.04% 1 0 2025-07-01T12:31:05 Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in route
CVE-2025-49488 5.4 0.04% 1 0 2025-07-01T12:31:05 Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in route
CVE-2025-49492 7.4 0.04% 1 0 2025-07-01T12:31:05 Out-of-bounds write in ASR180x in lte-telephony, May cause a buffer underrun. 
CVE-2025-49482 5.4 0.04% 1 0 2025-07-01T12:31:05 Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069
CVE-2025-49489 5.4 0.04% 1 0 2025-07-01T12:31:05 Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、
CVE-2025-5072 5.4 0.04% 1 0 2025-07-01T09:30:40 Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak E
CVE-2025-41656 10.0 0.14% 1 0 2025-07-01T09:30:40 An unauthenticated remote attacker can run arbitrary commands on the affected de
CVE-2025-41648 9.8 0.06% 1 0 2025-07-01T09:30:40 An unauthenticated remote attacker can bypass the login to the web application o
CVE-2025-6824 8.8 0.17% 1 0 2025-07-01T03:31:37 A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.
CVE-2025-49520 8.8 0.09% 1 0 2025-07-01T03:31:36 A flaw was found in Ansible Automation Platform’s EDA component where user-suppl
CVE-2025-26074 9.8 0.15% 1 0 2025-06-30T22:16:54 Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS command
CVE-2025-32462 2.8 0.02% 11 7 2025-06-30T21:30:54 Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that i
CVE-2025-6916 8.8 0.07% 1 1 2025-06-30T21:15:32.730000 A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.
CVE-2025-45931 9.8 0.35% 1 0 2025-06-30T19:15:24.117000 An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote a
CVE-2025-47824 2.0 0.01% 1 0 2025-06-30T18:38:48.477000 Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have c
CVE-2025-6881 8.8 0.05% 1 0 2025-06-30T18:38:23.493000 A vulnerability was found in D-Link DI-8100 16.07.21. It has been rated as criti
CVE-2025-6825 8.8 0.16% 1 0 2025-06-30T18:38:23.493000 A vulnerability classified as critical was found in TOTOLINK A702R up to 4.0.0-B
CVE-2025-6522 5.4 0.04% 1 0 2025-06-30T18:38:23.493000 Unauthenticated users on an adjacent network with the Sight Bulb Pro can run sh
CVE-2025-53391 9.3 0.01% 1 0 2025-06-30T18:38:23.493000 The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.
CVE-2025-24290 9.9 0.04% 1 0 2025-06-30T15:30:38 Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (
CVE-2025-6899 6.3 0.84% 1 0 2025-06-30T09:30:35 A vulnerability, which was classified as critical, was found in D-Link DI-7300G+
CVE-2025-6898 6.3 0.84% 1 0 2025-06-30T09:30:30 A vulnerability, which was classified as critical, has been found in D-Link DI-7
CVE-2025-6896 6.3 0.84% 1 0 2025-06-30T09:30:30 A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.
CVE-2025-6887 8.8 0.08% 1 0 2025-06-30T06:30:33 A vulnerability was found in Tenda AC5 15.03.06.47 and classified as critical. A
CVE-2025-6886 8.8 0.08% 2 0 2025-06-30T06:30:33 A vulnerability has been found in Tenda AC5 15.03.06.47 and classified as critic
CVE-2025-6882 8.8 0.05% 1 0 2025-06-30T03:30:39 A vulnerability classified as critical has been found in D-Link DIR-513 1.0. Thi
CVE-2025-45729 6.3 0.07% 1 0 2025-06-27T21:31:30 D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized u
CVE-2025-6620 6.3 2.28% 1 0 2025-06-27T18:31:47 A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as c
CVE-2025-6618 6.3 2.28% 1 0 2025-06-27T18:31:47 A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified
CVE-2025-6621 6.3 2.28% 1 0 2025-06-27T18:31:47 A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c
CVE-2025-6619 6.3 2.28% 1 0 2025-06-27T18:31:47 A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared a
CVE-2025-6568 8.8 0.17% 1 0 2025-06-27T18:30:43 A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2c
CVE-2025-6705 None 0.05% 1 0 2025-06-27T15:31:41 On open-vsx.org http://open-vsx.org/  it was possible to run an arbitrary build
CVE-2024-51978 9.8 2.68% 1 1 template 2025-06-27T14:15:32.593000 An unauthenticated attacker who knows the target device's serial number, can gen
CVE-2024-54085 9.8 9.47% 1 1 2025-06-27T12:32:19 AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authe
CVE-2025-6752 8.8 0.09% 1 0 2025-06-27T06:31:22 A vulnerability has been found in Linksys WRT1900ACS, EA7200, EA7450 and EA7500
CVE-2025-6751 8.8 0.09% 1 0 2025-06-27T06:31:22 A vulnerability, which was classified as critical, was found in Linksys E8450 up
CVE-2025-47819 6.4 0.02% 1 0 2025-06-27T03:30:47 Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interfac
CVE-2025-47821 2.2 0.02% 1 0 2025-06-27T03:30:47 Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for
CVE-2025-47822 6.4 0.02% 1 0 2025-06-27T03:30:47 Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a
CVE-2025-47823 2.2 0.02% 1 0 2025-06-27T03:30:47 Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a
CVE-2025-47818 2.2 0.02% 1 0 2025-06-27T03:30:41 Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for
CVE-2025-6734 8.8 0.05% 1 0 2025-06-27T00:32:15 A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been rate
CVE-2025-6732 8.8 0.05% 1 0 2025-06-27T00:32:15 A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been clas
CVE-2025-6627 8.8 0.16% 1 0 2025-06-26T21:31:22 A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classi
CVE-2025-6616 8.8 0.09% 1 0 2025-06-26T21:31:21 A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as crit
CVE-2025-6614 8.8 0.09% 1 0 2025-06-26T21:31:20 A vulnerability, which was classified as critical, has been found in D-Link DIR-
CVE-2025-20281 9.8 0.14% 1 4 2025-06-26T21:31:20 A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an
CVE-2025-6615 8.8 0.09% 1 0 2025-06-26T21:31:13 A vulnerability, which was classified as critical, was found in D-Link DIR-619L
CVE-2025-20282 10.0 0.14% 1 0 2025-06-26T21:31:13 A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an
CVE-2025-32977 9.7 0.02% 1 0 2025-06-26T21:31:13 Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x bef
CVE-2025-6565 8.8 0.19% 1 0 2025-06-26T21:31:09 A vulnerability was found in Netgear WNCE3001 1.0.0.50. It has been classified a
CVE-2025-36537 7.0 0.01% 1 0 2025-06-26T21:31:09 Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (
CVE-2025-32976 8.8 0.10% 1 0 2025-06-26T21:31:09 Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x bef
CVE-2025-34037 None 2.46% 1 0 2025-06-26T21:31:08 An OS command injection vulnerability exists in various models of E-Series Links
CVE-2025-6559 9.8 0.62% 1 0 2025-06-26T21:31:08 Multiple wireless router models from Sapido have an OS Command Injection vulnera
CVE-2025-32975 10.0 0.12% 1 0 2025-06-26T21:31:08 Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x bef
CVE-2025-34034 None 0.05% 1 0 2025-06-26T21:31:08 A hardcoded credential vulnerability exists in the Blue Angel Software Suite dep
CVE-2025-34041 None 1.03% 1 0 2025-06-26T21:31:08 An OS command injection vulnerability exists in the Chinese versions of Sangfor
CVE-2025-6560 9.8 0.11% 1 0 2025-06-26T18:58:14.280000 Multiple wireless router models from Sapido have an Exposure of Sensitive Inform
CVE-2025-48469 9.6 0.04% 1 0 2025-06-26T18:58:14.280000 Successful exploitation of the vulnerability could allow an unauthenticated atta
CVE-2025-52570 0 0.06% 1 0 2025-06-26T18:58:14.280000 Letmein is an authenticating port knocker. Prior to version 10.2.1, The connecti
CVE-2025-52562 10.0 1.48% 1 0 2025-06-26T18:58:14.280000 Convoy is a KVM server management panel for hosting businesses. In versions 3.9.
CVE-2025-32978 7.5 0.06% 1 0 2025-06-26T18:58:14.280000 Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x bef
CVE-2025-34049 0 0.63% 1 0 2025-06-26T18:57:43.670000 An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router
CVE-2025-34042 0 0.66% 1 0 2025-06-26T18:57:43.670000 An authenticated command injection vulnerability exists in the Beward N100 IP Ca
CVE-2025-6617 8.8 0.09% 1 0 2025-06-26T18:57:43.670000 A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical.
CVE-2025-36038 9.0 0.24% 1 0 2025-06-26T18:57:43.670000 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to ex
CVE-2024-6174 8.8 0.02% 1 0 2025-06-26T18:57:43.670000 When a non-x86 platform is detected, cloud-init grants root access to a hardcode
CVE-2025-34043 None 0.40% 1 0 2025-06-26T18:31:35 A remote command injection vulnerability exists in Vacron Network Video Recorder
CVE-2025-34044 None 0.12% 1 0 2025-06-26T18:31:34 A remote command injection vulnerability exists in the confirm.php interface of
CVE-2025-34048 None 0.26% 1 0 2025-06-26T18:31:34 A path traversal vulnerability exists in the web management interface of D-Link
CVE-2025-6400 8.8 0.17% 1 0 2025-06-25T20:13:52.420000 A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101 and classified
CVE-2025-6399 8.8 0.17% 1 0 2025-06-25T20:13:30.100000 A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0
CVE-2025-6372 8.8 0.03% 1 0 2025-06-25T20:09:56.243000 A vulnerability, which was classified as critical, was found in D-Link DIR-619L
CVE-2025-6369 8.8 0.03% 1 0 2025-06-25T20:09:28.010000 A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01
CVE-2025-44531 7.5 0.05% 1 0 2025-06-24T21:30:28 An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause
CVE-2024-56731 10.0 0.33% 1 0 2025-06-24T19:00:21 ### Summary Due to the insufficient patch for the CVE-2024-39931, it's still pos
CVE-2025-6374 8.8 0.03% 1 0 2025-06-23T21:31:56 A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical.
CVE-2025-6402 8.8 0.16% 1 0 2025-06-23T21:31:56 A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been decl
CVE-2025-6511 8.8 0.19% 1 0 2025-06-23T20:16:21.633000 A vulnerability classified as critical has been found in Netgear EX6150 1.0.0.46
CVE-2025-34029 0 1.10% 1 0 2025-06-23T20:16:21.633000 An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmw
CVE-2025-34021 0 0.06% 1 0 2025-06-23T20:16:21.633000 A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targ
CVE-2025-27636 5.6 43.34% 2 2 2025-06-23T18:54:52.400000 Bypass/Injection vulnerability in Apache Camel components under particular condi
CVE-2025-6510 8.8 0.19% 1 0 2025-06-23T18:30:33 A vulnerability was found in Netgear EX6100 1.0.2.28_1.1.138. It has been rated
CVE-2025-6393 8.8 0.65% 1 0 2025-06-23T15:31:43 A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B
CVE-2025-6486 8.8 0.14% 1 0 2025-06-22T18:30:39 A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been d
CVE-2025-6487 8.8 0.14% 1 0 2025-06-22T18:30:31 A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been r
CVE-2025-6371 8.8 0.06% 1 0 2025-06-21T00:30:38 A vulnerability, which was classified as critical, has been found in D-Link DIR-
CVE-2025-6370 8.8 0.03% 1 0 2025-06-21T00:30:38 A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01. Aff
CVE-2025-6368 8.8 0.03% 1 0 2025-06-21T00:30:37 A vulnerability was found in D-Link DIR-619L 2.06B01. It has been rated as criti
CVE-2025-6373 8.8 0.03% 1 0 2025-06-21T00:30:37 A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as crit
CVE-2025-49132 10.0 23.69% 1 6 template 2025-06-20T22:21:17 ## Impact Using the `/locales/locale.json` with the `locale` and `namespace` qu
CVE-2025-6367 8.8 0.03% 1 0 2025-06-20T21:32:14 A vulnerability was found in D-Link DIR-619L 2.06B01. It has been declared as cr
CVE-2025-34024 None 0.64% 1 0 2025-06-20T21:32:14 An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware v
CVE-2025-34022 None 0.26% 1 0 2025-06-20T21:32:13 A path traversal vulnerability exists in multiple models of Selea Targa IP OCR-A
CVE-2025-5777 None 4.17% 17 6 template 2025-06-17T15:31:16 Insufficient input validation leading to memory overread on the NetScaler Manage
CVE-2025-49596 None 0.52% 2 1 2025-06-13T22:15:27 Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution d
CVE-2025-22157 8.8 0.05% 1 0 2025-06-12T18:31:14 This High severity PrivEsc (Privilege Escalation) vulnerability was introduced i
CVE-2025-33073 8.8 0.39% 1 2 2025-06-12T16:06:39.330000 Improper access control in Windows SMB allows an authorized attacker to elevate
CVE-2025-48927 5.3 11.15% 3 0 2025-05-28T18:33:28 The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with
CVE-2010-2772 7.8 0.08% 1 0 2025-04-11T00:51:21.963000 Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which a
CVE-2025-24813 9.8 93.98% 2 37 template 2025-04-03T13:23:54 Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution an
CVE-2025-29891 4.2 0.09% 2 0 2025-03-19T15:44:53 Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel
CVE-2025-1094 8.1 83.63% 1 5 2025-02-21T18:31:09 Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescape
CVE-2024-55591 9.8 94.25% 1 10 template 2025-01-14T15:31:02 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-2
CVE-2019-11932 8.8 80.16% 1 21 2025-01-13T15:21:41 A double free vulnerability in the DDGifSlurp function in decoding.c in the andr
CVE-2024-56337 None 9.71% 2 1 2025-01-08T16:05:13 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat
CVE-2024-50379 9.8 88.89% 1 16 2025-01-03T12:30:31 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compi
CVE-2024-12856 7.2 77.16% 1 1 2024-12-27T18:15:23.677000 The Four-Faith router models F3x24 and F3x36 are affected by an operating system
CVE-2024-39931 10.0 1.37% 1 0 2024-12-23T20:38:21 ### Impact Unprivileged user accounts can execute arbitrary commands on the Gog
CVE-2024-6874 4.3 0.24% 2 0 2024-11-21T09:50:26.493000 libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_g
CVE-2024-3721 6.3 57.40% 1 0 2024-04-13T12:30:30 A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classi
CVE-2023-36934 9.1 93.06% 1 0 template 2024-04-04T05:23:52 In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.
CVE-2023-34362 9.8 94.48% 2 11 template 2024-04-04T04:29:06 In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.
CVE-2022-38392 5.3 0.08% 1 0 2023-09-18T05:03:19 A certain 5400 RPM OEM hard drive, as shipped with laptop PCs in approximately 2
CVE-2025-48952 0 0.06% 3 0 N/A
CVE-2025-1735 0 0.00% 1 0 N/A
CVE-2025-47812 0 0.00% 4 4 template N/A
CVE-2025-53367 0 0.01% 2 0 N/A
CVE-2025-52891 0 0.05% 1 0 N/A
CVE-2025-0038 0 0.00% 1 0 N/A
CVE-2025-49588 0 0.04% 1 0 N/A
CVE-2025-48703 0 0.00% 1 2 N/A
CVE-2025-49144 0 0.01% 2 6 N/A
CVE-2025-53104 0 0.27% 1 0 N/A
CVE-2025-53094 0 0.06% 1 0 N/A

CVE-2025-7096
(8.1 HIGH)

EPSS: 0.00%

updated 2025-07-06T22:15:25.067000

2 posts

A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be diffic

cR0w at 2025-07-06T22:18:25.182Z ##

drive.google.com/file/d/1qnWar

sev:CRIT 9.2 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvd.nist.gov/vuln/detail/CVE-2

##

cR0w@infosec.exchange at 2025-07-06T22:18:25.000Z ##

drive.google.com/file/d/1qnWar

sev:CRIT 9.2 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-5333
(0 None)

EPSS: 0.00%

updated 2025-07-06T14:15:27.573000

2 posts

Remote attackers can execute arbitrary code in the context of the vulnerable service process.

cR0w at 2025-07-06T14:03:25.887Z ##

Fuck Broadcom. I would love to provide more details but I don't have a login. Go hack some Symantec IT Management Suite shit.

support.broadcom.com/web/ecx/s

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:I/V:C/RE:L/U:Red

Remote attackers can execute arbitrary code in the context of the vulnerable service process.

nvd.nist.gov/vuln/detail/CVE-2

##

cR0w@infosec.exchange at 2025-07-06T14:03:25.000Z ##

Fuck Broadcom. I would love to provide more details but I don't have a login. Go hack some Symantec IT Management Suite shit.

support.broadcom.com/web/ecx/s

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:I/V:C/RE:L/U:Red

Remote attackers can execute arbitrary code in the context of the vulnerable service process.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-7079
(3.7 LOW)

EPSS: 0.00%

updated 2025-07-06T13:15:35.413000

4 posts

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an atta

0xThiebaut at 2025-07-06T16:03:16.286Z ##

@cR0w is that the correct CVE link? CVE-2025-7079 seems unrelated to Broadcom

##

cR0w at 2025-07-06T13:01:14.001Z ##

Since the latest release is two years old, I don't expect many people use this. But have another hardcoded JWT secret.

github.com/mao888/bluebell-plu

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

nvd.nist.gov/vuln/detail/CVE-2

##

0xThiebaut@infosec.exchange at 2025-07-06T16:03:16.000Z ##

@cR0w is that the correct CVE link? CVE-2025-7079 seems unrelated to Broadcom

##

cR0w@infosec.exchange at 2025-07-06T13:01:14.000Z ##

Since the latest release is two years old, I don't expect many people use this. But have another hardcoded JWT secret.

github.com/mao888/bluebell-plu

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-7077
(8.8 HIGH)

EPSS: 0.04%

updated 2025-07-06T07:15:35.383000

1 posts

A vulnerability classified as critical has been found in Shenzhen Libituo Technology LBT-T300-T310 up to 2.2.3.6. This affects the function config_3g_para of the file /appy.cgi. The manipulation of the argument username_3g/password_3g leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be aff

offseq at 2025-07-06T07:31:17.276Z ##

🔎 High severity buffer overflow (CVSS 8.7) in Shenzhen Libituo LBT-T300-T310 (2.2.3.0–2.2.3.6). Remote exploit via /appy.cgi—no patch yet, public exploit disclosed. Restrict access & monitor now. CVE-2025-7077 radar.offseq.com/threat/cve-20

##

CVE-2025-27446
(0 None)

EPSS: 0.01%

updated 2025-07-06T06:15:21.587000

3 posts

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0. Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

cR0w at 2025-07-06T12:40:20.410Z ##

PrivEsc in Apache APISIX.

lists.apache.org/thread/qwxnxo

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges.
This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

nvd.nist.gov/vuln/detail/CVE-2

##

offseq at 2025-07-06T09:01:03.705Z ##

🛡️ HIGH severity: CVE-2025-27446 in Apache APISIX Java Plugin Runner (0.2.0–0.5.0) allows local privilege escalation via incorrect file permissions. Upgrade to 0.6.0+ ASAP. radar.offseq.com/threat/cve-20

##

cR0w@infosec.exchange at 2025-07-06T12:40:20.000Z ##

PrivEsc in Apache APISIX.

lists.apache.org/thread/qwxnxo

Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).

Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges.
This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.

Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-53603
(7.5 HIGH)

EPSS: 0.04%

updated 2025-07-05T01:15:27.360000

1 posts

In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.

offseq at 2025-07-06T06:01:05.992Z ##

🛑 HIGH severity: Alinto SOPE SOGo (2.0.2–5.12.2) is vulnerable to remote DoS (CVE-2025-53603) via NULL pointer dereference in sope-core/NGHashMap.m. No auth required. Patch pending—use WAF/rate limits. More info: radar.offseq.com/threat/cve-20

##

CVE-2025-53366
(0 None)

EPSS: 0.04%

updated 2025-07-04T22:15:22.300000

1 posts

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level

offseq at 2025-07-06T10:31:19.089Z ##

⚠️ MCP Python SDK (<1.9.4) has a HIGH severity vuln (CVE-2025-53366): malformed requests can crash services via uncaught exceptions (DoS). Patch by upgrading to 1.9.4+ and boost input validation! radar.offseq.com/threat/cve-20

##

CVE-2025-49809
(7.8 HIGH)

EPSS: 0.01%

updated 2025-07-04T13:15:25.780000

1 posts

mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.

cR0w@infosec.exchange at 2025-07-04T14:02:25.000Z ##

Never had this problem with traceroute. ducks

github.com/Homebrew/homebrew-c

sev:HIGH 7.8 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-52833
(9.3 CRITICAL)

EPSS: 0.03%

updated 2025-07-04T12:30:38

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS allows SQL Injection. This issue affects LMS: from n/a through 9.1.

offseq at 2025-07-06T01:31:20.163Z ##

🔴 CRITICAL: CVE-2025-52833 (CVSS 9.3) hits designthemes LMS ≤9.1. Remote SQL Injection—no patch yet. Protect user data: enable WAFs, validate inputs, monitor queries. More: radar.offseq.com/threat/cve-20

##

CVE-2025-52831
(9.3 CRITICAL)

EPSS: 0.03%

updated 2025-07-04T12:30:38

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager allows SQL Injection. This issue affects Video List Manager: from n/a through 1.7.

offseq at 2025-07-05T10:31:19.328Z ##

⚠️ CRITICAL: CVE-2025-52831 in thanhtungtnt Video List Manager (≤1.7) enables unauthenticated SQL Injection—data theft risk, no patch yet. Restrict access, use WAF, and monitor traffic! radar.offseq.com/threat/cve-20

##

CVE-2025-52832
(9.3 CRITICAL)

EPSS: 0.03%

updated 2025-07-04T12:30:37

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search allows SQL Injection. This issue affects NGG Smart Image Search: from n/a through 3.4.1.

offseq at 2025-07-06T00:01:07.394Z ##

🚨 CVE-2025-52832: CRITICAL SQLi in wpo-HR NGG Smart Image Search (≤3.4.1). No patch yet—disable plugin, use WAF, monitor logs. High risk to sensitive data & compliance. radar.offseq.com/threat/cve-20

##

CVE-2025-52830
(9.3 CRITICAL)

EPSS: 0.03%

updated 2025-07-04T12:30:37

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bsecuretech bSecure &#8211; Your Universal Checkout allows Blind SQL Injection. This issue affects bSecure &#8211; Your Universal Checkout: from n/a through 1.7.9.

offseq at 2025-07-05T09:01:02.196Z ##

🛡️ CRITICAL SQL Injection (CVE-2025-52830) in bSecure – Your Universal Checkout ≤1.7.9. Blind SQLi enables remote data exposure—no auth needed. E-commerce risk is high! Mitigate ASAP: WAF, DB least-priv, input validation. radar.offseq.com/threat/cve-20

##

CVE-2025-49417
(9.8 CRITICAL)

EPSS: 0.04%

updated 2025-07-04T12:30:33

1 posts

Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action allows Object Injection. This issue affects WooCommerce Product Multi-Action: from n/a through 1.3.

offseq at 2025-07-06T04:31:18.584Z ##

🚩 CRITICAL: CVE-2025-49417 in BestWpDeveloper WooCommerce Product Multi-Action (≤1.3) enables unauthenticated object injection via unsafe deserialization. Full site compromise possible—disable plugin now! radar.offseq.com/threat/cve-20

##

CVE-2025-49414
(10.0 CRITICAL)

EPSS: 0.04%

updated 2025-07-04T12:30:33

1 posts

Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery allows Using Malicious Files. This issue affects FW Gallery: from n/a through 8.0.0.

offseq at 2025-07-06T03:01:01.431Z ##

🚨 CVE-2025-49414: CRITICAL vuln in Fastw3b FW Gallery (<=8.0.0). Unrestricted file upload flaw can lead to full server compromise—no patch yet. Disable uploads & enforce strict validation! radar.offseq.com/threat/cve-20

##

CVE-2025-49867
(9.8 CRITICAL)

EPSS: 0.04%

updated 2025-07-04T12:30:33

1 posts

Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes allows Privilege Escalation. This issue affects RealHomes: from n/a through 4.4.0.

offseq at 2025-07-05T07:31:36.765Z ##

⚠️ CVE-2025-49867: CRITICAL privilege escalation in InspiryThemes RealHomes ≤4.4.0. Unauthenticated remote attackers can gain admin rights. Restrict admin access, monitor logs, deploy WAF rules until patch. radar.offseq.com/threat/cve-20

##

CVE-2025-28983
(9.8 CRITICAL)

EPSS: 0.03%

updated 2025-07-04T12:30:33

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.

offseq at 2025-07-05T03:01:04.119Z ##

🔴 CRITICAL (CVSS 9.8) SQL Injection in Click & Pledge Connect (v25.04010101–WP6.8) enables unauthenticated privilege escalation & data access. No patch yet—deploy WAF, restrict access, monitor closely. CVE-2025-28983 radar.offseq.com/threat/cve-20

##

CVE-2025-49302
(10.0 CRITICAL)

EPSS: 0.05%

updated 2025-07-04T12:30:32

1 posts

Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson Easy Stripe allows Remote Code Inclusion. This issue affects Easy Stripe: from n/a through 1.1.

offseq at 2025-07-05T06:00:58.882Z ##

🚨 CVE-2025-49302: CRITICAL code injection in Easy Stripe (≤1.1). Allows unauth RCE—no patch yet. Isolate systems, deploy WAFs, monitor for exploit attempts, & consider disabling. Details: radar.offseq.com/threat/cve-20

##

CVE-2025-30933
(10.0 CRITICAL)

EPSS: 0.04%

updated 2025-07-04T12:30:32

1 posts

Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub allows Upload a Web Shell to a Web Server. This issue affects LogisticsHub: from n/a through 1.1.6.

offseq at 2025-07-05T04:31:17.457Z ##

🚨 CVE-2025-30933 (CRITICAL, CVSS 10): LiquidThemes LogisticsHub ≤1.1.6 is vulnerable to unrestricted file uploads. Remote attackers can deploy web shells for total server compromise. Disable uploads & monitor now! radar.offseq.com/threat/cve-20

##

CVE-2025-23970
(9.8 CRITICAL)

EPSS: 0.04%

updated 2025-07-04T12:30:24

1 posts

Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking allows Privilege Escalation. This issue affects Service Finder Booking: from n/a through 6.0.

offseq at 2025-07-05T01:31:16.859Z ##

CVE-2025-23970: CRITICAL flaw in Service Finder Booking (≤6.0) allows unauth’d privilege escalation 🚨. No patch yet—restrict access, deploy WAF, monitor logs. Major risk for EU orgs handling bookings! radar.offseq.com/threat/cve-20

##

CVE-2025-5372
(5.0 MEDIUM)

EPSS: 0.04%

updated 2025-07-04T06:30:28

1 posts

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographi

cR0w@infosec.exchange at 2025-07-04T13:14:05.000Z ##

Okay, this one's kind of funny. 1s and 0s are hard.

access.redhat.com/security/cve

sev:MED 5.0 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-49826
(7.5 HIGH)

EPSS: 0.01%

updated 2025-07-03T22:15:21.010000

1 posts

Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being se

cR0w@infosec.exchange at 2025-07-03T21:44:13.000Z ##

sev:HIGH cache poisoning vuln in next dot js.

github.com/vercel/next.js/secu

A vulnerability affecting Next.js has been addressed. It impacted versions >=15.1.0 <15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.

Edit to add the CVE: cve.org/CVERecord?id=CVE-2025-

##

CVE-2025-43713
(6.5 MEDIUM)

EPSS: 0.07%

updated 2025-07-03T15:31:21

1 posts

ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows system services that support license key management and deprecated Windows network authentication. The services are implemented with .NET remoting and can be exploited via well-known deserialization techniques inherent in the technology. Because the services run with SYSTEM-level

cR0w@infosec.exchange at 2025-07-03T13:53:32.000Z ##

asna.com/en/kb/security-update

This vulnerability affects only our Windows-based products. DataGate for IBM i is not affected. Our Visual RPG (for .NET and Classic), Wings, Mobile RPG, and DataGate for SQL Server are affected by this vulnerability and need to be updated.

The vulnerability exists only on the network where Windows machines are running the affected ASNA Assist or ASNA Registrar services. The threat is present only when these vulnerable services are running and an untrusted user has Windows network access (e.g., via a malicious intruder or a disgruntled employee).

ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows system services that support license key management and deprecated Windows network authentication. The services are implemented with .NET remoting and can be exploited via well-known deserialization techniques inherent in the technology. Because the services run with SYSTEM-level rights, exploits can be crafted to achieve escalation of privilege and arbitrary code execution. This affects DataGate for SQL Server 17.0.36.0 and 16.0.89.0, DataGate Component Suite 17.0.36.0 and 16.0.89.0, DataGate Monitor 17.0.26.0 and 16.0.65.0, DataGate WebPak 17.0.37.0 and 16.0.90.0, Monarch for .NET 11.4.50.0 and 10.0.62.0, Encore RPG 4.1.36.0, Visual RPG .NET FW 17.0.37.0 and 16.0.90.0, Visual RPG .NET FW Windows Deployment 17.0.36.0 and 16.0.89.0, WingsRPG 11.0.38.0 and 10.0.95.0, Mobile RPG 11.0.35.0 and 10.0.94.0, Monarch Framework for .NET FW 11.0.36.0 and 10.0.89.0, Browser Terminal 17.0.37.0 and 16.0.90.0, Visual RPG Classic 5.2.7.0 and 5.1.17.0, Visual RPG Deployment 5.2.7.0 and 5.1.17.0, and DataGate Studio 17.0.38.0 and 16.0.104.0.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-49618
(5.8 MEDIUM)

EPSS: 0.03%

updated 2025-07-03T15:31:20

1 posts

In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.

cR0w@infosec.exchange at 2025-07-03T12:58:15.000Z ##

Oh my.

linkedin.com/posts/gaetano-ces

sev:MED 5.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.

nvd.nist.gov/vuln/detail/CVE-2

##

purpleidea@mastodon.social at 2025-07-06T05:31:12.000Z ##

Wow, this sudo priv escalation bug works perfectly on Fedora 42.

Woops! No distro patch available atm :/

stratascale.com/vulnerability-

##

benzogaga33@mamot.fr at 2025-07-04T15:40:03.000Z ##

Linux – Obtenez un accès root avec ces deux failles dans sudo : CVE-2025-32462 et CVE-2025-32463 it-connect.fr/linux-acces-root #ActuCybersécurité #Vulnérabilités #Cybersécurité #Linux

##

knoppix95@mastodon.social at 2025-07-04T15:33:38.000Z ##

A critical Linux vulnerability (CVE-2025-32463) in Sudo lets any local unprivileged user gain root via the --chroot (-R) option

🔒 Affects default configs on Ubuntu, Fedora & others — no Sudo rules needed

🛠️ Fix: Update to Sudo 1.9.17p1+ (no workarounds)
👀 CVSS: 9.8 (Critical)

Highlights persistent risks in open-source privilege handling 🧩

cybersecuritynews.com/linux-su

#Linux #Sudo #FOSS #CyberSecurity #InfoSec #OpenSource #Vulnerability #Root #Exploit #SysAdmin #DevSecOps

##

b9AcE@todon.eu at 2025-07-04T10:42:08.000Z ##

It is important you make sure you keep your software up to date on all devices where you can.

In this case, the core tool "sudo" found on most Linux systems had a bug with CVSS severity score 9.3 (where 10 is worst) was found, allowing local users to become "root" (the most, fully privileged user) and has fixed versions being distributed as part of operating system updates.
sudo.ws/security/advisories/ch
cve.org/CVERecord?id=CVE-2025-
thehackernews.com/2025/07/crit

##

jos1264@social.skynetcloud.site at 2025-07-02T17:45:03.000Z ##

CVE-2025-32463 and CVE-2025-32462: Sudo Local Privilege Escalation Vulnerabilities Threaten Linux Environments – Source: socprime.com ciso2ciso.com/cve-2025-32463-a #rssfeedpostgeneratorecho #PrivilageEscalation #CyberSecurityNews #CVE-2025-32462 #CVE-2025-32463 #Latestthreats #Vulnerability #socprimecom #socprime #Blog #CVE

##

benzogaga33@mamot.fr at 2025-07-02T16:10:02.000Z ##

Local Privilege Escalation to Root via Sudo Chroot in Linux github.com/kh4sh3i/CVE-2025-32

##

Ubuntu@activitypub.awakari.com at 2025-07-02T03:13:02.000Z ## CVE-2025-32463 Privilege Escalation in SUDO Triggers Urgent Linux Patching Threat Group: General Operating System Threat Threat Type: Privilege Escalation Vulnerabilities Exploited Vulnerabilities:...

#Linux #CVE #SUDO #News #Articles

Origin | Interest | Match ##

nixCraft@mastodon.social at 2025-07-01T21:04:36.000Z ##

Vulnerability Advisory: Sudo chroot Elevation of Privilege stratascale.com/vulnerability-

#linux #unix

##

Haydar@social.tchncs.de at 2025-07-01T20:54:11.000Z ##

Kurzer Check bei mir, welche Distros die kritische #sudo Lücke CVE-2025-32463 bis jetzt behoben haben:

- Alpine 3.22: OK
- Arch Linux: OK
- Debian 12 / Devuan 5: OK
- Fedora 42: FAIL
- Void Linux: OK

#itsec

##

cR0w@infosec.exchange at 2025-07-01T15:14:21.000Z ##

I think I boosted information about these sudo EoP vulns yesterday but in case I didn't, here's some basic info on them.

stratascale.com/vulnerability-

sev:LOW 2.8 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

nvd.nist.gov/vuln/detail/CVE-2

stratascale.com/vulnerability-

sev:CRIT 9.3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

nvd.nist.gov/vuln/detail/CVE-2

##

Ubuntu@activitypub.awakari.com at 2025-07-01T12:58:55.000Z ## Sudo local privilege escalation vulnerabilities fixed (CVE-2025-32462, CVE-2025-32463) If you haven’t recently updated the Sudo utility on your Linux box(es), you should do so now, to patch two l...

#Don't #miss #Hot #stuff #News #Debian #Linux #macOS #Stratascale #SUSE #Ubuntu

Origin | Interest | Match ##

jos1264@social.skynetcloud.site at 2025-07-01T13:55:02.000Z ##

Sudo local privilege escalation vulnerabilities fixed (CVE-2025-32462, CVE-2025-32463) helpnetsecurity.com/2025/07/01 #vulnerability #Stratascale #Don'tmiss #Hotstuff #Debian #Ubuntu #Linux #macOS #News #SUSE

##

beyondmachines1@infosec.exchange at 2025-07-01T13:01:21.000Z ##

Critical Sudo vulnerabilities enable local privilege escalation to root

The Stratascale Cyber Research Unit are reporting two vulnerabilities in the Sudo utility, including a critical flaw (CVE-2025-32463) that allows unprivileged users to escalate to root privileges through the chroot option by exploiting NSS library loading mechanisms.

**This is a nasty flaw. If you have multiple user roles on your linux systems or are running services as non-root, make sure to update your Linux systems' Sudo utility to version 1.9.17p1 or later. The exploit vector is possible if someone already has local access to the system, which can either be through direct credentials or through breaching a vulnerable service that's running as non-root.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

jonny@neuromatch.social at 2025-07-01T06:22:24.000Z ##

Maybe controversial, but I think it is bad to do this
stratascale.com/vulnerability-

##

leah@blahaj.social at 2025-06-30T20:40:42.000Z ##

Turns out sudo -f was implemented as sudo -R...
leahneukirchen.org/blog/archiv

stratascale.com/vulnerability-

##

lobsters@mastodon.social at 2025-06-30T20:20:09.000Z ##

CVE-2025-32463 Vulnerability Advisory: Sudo chroot Elevation of Privilege lobste.rs/s/srcfxn #linux #security
stratascale.com/vulnerability-

##

harrysintonen@infosec.exchange at 2025-06-30T16:57:52.000Z ##

Sudo versions 1.9.14 to 1.9.17 (inclusive) have two critical vulnerabilities:
- local privilege escalation via chroot option (CVE-2025-32463) openwall.com/lists/oss-securit
- local privilege escalation via host option (CVE-2025-32462) openwall.com/lists/oss-securit

#cve_2025_32463 #cve_2025_32462 #infosec #cybersecurity

##

CVE-2025-4689
(9.8 CRITICAL)

EPSS: 0.15%

updated 2025-07-03T15:14:12.767000

1 posts

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers

AAKL@infosec.exchange at 2025-07-02T15:12:43.000Z ##

EUVD: Critical CVE-2024-13786: the education theme for WordPress is vulnerable to PHP Object Injection in all versions euvd.enisa.europa.eu/vulnerabi

- CVE-2025-4689: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to RCE Local File Inclusion euvd.enisa.europa.eu/vulnerabi @euvdfeed #cybersecurity #infosec #WordPress

##

CVE-2025-53107
(7.5 HIGH)

EPSS: 0.13%

updated 2025-07-03T15:14:12.767000

1 posts

@cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The

cR0w@infosec.exchange at 2025-07-01T19:07:39.000Z ##

Go hack more MCP shit.

github.com/cyanheads/git-mcp-s

sev:HIGH 7.5 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

@cyanheads/git-mcp-server is an MCP server designed to interact with Git repositories. Prior to version 2.1.5, there is a command injection vulnerability caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). An MCP Client can be instructed to execute additional actions for example via indirect prompt injection when asked to read git logs. This issue has been patched in version 2.1.5.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-53100
(0 None)

EPSS: 0.69%

updated 2025-07-03T15:14:12.767000

1 posts

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated remote command injection attack on a running MCP Server. This issue has been patched in version 0.2.2.

cR0w@infosec.exchange at 2025-07-01T18:05:11.000Z ##

Go hack more MCP shit.

github.com/RestDB/codehooks-mc

sev:HIGH 8.6 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated remote command injection attack on a running MCP Server. This issue has been patched in version 0.2.2.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-37097
(7.5 HIGH)

EPSS: 0.04%

updated 2025-07-03T15:14:12.767000

1 posts

A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service

cR0w@infosec.exchange at 2025-07-01T15:03:07.000Z ##

Go hack more remote support shit.

support.hpe.com/hpesc/public/d

Multiple security vulnerabilities have been identified in HPE Insight Remote Support. These vulnerabilities could remotely allow a directory traversal, disclosure of information, or code execution.

CVE-2025-37097 ( sev:MED 7.5 - :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )

CVE-2025-37098 ( sev:MED 6.5 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVE-2025-37099 ( sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )

##

CVE-2025-34060
(0 None)

EPSS: 0.19%

updated 2025-07-03T15:14:12.767000

1 posts

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing

cR0w@infosec.exchange at 2025-07-01T14:58:44.000Z ##

Perfect 10 in Monero forums. 🥳

swap.gs/posts/monero-forums/

github.com/monero-project/mone

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-49490
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-07-03T15:14:12.767000

1 posts

Resource leak vulnerability in ASR180x in router allows Resource Leak Exposure. This vulnerability is associated with program files router/sms/sms.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-49483
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-07-03T15:14:12.767000

1 posts

Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with program files tr069/tr069_uci.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-49491
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-07-03T15:14:12.767000

1 posts

Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (traffic_stat modules) allows Resource Leak Exposure. This vulnerability is associated with program files traffic_stat/traffic_service/traffic_service.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-49521
(8.8 HIGH)

EPSS: 0.09%

updated 2025-07-03T15:14:12.767000

1 posts

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

cR0w@infosec.exchange at 2025-06-30T21:42:52.000Z ##

Post-auth sev:HIGH code injection and argument injection vulns in Ansible Automation Platform.

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

bugzilla.redhat.com/show_bug.c

nvd.nist.gov/vuln/detail/CVE-2

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

bugzilla.redhat.com/show_bug.c

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-53110
(0 None)

EPSS: 0.06%

updated 2025-07-03T15:13:53.147000

2 posts

Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 0.6.4 or 2025.7.01 resolve.

LCSC_IE@infosec.exchange at 2025-07-03T11:49:00.000Z ##

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟑 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Microsoft to Lay Off 9,000 Employees, Affecting 4% of Workforce

reuters.com/business/world-at-

2. Hunters International Ransomware Shuts Down, Offers Free Decryptors to Victims

cyberinsider.com/hunters-inter

3. UK charity bank branded a 'disaster' after platform migration goes wrong

theregister.com/2025/07/03/uk_

4. Police warn of SMS scams following prison sentence for criminal who conducted smishing campaign

ukfinance.org.uk/news-and-insi

5. Large Language Models (LLMs) Are Falling for Phishing Scams: What Happens When AI Gives You the Wrong URL?

netcraft.com/blog/large-langua

6. Russia’s Cyber Warriors Assail NATO-Linked Private Companies

cepa.org/article/russias-cyber

7. US probes negotiator suspected of taking crypto ransomware money

cointelegraph.com/news/digital

8. Cyberattacks Disrupt Iran’s Bread Distribution, Payments Remain Frozen

iranwire.com/en/news/142915-cy

9. Spain arrests hackers who targeted politicians and journalists

policia.es/_es/comunicacion_pr

10. A third of organisations take more than 90 days to remediate threats

itsecurityguru.org/2025/07/02/

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Irish Eyecare software firm Ocuco investigating cyber-attack

thecurrency.news/articles/1946

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack

unit42.paloaltonetworks.com/ap

2. Snake Keyloggers Exploit Java Tools to Bypass Security – Active IOCs

rewterz.com/threat-advisory/sn

3. Who are DragonForce Ransomware Group?

bridewell.com/insights/blogs/d

4. Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign Using Thousands of Websites to Spoof Popular Retail Brands

silentpush.com/blog/fake-marke

5. Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

wiz.io/blog/exposed-jdwp-explo

6. Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

arcticwolf.com/resources/blog/

7. North Korean APT Kimsuky aka Black Banshee – Active IOCs

rewterz.com/threat-advisory/no

8. DarkTortilla Malware – Active IOCs

rewterz.com/threat-advisory/da

---

𝐀𝐏𝐓 𝐈𝐎𝐂𝐬:

1. Lazarus: Source VT
yourdomainhost[.]store
api[.]yourdomainhost[.]store

2. Kimsuky: Source Validin
Accounts-mysticete[.]servepics[.]com
freedrive[.]servehttp[.]com
login-accounts[.]servehttp[.]com
myaccounts-profile[.]servehttp[.]com
mydocs[.]onthewifi[.]com
securedrive-mofa[.]servehttp[.]com
translate[.]onthewifi[.]com
undocs[.]ddns[.]net
undocs[.]myvnc[.]com
undocs[.]servehttp[.]com

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. Automating macOS Incident Response: DFIR-as-Code in Action Against AppleProcessHub

abstract.security/blog/automat

2. Using Staging Folders For Threat Hunting

knowyouradversary.ru/2025/07/1

3. PDFs: Portable documents, or perfect deliveries for phish?

blog.talosintelligence.com/pdf

4. EscapeRoute: Breaking the Scope of Anthropic’s Filesystem MCP Server
(CVE-2025-53109 & CVE-2025-53110)

cymulate.com/blog/cve-2025-531

5. Yet another ZIP trick

hackarcana.com/article/yet-ano

6. Malware development trick 48: leveraging Office macros for malware. Simple VBA example.

cocomelonc.github.io/malware/2

7. Hijacked by a Text: Understanding and Preventing SIM Swapping Attack

bitsight.com/blog/what-is-sim-

8. CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries

crowdstrike.com/en-us/blog/cro

9. DanaBot Lab Analysis

omer-secure.medium.com/danabot

10. ClickFix Campaign: How Clipboard Injection Leads to RAT Infection (Part 1)

h3xstone.medium.com/clickfix-c

11. Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules

any.run/cybersecurity-blog/rel

12. Inside Android Malware Development: Building a C2 Exfiltrator from the UI to the Network

medium.com/@lord_murak/inside-

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. Pro-Russian hacktivism: Shifting alliances, new groups and risks

intel471.com/blog/pro-russian-

2. Insider Risk Lessons from the DPRK IT Worker Crackdown

dtexsystems.com/blog/insider-r

3. Calling Out Russia: France’s Shift on Public Attribution

warontherocks.com/2025/07/call

4. Outsourced Trust: How Coinbase's $400M Problem Started in an Indian Call Center

reco.ai/blog/coinbase-breach

---

##

_r_netsec@infosec.exchange at 2025-07-02T17:43:05.000Z ##

EscapeRoute: How we found 2 vulnerabilities in Anthropic’s Filesystem MCP Server (CVE-2025-53109 & CVE-2025-53110) cymulate.com/blog/cve-2025-531

##

CVE-2025-20310
(6.1 MEDIUM)

EPSS: 0.04%

updated 2025-07-03T15:13:53.147000

1 posts

A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a craf

AAKL@infosec.exchange at 2025-07-02T17:12:35.000Z ##

New.

CVE-2025-20309 (critical): Cisco Unified Communications Manager Static SSH Credentials Vulnerability sec.cloudapps.cisco.com/securi

- Cisco Spaces Connector Privilege Escalation Vulnerability - CVE-2025-20308 sec.cloudapps.cisco.com/securi

- Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability - CVE-2025-20310 sec.cloudapps.cisco.com/securi

- Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability - CVE-2025-20307 sec.cloudapps.cisco.com/securi @TalosSecurity #cybersecurity #infosec #Cisco

##

CVE-2025-34072
(0 None)

EPSS: 0.08%

updated 2025-07-03T15:13:53.147000

1 posts

A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containing attacker-crafted hyperlinks embedding sensitive data. Slack’s link preview bots (e.g., Slack-LinkExpanding, Slackbot, Slack-ImgProxy) wil

CVE-2025-24329
(6.4 MEDIUM)

EPSS: 0.02%

updated 2025-07-03T15:13:53.147000

1 posts

Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. Beginning with release 24R1-SR 1.0 MP, the OAM se

CVE-2025-24335
(2.0 LOW)

EPSS: 0.02%

updated 2025-07-03T15:13:53.147000

1 posts

Nokia Single RAN baseband software versions earlier than 24R1-SR 2.1 MP contain a SOAP message input validation flaw, which in theory could potentially be used for causing resource exhaustion in the Single RAN baseband OAM service. No practical exploit has been detected for this flaw. However, the issue has been corrected starting from release 24R1-SR 2.1 MP by adding sufficient input validation

CVE-2025-24331
(6.4 MEDIUM)

EPSS: 0.01%

updated 2025-07-03T15:13:53.147000

1 posts

The Single RAN baseband OAM service is intended to run as an unprivileged service. However, it initially starts with root privileges and assigns certain capabilities before dropping to an unprivileged level. The capabilities retained from the root period are considered extensive after the privilege drop and, in theory, could potentially allow actions beyond the intended scope of the OAM service. T

CVE-2025-27025
(8.8 HIGH)

EPSS: 0.36%

updated 2025-07-03T15:13:53.147000

1 posts

The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device file system. Files are written as root. Using Postman it is possible to perform a Directory Traversal attack and write files into any lo

CVE-2025-1708
(8.6 HIGH)

EPSS: 0.04%

updated 2025-07-03T12:35:09

1 posts

The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read its content.

PostgreSQL@activitypub.awakari.com at 2025-07-03T11:18:22.000Z ## CVE-2025-1708The application is vulnerable to SQL injection attacks. An attac... The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read...


Origin | Interest | Match ##

CVE-2025-53109(CVSS UNKNOWN)

EPSS: 0.06%

updated 2025-07-02T18:56:41

2 posts

Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. Thank you to Elad Beber (Cymulate) for reporting these issues.

LCSC_IE@infosec.exchange at 2025-07-03T11:49:00.000Z ##

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟑 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Microsoft to Lay Off 9,000 Employees, Affecting 4% of Workforce

reuters.com/business/world-at-

2. Hunters International Ransomware Shuts Down, Offers Free Decryptors to Victims

cyberinsider.com/hunters-inter

3. UK charity bank branded a 'disaster' after platform migration goes wrong

theregister.com/2025/07/03/uk_

4. Police warn of SMS scams following prison sentence for criminal who conducted smishing campaign

ukfinance.org.uk/news-and-insi

5. Large Language Models (LLMs) Are Falling for Phishing Scams: What Happens When AI Gives You the Wrong URL?

netcraft.com/blog/large-langua

6. Russia’s Cyber Warriors Assail NATO-Linked Private Companies

cepa.org/article/russias-cyber

7. US probes negotiator suspected of taking crypto ransomware money

cointelegraph.com/news/digital

8. Cyberattacks Disrupt Iran’s Bread Distribution, Payments Remain Frozen

iranwire.com/en/news/142915-cy

9. Spain arrests hackers who targeted politicians and journalists

policia.es/_es/comunicacion_pr

10. A third of organisations take more than 90 days to remediate threats

itsecurityguru.org/2025/07/02/

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Irish Eyecare software firm Ocuco investigating cyber-attack

thecurrency.news/articles/1946

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack

unit42.paloaltonetworks.com/ap

2. Snake Keyloggers Exploit Java Tools to Bypass Security – Active IOCs

rewterz.com/threat-advisory/sn

3. Who are DragonForce Ransomware Group?

bridewell.com/insights/blogs/d

4. Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign Using Thousands of Websites to Spoof Popular Retail Brands

silentpush.com/blog/fake-marke

5. Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

wiz.io/blog/exposed-jdwp-explo

6. Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

arcticwolf.com/resources/blog/

7. North Korean APT Kimsuky aka Black Banshee – Active IOCs

rewterz.com/threat-advisory/no

8. DarkTortilla Malware – Active IOCs

rewterz.com/threat-advisory/da

---

𝐀𝐏𝐓 𝐈𝐎𝐂𝐬:

1. Lazarus: Source VT
yourdomainhost[.]store
api[.]yourdomainhost[.]store

2. Kimsuky: Source Validin
Accounts-mysticete[.]servepics[.]com
freedrive[.]servehttp[.]com
login-accounts[.]servehttp[.]com
myaccounts-profile[.]servehttp[.]com
mydocs[.]onthewifi[.]com
securedrive-mofa[.]servehttp[.]com
translate[.]onthewifi[.]com
undocs[.]ddns[.]net
undocs[.]myvnc[.]com
undocs[.]servehttp[.]com

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. Automating macOS Incident Response: DFIR-as-Code in Action Against AppleProcessHub

abstract.security/blog/automat

2. Using Staging Folders For Threat Hunting

knowyouradversary.ru/2025/07/1

3. PDFs: Portable documents, or perfect deliveries for phish?

blog.talosintelligence.com/pdf

4. EscapeRoute: Breaking the Scope of Anthropic’s Filesystem MCP Server
(CVE-2025-53109 & CVE-2025-53110)

cymulate.com/blog/cve-2025-531

5. Yet another ZIP trick

hackarcana.com/article/yet-ano

6. Malware development trick 48: leveraging Office macros for malware. Simple VBA example.

cocomelonc.github.io/malware/2

7. Hijacked by a Text: Understanding and Preventing SIM Swapping Attack

bitsight.com/blog/what-is-sim-

8. CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries

crowdstrike.com/en-us/blog/cro

9. DanaBot Lab Analysis

omer-secure.medium.com/danabot

10. ClickFix Campaign: How Clipboard Injection Leads to RAT Infection (Part 1)

h3xstone.medium.com/clickfix-c

11. Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules

any.run/cybersecurity-blog/rel

12. Inside Android Malware Development: Building a C2 Exfiltrator from the UI to the Network

medium.com/@lord_murak/inside-

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. Pro-Russian hacktivism: Shifting alliances, new groups and risks

intel471.com/blog/pro-russian-

2. Insider Risk Lessons from the DPRK IT Worker Crackdown

dtexsystems.com/blog/insider-r

3. Calling Out Russia: France’s Shift on Public Attribution

warontherocks.com/2025/07/call

4. Outsourced Trust: How Coinbase's $400M Problem Started in an Indian Call Center

reco.ai/blog/coinbase-breach

---

##

_r_netsec@infosec.exchange at 2025-07-02T17:43:05.000Z ##

EscapeRoute: How we found 2 vulnerabilities in Anthropic’s Filesystem MCP Server (CVE-2025-53109 & CVE-2025-53110) cymulate.com/blog/cve-2025-531

##

CVE-2025-53106(CVSS UNKNOWN)

EPSS: 0.04%

updated 2025-07-02T18:55:46

1 posts

### Impact Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. ### Workarounds

cR0w@infosec.exchange at 2025-07-02T14:54:25.000Z ##

PrivEsc in Graylog.

github.com/Graylog2/graylog2-s

sev:HIGH 8.8 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Graylog is a free and open log management platform. In versions 6.2.0 to before 6.2.4 and 6.3.0-alpha.1 to before 6.3.0-rc.2, Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation. This issue has been patched in versions 6.2.4 and 6.3.0-rc.2. A workaround involves disabling the respective configuration found in System > Configuration > Users > "Allow users to create personal access tokens".

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-20309
(10.0 CRITICAL)

EPSS: 0.13%

updated 2025-07-02T18:30:42

9 posts

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials

LCSC_IE@infosec.exchange at 2025-07-04T11:18:44.000Z ##

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟒 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Ekco Ireland grows headcount to more than 1,000 with Adapt IT acquisition

siliconrepublic.com/business/e

2. Estonia’s cyber ambassador on digitalization, punching upwards and outing GRU spies

therecord.media/estonia-cyber-

3. Why cybersecurity should be seen as a business enabler, not a blocker

siliconrepublic.com/enterprise

4. South Korea penalises 'negligent' SK Telecom over major data leak

reuters.com/sustainability/boa

5. Russia jails man for 16 years over pro-Ukraine cyberattacks on critical infrastructure

therecord.media/russia-jails-m

6. CVE-2025-20309: Cisco Unified Communications Manager Static SSH Credentials Maximum Severity Vulnerability

sec.cloudapps.cisco.com/securi

7. Criminals Sending QR Codes in Phishing, Malware Campaigns

darkreading.com/endpoint-secur

8. Interpol identifies West Africa as potential new hotspot for cybercrime compounds

therecord.media/interpol-west-

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Allianz Seguros Spain Allegedly Breached – Database of 4.6 Million Offered for Sale

dailydarkweb.net/allianz-segur

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Taking SHELLTER: a commercial evasion framework abused in- the- wild

elastic.co/security-labs/takin

2. Threat Actors Recompile SonicWall's NetExtender to Include SilentRoute Backdoor

esentire.com/blog/threat-actor

3. RondoDox Unveiled: Breaking Down a New Botnet Threat

fortinet.com/blog/threat-resea

4. Hpingbot: A New Botnet Family Based on Pastebin Payload Delivery Chain and Hping3 DDoS Module

nsfocusglobal.com/hpingbot-a-n

5. 8 More Malicious Firefox Extensions: Exploiting Popular Game Recognition, Hijacking User Sessions, and Stealing OAuth Credentials

socket.dev/blog/8-more-malicio

6. Satori Threat Intelligence Alert: IconAds Conceals Source of Ad Fraud from Users

humansecurity.com/learn/blog/s

7. When Installers Turn Evil: The Pascal Script Behind Inno Setup Malware Campaign

splunk.com/en_us/blog/security

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. The Future of Threat Hunting and Investigation : ELK MCP Server

f0xypr0xy.medium.com/the-futur

2. Data breach reveals Catwatchful ‘stalkerware’ is spying on thousands of phones

techcrunch.com/2025/07/02/data

3. Researchers Defeat Content Security Policy Protections via HTML Injection

jorianwoltjer.com/blog/p/resea

4. Cl0p Ransomware’s Exfiltration Process Exposes RCE Vulnerability

infosec.exchange/@adulau/11477

5. Identifying and abusing Azure Arc for hybrid escalation and persistence

ibm.com/think/x-force/identify

6. Detecting Attacks in Real-Time with Falco and Grafana: A Beginner’s Guide

medium.com/@lavanyabhargava05/

7. How I Bypassed a WAF | Why Documentation matters | RGHX

rghx.medium.com/how-i-bypassed

8. One attack, one alert: From thousands of signals to one clear story

group-ib.com/blog/one-attack-o

9. Azure Honeypot with Live Traffic

medium.com/@rajesh.p3807/azure

10. dnSpy—Static Analysis of a .NET Malware

medium.com/@tarunrd77/dnspy-st

11. Part 3: In-Memory Execution Methods — How Malware Lives Rent-Free in Your System

medium.com/@cybertooths/part-3

12. Using Process Parent and Children Relationships for Detection and Hunting

knowyouradversary.ru/2025/07/1

13. Taking over 60k spyware user accounts with SQL injection

ericdaigle.ca/posts/taking-ove

14. Logwatcher’s Zenit #05: Beginner Mistakes in KQL

threathunter-chronicles.medium

15. Custom AnyDesk Abuse: A Stealthy Way Adversaries Take Over Your System

medium.com/@dgtrivedi4646/cust

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. The Evolving Threat Landscape: A Comprehensive Report on Scattered Spider

falconfeeds.io/blogs/scattered

2. Exclusive disclosure of the attack activities of the APT group NightEagle

github.com/RedDrip7/NightEagle

3. Iran's Intelligence Group 13

dti.domaintools.com/irans-inte

4. Beneath the Waves and Beyond: How Cybersecurity and Undersea Defense Stocks Are Rising to Meet Russia's Hybrid Threats

ainvest.com/news/beneath-waves

5. PLA’s Multi-Domain Reorganization: Cyberspace, Aerospace, and Information Support Forces Reshape the Threat Landscape

blog.alphahunt.io/plas-multi-d

6. First Quarter 2025 Ransomware Trends

optiv.com/insights/discover/bl

---

##

todb@infosec.exchange at 2025-07-03T14:21:53.000Z ##

Another static, unchangable root password in Cisco gear. In 2025.

cve.org/cverecord?id=CVE-2025-

#SecureByDesign

##

jos1264@social.skynetcloud.site at 2025-07-03T11:15:02.000Z ##

Cisco fixes maximum-severity flaw in enterprise unified comms platform (CVE-2025-20309) helpnetsecurity.com/2025/07/03 #communication #vulnerability #enterprise #Don'tmiss #Hotstuff #Cisco #News #SMBs

##

beyondmachines1@infosec.exchange at 2025-07-03T08:01:28.000Z ##

Cisco patches critical hardcoded credentials vulnerability in Unified Communications Manager

Cisco reports a maximum-severity vulnerability (CVE-2025-20309) in its Unified Communications Manager platforms caused by hardcoded static SSH credentials for the root account. The flaw allows unauthenticated remote attackers to gain complete administrative control over enterprise IP telephony networks.

**Obvious first step - isolate the SSH port of your CUCM and make it accessible from trusted networks only. Then VERY QUICLY update to versions 15.0.1.13010-1 through 15.0.1.13017-1, or apply the patches. Just isolating the CUCM isn't enough - the hardcoded password can be abused by malicious insiders, or other devices with access to trusted networks can be breached and the attackers can then breach CUCM.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

jos1264@social.skynetcloud.site at 2025-07-03T06:45:03.000Z ##

Cisco Issues Urgent Patch for Critical Unified CM Vulnerability (CVE-2025-20309) thecyberexpress.com/cisco-patc #TheCyberExpressNews #Ciscovulnerability #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE202520309 #UnifiedCMSME #CyberNews #UnifiedCM

##

TomSellers@infosec.exchange at 2025-07-02T19:54:57.000Z ##

A note on the security advisory for CVE-2025-20309 in Cisco Unified Communications Manager which covers hard coded credentials - as I understand it this only impacts a special version of the product that users would have to contact TAC to get. If that is a correct understanding then I would expect this to limit the likelihood that organizations are running the impacted versions.

Quoting from the advisory:

This vulnerability affects Cisco Unified CM and Unified CM SME Engineering Special (ES) releases 15.0.1.13010-1 through 15.0.1.13017-1, regardless of device configuration.

Note: ES releases are limited fix releases that are distributed only by the Cisco Technical Assistance Center (TAC).

Reference: sec.cloudapps.cisco.com/securi

#Security #CVE_2025_20309 #CVE202520309

##

cR0w@infosec.exchange at 2025-07-02T17:16:34.000Z ##

@_newick NIST hasn't published it then. It's also available here: cve.org/CVERecord?id=CVE-2025-

##

AAKL@infosec.exchange at 2025-07-02T17:12:35.000Z ##

New.

CVE-2025-20309 (critical): Cisco Unified Communications Manager Static SSH Credentials Vulnerability sec.cloudapps.cisco.com/securi

- Cisco Spaces Connector Privilege Escalation Vulnerability - CVE-2025-20308 sec.cloudapps.cisco.com/securi

- Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability - CVE-2025-20310 sec.cloudapps.cisco.com/securi

- Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability - CVE-2025-20307 sec.cloudapps.cisco.com/securi @TalosSecurity #cybersecurity #infosec #Cisco

##

cR0w@infosec.exchange at 2025-07-02T16:40:18.000Z ##

Are you fucking kidding me Cisco? Again?

sec.cloudapps.cisco.com/securi

sev:CRIT 10.0 🥳

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-20307
(4.8 MEDIUM)

EPSS: 0.03%

updated 2025-07-02T18:30:42

1 posts

A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an authenticated, remote attacker to to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this

AAKL@infosec.exchange at 2025-07-02T17:12:35.000Z ##

New.

CVE-2025-20309 (critical): Cisco Unified Communications Manager Static SSH Credentials Vulnerability sec.cloudapps.cisco.com/securi

- Cisco Spaces Connector Privilege Escalation Vulnerability - CVE-2025-20308 sec.cloudapps.cisco.com/securi

- Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability - CVE-2025-20310 sec.cloudapps.cisco.com/securi

- Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability - CVE-2025-20307 sec.cloudapps.cisco.com/securi @TalosSecurity #cybersecurity #infosec #Cisco

##

CVE-2025-20308
(6.0 MEDIUM)

EPSS: 0.02%

updated 2025-07-02T18:30:42

1 posts

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker could exploit this vulnerability by logging in to the Cisco Spaces Connector CLI as the spacesadmin u

AAKL@infosec.exchange at 2025-07-02T17:12:35.000Z ##

New.

CVE-2025-20309 (critical): Cisco Unified Communications Manager Static SSH Credentials Vulnerability sec.cloudapps.cisco.com/securi

- Cisco Spaces Connector Privilege Escalation Vulnerability - CVE-2025-20308 sec.cloudapps.cisco.com/securi

- Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability - CVE-2025-20310 sec.cloudapps.cisco.com/securi

- Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability - CVE-2025-20307 sec.cloudapps.cisco.com/securi @TalosSecurity #cybersecurity #infosec #Cisco

##

CVE-2025-48928
(4.0 MEDIUM)

EPSS: 8.89%

updated 2025-07-02T17:55:06.963000

3 posts

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.

beyondmachines1@infosec.exchange at 2025-07-04T09:01:18.000Z ##

CISA warns of active attacks on Signal clone TeleMessage

CISA has issued a warning about two actively exploited vulnerabilities in TeleMessage TM SGNL, a Signal clone used by national security staffers and government officials, including a Spring Boot Actuator misconfiguration (CVE-2025-48927) that exposes memory dumps and a local access vulnerability (CVE-2025-48928) enabling password extraction.

**If you're using TeleMessage TM SGNL, start patching it today, because it's being actively exploited. Alternatively, stop using the software entirely. Switch back to standard Signal or another approved properly encrypted messaging app since TM SGNL has already been breached and continues to be attacked.**
#cybersecurity #infosec #attack #activeattack
beyondmachines.net/event_detai

##

AAKL@infosec.exchange at 2025-07-01T19:28:38.000Z ##

CISA has added to the KEV catalogue:

- CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability cve.org/CVERecord?id=CVE-2025-

- CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability cve.org/CVERecord?id=CVE-2025-

From yesterday:

- CVE-2025-6543: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability cve.org/CVERecord?id=CVE-2025- #CISA #cybersecurity #infosec

##

cisakevtracker@mastodon.social at 2025-07-01T18:00:53.000Z ##

CVE ID: CVE-2025-48928
Vendor: TeleMessage
Product: TM SGNL
Date Added: 2025-07-01
Notes: It is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue use of the product. ; nvd.nist.gov/vuln/detail/CVE-2
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-24333
(6.4 MEDIUM)

EPSS: 0.02%

updated 2025-07-02T15:31:43

1 posts

Nokia Single RAN baseband software earlier than 24R1-SR 1.0 MP contains administrative shell input validation fault, which authenticated admin user can, in theory, potentially use for injecting arbitrary commands for unprivileged baseband OAM service process execution via special characters added to baseband internal COMA_config.xml file. This issue has been corrected starting from release 24R1-S

CVE-2025-24332
(7.1 HIGH)

EPSS: 0.02%

updated 2025-07-02T15:31:43

1 posts

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity boards using the internal bsoc SSH service, which is available only internally within the baseband and throu

CVE-2025-24334
(3.3 LOW)

EPSS: 0.01%

updated 2025-07-02T15:31:43

1 posts

The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release version by sending a specific HTTP POST request through the Mobile Network Operator (MNO) internal RAN management network.

CVE-2025-27021
(7.0 None)

EPSS: 0.01%

updated 2025-07-02T15:31:43

1 posts

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by tampering with kernel memory. Details: The output of "sudo -l" reports the presence of "devmem" com

CVE-2025-24330
(6.4 MEDIUM)

EPSS: 0.02%

updated 2025-07-02T15:31:42

1 posts

Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. Beginning with release 24R1-SR 1.0 MP, the OAM ser

CVE-2025-24328
(4.2 MEDIUM)

EPSS: 0.01%

updated 2025-07-02T15:31:37

1 posts

Sending a crafted SOAP "set" operation message within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to release 24R1-SR 1.0 MP and later. The OAM service component restarts automatically after the stac

CVE-2025-34067(CVSS UNKNOWN)

EPSS: 0.38%

updated 2025-07-02T15:30:44

2 posts

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a mali

beyondmachines1 at 2025-07-05T12:01:15.319Z ##

Remote code execution flaw reported in HIKVISION Security Management Platforms

HIKVISION reports a maximum-severity vulnerability (CVE-2025-34067) in its applyCT security management platform that allows unauthenticated remote code execution through a vulnerable Fastjson library, enabling attackers arbitrary code execution.

**If you have HIKVISION HikCentral security management systems, make sure it's isolated it from the internet and accessible only from trusted networks. Also block outbound LDAP connections, and then plan a quick patch cycle. Because isolation will never be enough with maximum severity flaw.**

beyondmachines.net/event_detai

##

beyondmachines1@infosec.exchange at 2025-07-05T12:01:15.000Z ##

Remote code execution flaw reported in HIKVISION Security Management Platforms

HIKVISION reports a maximum-severity vulnerability (CVE-2025-34067) in its applyCT security management platform that allows unauthenticated remote code execution through a vulnerable Fastjson library, enabling attackers arbitrary code execution.

**If you have HIKVISION HikCentral security management systems, make sure it's isolated it from the internet and accessible only from trusted networks. Also block outbound LDAP connections, and then plan a quick patch cycle. Because isolation will never be enough with maximum severity flaw.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

CVE-2025-34071(CVSS UNKNOWN)

EPSS: 0.28%

updated 2025-07-02T15:30:44

1 posts

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authent

cR0w@infosec.exchange at 2025-07-02T14:36:42.000Z ##

IDK how old this disclosure is because once again, there's no date on the post. But the CVEs were just published today. Happy hacking.

ssd-disclosure.com/ssd-advisor

An analysis primarily of Kerio Control revealed a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can cause the execution of arbitrary code and commands.

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-34069(CVSS UNKNOWN)

EPSS: 0.14%

updated 2025-07-02T15:30:44

1 posts

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services such as GFIAgent, bypassing firewall restrictions and exposing internal management endpoints. This enables unauthenticated

cR0w@infosec.exchange at 2025-07-02T14:36:42.000Z ##

IDK how old this disclosure is because once again, there's no date on the post. But the CVEs were just published today. Happy hacking.

ssd-disclosure.com/ssd-advisor

An analysis primarily of Kerio Control revealed a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can cause the execution of arbitrary code and commands.

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-34070(CVSS UNKNOWN)

EPSS: 0.12%

updated 2025-07-02T15:30:37

1 posts

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper authentication. The /proxy handler on port 7996 allows arbitrary forwarding to administrative endpoints

cR0w@infosec.exchange at 2025-07-02T14:36:42.000Z ##

IDK how old this disclosure is because once again, there's no date on the post. But the CVEs were just published today. Happy hacking.

ssd-disclosure.com/ssd-advisor

An analysis primarily of Kerio Control revealed a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can cause the execution of arbitrary code and commands.

sev:CRIT 9.5 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

sev:CRIT 9.4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-48379
(7.1 HIGH)

EPSS: 0.01%

updated 2025-07-02T14:20:25

1 posts

There is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. * Unclear how large the potential write could be. It is likely limited by process segfault, so it's not necessarily determinist

cR0w@infosec.exchange at 2025-07-01T19:11:54.000Z ##

BoF in Python Pillow.

github.com/python-pillow/Pillo

sev:HIGH 7.1 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only affects users who save untrusted data as a compressed DDS image. This issue has been patched in version 11.3.0.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-27022
(7.5 HIGH)

EPSS: 0.06%

updated 2025-07-02T12:33:13

1 posts

Path traversal in WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.

CVE-2025-4679
(6.5 MEDIUM)

EPSS: 0.05%

updated 2025-07-02T12:33:13

1 posts

A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors.

beyondmachines1@infosec.exchange at 2025-06-30T14:01:21.000Z ##

Vulnerability in Synology Active Backup for Microsoft 365 exposes credentials, enables unauthorized access to Teams chats

Security researchers discovered a vulnerability (CVE-2025-4679) in Synology's Active Backup for Microsoft 365 that exposed a master credential in HTTP redirects, allowing attackers to gain unauthorized access to sensitive Microsoft 365 data across all organizations using the popular backup solution with over 1.2 million installations.

**If you use Synology's Active Backup for Microsoft 365, be aware that a critical flaw exposed your Microsoft 365 data to potential unauthorized access until recently. Even though Synology says they've fixed it, check your Microsoft 365 audit logs for any suspicious access and ensure your Synology system is fully updated. If developing applications, check if any of your responses contains secrets that shouldn't be there.**
#cybersecurity #infosec #advisory #databreach
beyondmachines.net/event_detai

##

CVE-2025-27024
(6.5 MEDIUM)

EPSS: 0.04%

updated 2025-07-02T12:32:17

1 posts

Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used for SSH CLI access and are able to read all files according to the OS permission instead of remain

CVE-2025-27023
(6.5 MEDIUM)

EPSS: 0.07%

updated 2025-07-02T12:32:17

1 posts

Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target

CVE-2024-13786
(9.8 CRITICAL)

EPSS: 0.11%

updated 2025-07-02T09:30:34

1 posts

The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless anot

AAKL@infosec.exchange at 2025-07-02T15:12:43.000Z ##

EUVD: Critical CVE-2024-13786: the education theme for WordPress is vulnerable to PHP Object Injection in all versions euvd.enisa.europa.eu/vulnerabi

- CVE-2025-4689: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to RCE Local File Inclusion euvd.enisa.europa.eu/vulnerabi @euvdfeed #cybersecurity #infosec #WordPress

##

CVE-2025-6463
(8.8 HIGH)

EPSS: 0.14%

updated 2025-07-02T06:30:42

4 posts

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted whe

Grub_09@mastodon.uno at 2025-07-05T20:06:35.000Z ##

Grave vulnerabilità di un plugin WordPress: oltre 600.000 siti a rischio.

Una grave vulnerabilità sta mettendo in allarme la comunità di WordPress, con oltre 600.000 siti web a rischio a causa di una falla nel plugin Forminator. L’exploit, identificato con il codice CVE-2025-6463, è stato classificato con un indice di gravità di 8.8 su 10 secondo il sistema CVSS, evidenziando il suo elevato grado di pericolosità.

#wordpress #vulnerabilita #wordpressplugin

ilsoftware.it/grave-vulnerabil

##

benzogaga33@mamot.fr at 2025-07-03T09:40:02.000Z ##

WordPress – CVE-2025-6463 : cette faille dans le plugin Forminator menace plus de 400 000 sites Web ! it-connect.fr/wordpress-cve-20 #ActuCybersécurité #Cybersécurité #Wordpress #Web

##

beyondmachines1@infosec.exchange at 2025-07-02T15:01:13.000Z ##

WordPress Plugin flaw exposes over 600,000 websites to potential remote takeover

A critical vulnerability (CVE-2025-6463) in the Forminator WordPress plugin affecting over 600,000 installations allows unauthenticated attackers to delete arbitrary files, including critical WordPress files like wp-config.php. The flaw enable site takeover by forcing installations into setup mode after deleting wp-config.php and then connecting to a database they control.

**If you're using the Forminator WordPress plugin, immediately update to version 1.44.3 or later. Your WordPress site is exposed to the internet by design, so attackers will find it very quickly. Don't delay, updating a plugin in WordPress is quite easy. Then check your form submission logs for any suspicious entries that might indicate your site was already targeted.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

FunctionalProgramming@activitypub.awakari.com at 2025-07-02T07:08:56.000Z ## Severe WordPress Plugin Flaw Puts Over 600,000 Sites at Risk of Remote Takeover A newly disclosed vulnerability, tracked as CVE-2025-6463, has put over 600,000 WordPress sites at immediate risk. Th...

#Cyber #Security #News #Cybersecurity #Vulnerability #Cyber #Security #Cyber #security #news #vulnerability

Origin | Interest | Match ##

CVE-2025-37099
(9.8 CRITICAL)

EPSS: 0.18%

updated 2025-07-01T18:30:47

1 posts

A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.

cR0w@infosec.exchange at 2025-07-01T15:03:07.000Z ##

Go hack more remote support shit.

support.hpe.com/hpesc/public/d

Multiple security vulnerabilities have been identified in HPE Insight Remote Support. These vulnerabilities could remotely allow a directory traversal, disclosure of information, or code execution.

CVE-2025-37097 ( sev:MED 7.5 - :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )

CVE-2025-37098 ( sev:MED 6.5 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVE-2025-37099 ( sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )

##

CVE-2025-6543
(9.8 CRITICAL)

EPSS: 16.12%

updated 2025-07-01T18:19:45.547000

4 posts

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

3 repos

https://github.com/grupooruss/Citrix-cve-2025-6543

https://github.com/seabed-atavism/CVE-2025-6543

https://github.com/abrewer251/CVE-2025-6543_CitrixNetScaler_PoC

AAKL@infosec.exchange at 2025-07-01T19:28:38.000Z ##

CISA has added to the KEV catalogue:

- CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability cve.org/CVERecord?id=CVE-2025-

- CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability cve.org/CVERecord?id=CVE-2025-

From yesterday:

- CVE-2025-6543: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability cve.org/CVERecord?id=CVE-2025- #CISA #cybersecurity #infosec

##

GossiTheDog@cyberplace.social at 2025-07-01T09:36:40.000Z ##

Citrix blog on CVE-2025-5777 and some other ones netscaler.com/blog/news/netsca

##

cisakevtracker@mastodon.social at 2025-06-30T18:00:49.000Z ##

CVE ID: CVE-2025-6543
Vendor: Citrix
Product: NetScaler ADC and Gateway
Date Added: 2025-06-30
Notes: support.citrix.com/support-hom ; netscaler.com/blog/news/netsca ; nvd.nist.gov/vuln/detail/CVE-2
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

hrbrmstr@mastodon.social at 2025-06-30T17:52:46.000Z ##

CVE-2025-6543 (citrix 🩸) hit KEV. that means confirmed exploitation with receipts. will wash dishes for payloads. bob [@] greynoise [.] io (some mastodon clients really bork email addresses) if you have'm.

##

CVE-2025-47176
(7.8 HIGH)

EPSS: 0.06%

updated 2025-07-01T16:50:53.030000

3 posts

'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.

CVE-2025-6897
(5.5 MEDIUM)

EPSS: 0.23%

updated 2025-07-01T16:30:28.957000

1 posts

A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_debug.asp. The manipulation of the argument Time leads to os command injection. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6554
(8.1 HIGH)

EPSS: 6.66%

updated 2025-07-01T15:32:11

24 posts

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

3 repos

https://github.com/windz3r0day/CVE-2025-6554

https://github.com/rbaicba/CVE-2025-6554

https://github.com/gmh5225/CVE-2025-6554-2

linux@activitypub.awakari.com at 2025-07-05T19:19:23.000Z ## גוגל משחררת עדכון לכרום הסוגר חולשה המנוצלת בפועל ע"י תוקפים בעולם (CVE-2025-6554) הגרסאות התקינות הן: - 138.0.7204.96/.97...


Origin | Interest | Match ##

Android@activitypub.awakari.com at 2025-07-03T12:27:24.000Z ## Minor update(5) for Vivaldi Android Browser 7.4 This update includes backported security patch from the Chromium upstream (CVE-2025-6554). Head to the Google Play Store and download the browser. Al...

#Android #Android #Updates

Origin | Interest | Match ##

wasm@activitypub.awakari.com at 2025-07-03T21:47:14.000Z ## Chrome Zero-Day Exploit: CVE-2025-6554 A critical Chrome zero-day exploit (CVE-2025-6554) targets the V8 engine and has been exploited in the wild. Learn how this Chrome vulnerability works and how...

#Threat #Analysis #Malware #Research

Origin | Interest | Match ##

authentic8@mastodon.social at 2025-07-03T20:11:35.000Z ##

🚨 The Cyber Intel Brief is live! 🚨

This week, suspected nation-state threat actors wasted no time exploiting a Chrome zero-day (CVE-2025-6554). Iranian cyber operations are escalating, AI-enhanced malware evasion techniques emerge and Scattered Spider is hitting aviation.

Check out the full breakdown and analysis 👇
bit.ly/3Tnumh3

#zeroday #Iran #cyberthreats #cyberthreatintelligence #cybersecurity

##

jos1264@social.skynetcloud.site at 2025-07-03T02:25:02.000Z ##

CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025 – Source: securityaffairs.com ciso2ciso.com/cve-2025-6554-is #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #SecurityNews #hacking #Chrome

##

cR0w@infosec.exchange at 2025-07-02T21:32:31.000Z ##

Supposed PoC: github.com/DarkNavySecurity/Po

##

cisakevtracker@mastodon.social at 2025-07-02T18:00:48.000Z ##

CVE ID: CVE-2025-6554
Vendor: Google
Product: Chromium V8
Date Added: 2025-07-02
Notes: chromereleases.googleblog.com/ ; nvd.nist.gov/vuln/detail/CVE-2
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

AAKL@infosec.exchange at 2025-07-02T17:25:36.000Z ##

CISA has added to the KEV catalogue.

- CVE-2025-6554: Google Chromium V8 Type Confusion Vulnerability cve.org/CVERecord?id=CVE-2025- #CISA #Google #cybersecurity #infosec

##

wasm@activitypub.awakari.com at 2025-07-02T10:52:57.000Z ## CVE-2025-6554: Chrome’s New Zero-Day Under Active Exploitation CVE-2025-6554: Chrome’s New Zero-Day Under Active Exploitation A high-severity security flaw in Google Chrome is under active expl...

#Cyber #News

Origin | Interest | Match ##

wasm@activitypub.awakari.com at 2025-07-02T05:21:42.000Z ## Google Issues Emergency Fix for Actively Exploited Chrome Zero-Day – CVE-2025-6554 Google has released another emergency security update for its Chrome browser, addressing a high-severity zero-da...

#Security #Research #and #Intelligence

Origin | Interest | Match ##

wasm@activitypub.awakari.com at 2025-07-02T08:21:00.000Z ## CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025 Google released security patches to address a Chrome vulnerability, tracked as CVE-2025-6554, for which an exploit exists in th...

#Breaking #News #Hacking #Chrome #information #security #news #IT #Information #Security #Pierluigi

Origin | Interest | Match ##

patrickcmiller@infosec.exchange at 2025-07-02T03:12:04.000Z ##

Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update thehackernews.com/2025/07/goog

##

foxs@嘟文.com at 2025-07-02T01:59:50.000Z ##

CVE-2025-6554
该漏洞潜藏于Chrome核心引擎中,只需访问恶意网页,攻击者就能远程控制你的电脑。   
网络安全研究人员证实,该漏洞正在真实攻击中被利用,企业数据和个人隐私面临裸奔风险。
@board

##

jos1264@social.skynetcloud.site at 2025-07-01T23:25:02.000Z ##

Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update – Source:thehackernews.com ciso2ciso.com/chrome-zero-day- #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #Chrome

##

linux@activitypub.awakari.com at 2025-07-01T15:12:07.000Z ## Update your Chrome to fix new actively exploited zero-day vulnerability Google has released an urgent update for the Chrome browser to patch a vulnerability which has already been exploited. Google...

#Exploits #and #vulnerabilities #News #chrome #CVE-2025-6554

Origin | Interest | Match ##

cR0w@infosec.exchange at 2025-07-01T16:06:28.000Z ##

@beyondmachines1 I know it's pedantic, but the Chrome advisory does not state that it is in fact EITW. It says that there is an exploit in the wild, but not that it's known to have been used successfully.

Google is aware that an exploit for CVE-2025-6554 exists in the wild.

##

beyondmachines1@infosec.exchange at 2025-07-01T16:01:22.000Z ##

Google patches actively exploited flaw in Chrome

Google has patched an actively exploited zero-day vulnerability (CVE-2025-6554) in Chrome's V8 JavaScript engine that allows remote attackers to perform arbitrary read/write operations through malicious HTML pages. The flaw was reported by Google's Threat Analysis Group, which typically investigates government-backed attacks, suggesting potential state-sponsored exploitation.

**One more urgent patch for Chrome - Google is again patching an actively exploited flaw in Chrome, and exploitation is just a visit to a malicious site. DONT WAIT! Patch all your Chrome and Chromium browsers (Edge, Opera, Brave, Vivaldi...). Updating the browser is easy, all your tabs reopen after the patch.**
#cybersecurity #infosec #attack #activeexploit
beyondmachines.net/event_detai

##

benzogaga33@mamot.fr at 2025-07-01T15:40:01.000Z ##

Google Chrome 138 – CVE-2025-6554 : patchez pour vous protéger de cette nouvelle faille zero-day it-connect.fr/google-chrome-13 #ActuCybersécurité #Cybersécurité #Vulnérabilité #googlechrome

##

AAKL@infosec.exchange at 2025-07-01T14:30:28.000Z ##

Updated today:

NIST: High severity CVE-2025-6554 nvd.nist.gov/vuln/detail/CVE-2

The Hacker New: Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update thehackernews.com/2025/07/goog @thehackernews #Google #cybersecurity #Infosec #Chrome #zeroday

##

wasm@activitypub.awakari.com at 2025-07-01T08:55:00.000Z ## Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update Google has released security updates to address a vulnerability in its Chrome browser for which an exploit exists...


Origin | Interest | Match ##

jbhall56@infosec.exchange at 2025-07-01T12:41:45.000Z ##

"Google is aware that an exploit for CVE-2025-6554 exists in the wild," the browser vendor said in a security advisory issued on Monday. bleepingcomputer.com/news/secu

##

jos1264@social.skynetcloud.site at 2025-07-01T10:40:02.000Z ##

Google patches actively exploited Chrome (CVE‑2025‑6554) helpnetsecurity.com/2025/07/01 #securityupdate #MicrosoftEdge #Don'tmiss #Hotstuff #Vivaldi #Chrome #0-day #Brave #Opera #News

##

wasm@activitypub.awakari.com at 2025-07-01T10:04:31.000Z ## Google patches actively exploited Chrome (CVE‑2025‑6554) Google has released a security update for Chrome to address a zero‑day vulnerability (CVE-2025-6554) that its Threat Analysis Group (T...

#Don't #miss #Hot #stuff #News #0-day #Brave #Chrome #Microsoft #Edge #Opera

Origin | Interest | Match ##

cR0w@infosec.exchange at 2025-06-30T21:39:13.000Z ##

Chrome patched a sev:HIGH CVE with an ITW exploit.

Google is aware that an exploit for CVE-2025-6554 exists in the wild.

chromereleases.googleblog.com/

##

CVE-2025-34064(CVSS UNKNOWN)

EPSS: 0.04%

updated 2025-07-01T15:31:16

1 posts

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configura

cR0w@infosec.exchange at 2025-07-01T15:58:47.000Z ##

I don't understand the issue here. It's literally in the name of the company. 🥳

specterops.io/blog/2025/06/10/

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment.

nvd.nist.gov/vuln/detail/CVE-2

sev:CRIT 9.0 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-37098
(7.5 HIGH)

EPSS: 0.04%

updated 2025-07-01T15:31:16

1 posts

A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.

cR0w@infosec.exchange at 2025-07-01T15:03:07.000Z ##

Go hack more remote support shit.

support.hpe.com/hpesc/public/d

Multiple security vulnerabilities have been identified in HPE Insight Remote Support. These vulnerabilities could remotely allow a directory traversal, disclosure of information, or code execution.

CVE-2025-37097 ( sev:MED 7.5 - :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H )

CVE-2025-37098 ( sev:MED 6.5 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVE-2025-37099 ( sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )

##

CVE-2025-34063(CVSS UNKNOWN)

EPSS: 0.10%

updated 2025-07-01T15:31:10

1 posts

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstre

cR0w@infosec.exchange at 2025-07-01T15:58:47.000Z ##

I don't understand the issue here. It's literally in the name of the company. 🥳

specterops.io/blog/2025/06/10/

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment.

nvd.nist.gov/vuln/detail/CVE-2

sev:CRIT 9.0 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-49480
(7.4 HIGH)

EPSS: 0.04%

updated 2025-07-01T12:31:05

1 posts

Out-of-bounds access in ASR180x 、ASR190x in lte-telephony, This vulnerability is associated with program files apps/lzma/src/LzmaEnc.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-49481
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-07-01T12:31:05

1 posts

Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router modules allows Resource Leak Exposure. This vulnerability is associated with program files router/phonebook/pbwork-queue.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-49488
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-07-01T12:31:05

1 posts

Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in router components allows Resource Leak Exposure. This vulnerability is associated with program files router/phonebook/pb.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-49492
(7.4 HIGH)

EPSS: 0.04%

updated 2025-07-01T12:31:05

1 posts

Out-of-bounds write in ASR180x in lte-telephony, May cause a buffer underrun.  This vulnerability is associated with program files apps/atcmd_server/src/dev_api.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-49482
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-07-01T12:31:05

1 posts

Improper Resource Shutdown or Release vulnerability in ASR180x 、ASR190x in tr069 modules allows Resource Leak Exposure. This vulnerability is associated with program files tr069/tr098.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-49489
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-07-01T12:31:05

1 posts

Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (con_mgr components) allows Resource Leak Exposure. This vulnerability is associated with program files con_mgr/dialer_task.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-5072
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-07-01T09:30:40

1 posts

Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak Exposure.This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

cR0w@infosec.exchange at 2025-07-01T12:26:43.000Z ##

Ten CVEs in various ASR gear. They're all rated sev:HIGH by ASR, though the CVSS scores are eight sev:MED and two sev:HIGH.

asrmicro.com/en/goods/psirt?ci

CVE-2025-5072
CVE-2025-49489
CVE-2025-49490
CVE-2025-49491
CVE-2025-49492
CVE-2025-49488
CVE-2025-49480
CVE-2025-49481
CVE-2025-49482
CVE-2025-49483

##

CVE-2025-41656
(10.0 CRITICAL)

EPSS: 0.14%

updated 2025-07-01T09:30:40

1 posts

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

cR0w@infosec.exchange at 2025-07-01T12:20:18.000Z ##

July is starting off with a perfect 10 in some OT kit. 🥳

certvde.com/en/advisories/VDE-

sev:CRIT 10.0 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

nvd.nist.gov/vuln/detail/CVE-2

certvde.com/en/advisories/VDE-

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-41648
(9.8 CRITICAL)

EPSS: 0.06%

updated 2025-07-01T09:30:40

1 posts

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

cR0w@infosec.exchange at 2025-07-01T12:20:18.000Z ##

July is starting off with a perfect 10 in some OT kit. 🥳

certvde.com/en/advisories/VDE-

sev:CRIT 10.0 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

nvd.nist.gov/vuln/detail/CVE-2

certvde.com/en/advisories/VDE-

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-6824
(8.8 HIGH)

EPSS: 0.17%

updated 2025-07-01T03:31:37

1 posts

A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formParentControl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-49520
(8.8 HIGH)

EPSS: 0.09%

updated 2025-07-01T03:31:36

1 posts

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

cR0w@infosec.exchange at 2025-06-30T21:42:52.000Z ##

Post-auth sev:HIGH code injection and argument injection vulns in Ansible Automation Platform.

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

bugzilla.redhat.com/show_bug.c

nvd.nist.gov/vuln/detail/CVE-2

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

bugzilla.redhat.com/show_bug.c

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-26074
(9.8 CRITICAL)

EPSS: 0.15%

updated 2025-06-30T22:16:54

1 posts

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.

cR0w@infosec.exchange at 2025-06-30T19:48:07.000Z ##

Not yet evaluated means no risk yet, right?

medium.com/@mrcnry/cve-2025-26

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.

##

CVE-2025-32462
(2.8 LOW)

EPSS: 0.02%

updated 2025-06-30T21:30:54

11 posts

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

7 repos

https://github.com/mylovem313/CVE-2025-32462

https://github.com/cybersentinelx1/CVE-2025-32462-Exploit

https://github.com/Hacksparo/CVE-2025-32462

https://github.com/CryingN/CVE-2025-32462

https://github.com/SpongeBob-369/cve-2025-32462

https://github.com/cyberpoul/CVE-2025-32462-POC

https://github.com/atomicjjbod/CVE-2025-32462

adulau@infosec.exchange at 2025-07-04T16:04:38.000Z ##

Who is right with this sudo vulnerability? The CVSS reported or the VLAI severity model?

#sudo #vulnerability #vulnerabilitymanagement #threatintel

🔗 vulnerability.circl.lu/vuln/CV

##

benzogaga33@mamot.fr at 2025-07-04T15:40:03.000Z ##

Linux – Obtenez un accès root avec ces deux failles dans sudo : CVE-2025-32462 et CVE-2025-32463 it-connect.fr/linux-acces-root #ActuCybersécurité #Vulnérabilités #Cybersécurité #Linux

##

_r_netsec@infosec.exchange at 2025-07-04T08:43:05.000Z ##

CVE-2025-32462: sudo: LPE via host option access.redhat.com/security/cve

##

jos1264@social.skynetcloud.site at 2025-07-02T17:45:03.000Z ##

CVE-2025-32463 and CVE-2025-32462: Sudo Local Privilege Escalation Vulnerabilities Threaten Linux Environments – Source: socprime.com ciso2ciso.com/cve-2025-32463-a #rssfeedpostgeneratorecho #PrivilageEscalation #CyberSecurityNews #CVE-2025-32462 #CVE-2025-32463 #Latestthreats #Vulnerability #socprimecom #socprime #Blog #CVE

##

finn@surfin.dog at 2025-07-02T14:49:26.000Z ##

update sudo yall nvd.nist.gov/vuln/detail/CVE-2

##

cR0w@infosec.exchange at 2025-07-01T15:14:21.000Z ##

I think I boosted information about these sudo EoP vulns yesterday but in case I didn't, here's some basic info on them.

stratascale.com/vulnerability-

sev:LOW 2.8 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

nvd.nist.gov/vuln/detail/CVE-2

stratascale.com/vulnerability-

sev:CRIT 9.3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

nvd.nist.gov/vuln/detail/CVE-2

##

Ubuntu@activitypub.awakari.com at 2025-07-01T12:58:55.000Z ## Sudo local privilege escalation vulnerabilities fixed (CVE-2025-32462, CVE-2025-32463) If you haven’t recently updated the Sudo utility on your Linux box(es), you should do so now, to patch two l...

#Don't #miss #Hot #stuff #News #Debian #Linux #macOS #Stratascale #SUSE #Ubuntu

Origin | Interest | Match ##

jos1264@social.skynetcloud.site at 2025-07-01T13:55:02.000Z ##

Sudo local privilege escalation vulnerabilities fixed (CVE-2025-32462, CVE-2025-32463) helpnetsecurity.com/2025/07/01 #vulnerability #Stratascale #Don'tmiss #Hotstuff #Debian #Ubuntu #Linux #macOS #News #SUSE

##

harrysintonen@infosec.exchange at 2025-06-30T16:57:52.000Z ##

Sudo versions 1.9.14 to 1.9.17 (inclusive) have two critical vulnerabilities:
- local privilege escalation via chroot option (CVE-2025-32463) openwall.com/lists/oss-securit
- local privilege escalation via host option (CVE-2025-32462) openwall.com/lists/oss-securit

#cve_2025_32463 #cve_2025_32462 #infosec #cybersecurity

##

decio@infosec.exchange at 2025-06-30T15:59:09.000Z ##

𝐬𝐮𝐝𝐨 -𝐡 𝐡𝐨𝐬𝐭

Turns out the "h" stands for "hold my beer". 🍺 😅
⬇️
Local Privilege Escalation via host option

Sudo’s host (-h or --host) option is intended to be used in conjunction with the list option (-l or --list) to list a user’s sudo privileges on a host other than the current one. However, due to a bug it was not restricted to listing privileges and could be used when running a command via sudo or editing a file with sudoedit. Depending on the rules present in the sudoers file this could allow a local privilege escalation attack.

Sudo versions 1.8.8 to 1.9.17 inclusive are affected.
👇
sudo.ws/security/advisories/ho

[related]

Vulnerability Advisory: Sudo Host Option Elevation of Privilege
👇
stratascale.com/vulnerability-

#CyberVeille #sudo #CVE_2025_32462

##

bortzmeyer@mastodon.gougere.fr at 2025-06-30T15:23:57.000Z ##

Setting up sudo (1.9.13p3-1+deb12u2) ...

Et hop, CVE-2025-32462 ne passera pas par moi. tracker.debian.org/news/164997

##

CVE-2025-6916
(8.8 HIGH)

EPSS: 0.07%

updated 2025-06-30T21:15:32.730000

1 posts

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.

1 repos

https://github.com/c0nyy/IoT_vuln

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-45931
(9.8 CRITICAL)

EPSS: 0.35%

updated 2025-06-30T19:15:24.117000

1 posts

An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-47824
(2.0 LOW)

EPSS: 0.01%

updated 2025-06-30T18:38:48.477000

1 posts

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.

CVE-2025-6881
(8.8 HIGH)

EPSS: 0.05%

updated 2025-06-30T18:38:23.493000

1 posts

A vulnerability was found in D-Link DI-8100 16.07.21. It has been rated as critical. Affected by this issue is some unknown functionality of the file /pppoe_base.asp of the component jhttpd. The manipulation of the argument mschap_en leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6825
(8.8 HIGH)

EPSS: 0.16%

updated 2025-06-30T18:38:23.493000

1 posts

A vulnerability classified as critical was found in TOTOLINK A702R up to 4.0.0-B20230721.1521. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWlSiteSurvey of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be us

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6522
(5.4 MEDIUM)

EPSS: 0.04%

updated 2025-06-30T18:38:23.493000

1 posts

Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string.

cR0w@infosec.exchange at 2025-06-30T14:10:07.000Z ##

Internet. Of. Shit.

Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-53391
(9.3 CRITICAL)

EPSS: 0.01%

updated 2025-06-30T18:38:23.493000

1 posts

The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active settings that allow a local user to escalate their privileges to root.

cR0w@infosec.exchange at 2025-06-30T13:59:29.000Z ##

That's kind of a fun PrivEsc.

sev:CRIT 9.3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active settings that allow a local user to escalate their privileges to root.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-24290
(9.9 CRITICAL)

EPSS: 0.04%

updated 2025-06-30T15:30:38

1 posts

Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privileges.

cR0w@infosec.exchange at 2025-06-30T13:50:55.000Z ##

Fucking Ubiquiti showing they're the Tesla of networking yet again.

community.ui.com/releases/Secu

sev:CRIT 9.9 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privileges.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-6899
(6.3 MEDIUM)

EPSS: 0.84%

updated 2025-06-30T09:30:35

1 posts

A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file msp_info.htm. The manipulation of the argument flag/cmd/iface leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6898
(6.3 MEDIUM)

EPSS: 0.84%

updated 2025-06-30T09:30:30

1 posts

A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the file in proxy_client.asp. The manipulation of the argument proxy_srv/proxy_lanport/proxy_lanip/proxy_srvport leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6896
(6.3 MEDIUM)

EPSS: 0.84%

updated 2025-06-30T09:30:30

1 posts

A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulation of the argument url leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6887
(8.8 HIGH)

EPSS: 0.08%

updated 2025-06-30T06:30:33

1 posts

A vulnerability was found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/SetSysTimeCfg. The manipulation of the argument time/timeZone leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6886
(8.8 HIGH)

EPSS: 0.08%

updated 2025-06-30T06:30:33

2 posts

A vulnerability has been found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

offseq@infosec.exchange at 2025-06-30T04:31:21.000Z ##

🚨 HIGH severity vuln: Tenda AC5 (15.03.06.47) stack buffer overflow in /goform/openSchedWifi (CVE-2025-6886). Remote exploit public. Restrict access & monitor for fixes! radar.offseq.com/threat/cve-20 #OffSeq #Vuln #IoT #Tenda

##

CVE-2025-6882
(8.8 HIGH)

EPSS: 0.05%

updated 2025-06-30T03:30:39

1 posts

A vulnerability classified as critical has been found in D-Link DIR-513 1.0. This affects an unknown part of the file /goform/formSetWanPPTP. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the main

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-45729
(6.3 MEDIUM)

EPSS: 0.07%

updated 2025-06-27T21:31:30

1 posts

D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6620
(6.3 MEDIUM)

EPSS: 2.28%

updated 2025-06-27T18:31:47

1 posts

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been rated as critical. Affected by this issue is the function setUpgradeUboot of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6618
(6.3 MEDIUM)

EPSS: 2.28%

updated 2025-06-27T18:31:47

1 posts

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so. The manipulation of the argument PIN leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6621
(6.3 MEDIUM)

EPSS: 2.28%

updated 2025-06-27T18:31:47

1 posts

A vulnerability classified as critical has been found in TOTOLINK CA300-PoE 6.2c.884. This affects the function QuickSetting of the file ap.so. The manipulation of the argument hour/minute leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6619
(6.3 MEDIUM)

EPSS: 2.28%

updated 2025-06-27T18:31:47

1 posts

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the file upgrade.so. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6568
(8.8 HIGH)

EPSS: 0.17%

updated 2025-06-27T18:30:43

1 posts

A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6705(CVSS UNKNOWN)

EPSS: 0.05%

updated 2025-06-27T15:31:41

1 posts

On open-vsx.org http://open-vsx.org/  it was possible to run an arbitrary build scripts for auto-published extensions because of missing sandboxing of CI job runs. An attacker who had access to an existing extension could take over the service account of the marketplace. The issue has been fixed on June 24th, 2025 and the vulnerable code present in the publish-extension code repository.

beyondmachines1@infosec.exchange at 2025-06-30T10:01:20.000Z ##

Researchers report flaw in Open VSX Registry that can compromise VS Code extensions marketplace

Cybersecurity researchers disclosed a critical vulnerability (CVE-2025-6705) in the Open VSX Registry that could have allowed attackers to gain complete control over the Visual Studio Code extensions marketplace by exploiting the automated publishing mechanism to steal high-privilege tokens and distribute malicious updates to millions of developer environments. The Eclipse Foundation patched the vulnerability on June 25, 2025.

**When designing your CI/CD system, review what code will it run and whether it will expose your API keys and other secrets to untrusted third party code that may be malicious. If your CI/CD will run such code, consider levels of isolation or use API keys that are for that session only with limited permissions. Yes, this is very difficult, but it's part of the complexity of running any code from anyone.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

CVE-2024-51978
(9.8 CRITICAL)

EPSS: 2.68%

updated 2025-06-27T14:15:32.593000

1 posts

An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.

Nuclei template

1 repos

https://github.com/sfewer-r7/BrotherVulnerabilities

LMGsecurity@infosec.exchange at 2025-06-30T13:40:58.000Z ##

More information on printer security, since they are often a cybersecurity blind spot!

Last week, we shared a warning about the unpatchable Brother printer vulnerability (CVE-2024-51978) that puts millions of devices at risk. If you haven’t updated your default admin passwords, do it now.

Since there was a lot of interest in this topic, we're sharing our classic, but still very relevant, on-demand webinar, "How I met your printer": youtu.be/b6d6RO2AFgw

@tompohl shares real-world techniques attackers use to exploit printers for initial access and lateral movement—exactly what we see in our penetration tests all the time.

If you haven’t tested your print infrastructure, now’s the time. Need help? Our pentest team can assess your network and highlight hidden vulnerabilities.

#Cybersecurity #CISO #PrinterSecurity #PenetrationTesting #LMGSecurity #NetworkSecurity #Infosec #ITsecurity
#penetrationtesting #pentest #pentesting

##

CVE-2024-54085
(9.8 CRITICAL)

EPSS: 9.47%

updated 2025-06-27T12:32:19

1 posts

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.

1 repos

https://github.com/Mr-Zapi/CVE-2024-54085

benzogaga33@mamot.fr at 2025-07-02T15:40:02.000Z ##

Cette faille critique dans MegaRAC menace des milliers de serveurs, y compris ceux éteints ! it-connect.fr/faille-ami-megar #ActuCybersécurité #Cybersécurité #Vulnérabilité

##

CVE-2025-6752
(8.8 HIGH)

EPSS: 0.09%

updated 2025-06-27T06:31:22

1 posts

A vulnerability has been found in Linksys WRT1900ACS, EA7200, EA7450 and EA7500 up to 20250619 and classified as critical. This vulnerability affects the function SetDefaultConnectionService of the file /upnp/control/Layer3Forwarding of the component IGD. The manipulation of the argument NewDefaultConnectionService leads to stack-based buffer overflow. The attack can be initiated remotely. The exp

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6751
(8.8 HIGH)

EPSS: 0.09%

updated 2025-06-27T06:31:22

1 posts

A vulnerability, which was classified as critical, was found in Linksys E8450 up to 1.2.00.360516. This affects the function set_device_language of the file portal.cgi of the component HTTP POST Request Handler. The manipulation of the argument dut_language leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The ve

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-47819
(6.4 MEDIUM)

EPSS: 0.02%

updated 2025-06-27T03:30:47

1 posts

Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control.

CVE-2025-47821
(2.2 LOW)

EPSS: 0.02%

updated 2025-06-27T03:30:47

1 posts

Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.

CVE-2025-47822
(6.4 MEDIUM)

EPSS: 0.02%

updated 2025-06-27T03:30:47

1 posts

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control.

CVE-2025-47823
(2.2 LOW)

EPSS: 0.02%

updated 2025-06-27T03:30:47

1 posts

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.

CVE-2025-47818
(2.2 LOW)

EPSS: 0.02%

updated 2025-06-27T03:30:41

1 posts

Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.

CVE-2025-6734
(8.8 HIGH)

EPSS: 0.05%

updated 2025-06-27T00:32:15

1 posts

A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been rated as critical. This issue affects the function sub_484E40 of the file /goform/formP2PLimitConfig of the component API. The manipulation of the argument except leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early abou

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6732
(8.8 HIGH)

EPSS: 0.05%

updated 2025-06-27T00:32:15

1 posts

A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the component API. The manipulation of the argument passwd1 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about t

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6627
(8.8 HIGH)

EPSS: 0.16%

updated 2025-06-26T21:31:22

1 posts

A vulnerability has been found in TOTOLINK A702R 4.0.0-B20230721.1521 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6616
(8.8 HIGH)

EPSS: 0.09%

updated 2025-06-26T21:31:21

1 posts

A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWAN_Wizard51 of the file /goform/formSetWAN_Wizard51. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects pr

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6614
(8.8 HIGH)

EPSS: 0.09%

updated 2025-06-26T21:31:20

1 posts

A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetWANType_Wizard5 of the file /goform/formSetWANType_Wizard5. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability onl

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-20281
(9.8 CRITICAL)

EPSS: 0.14%

updated 2025-06-26T21:31:20

1 posts

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitti

4 repos

https://github.com/grupooruss/CVE-2025-20281-Cisco

https://github.com/ill-deed/Cisco-CVE-2025-20281-illdeed

https://github.com/abrewer251/CVE-2025-20281-2-Cisco-ISE-RCE

https://github.com/B1ack4sh/Blackash-CVE-2025-20281

DarkWebInformer@infosec.exchange at 2025-06-30T19:10:23.000Z ##

🚨CVE-2025-20281 & CVE-2025-20282: Unauthenticated RCE Vulnerabilities in Cisco ISE and ISE-PIC

• CVSS: 10
• ZoomEye Dork: app="Cisco ISE"
• Results: 1,937
• Advisory:
github.com/advisories/GHSA-rc4f-42xm-hvjwgithub.com/advisories/GHSA-w8p2-wjjr-hr24

• PoC: github.com/abrewer251/CVE-2025-20281-2-Citrix-ISE-RCE

• ZoomEye Search: zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBJU0Ui

—————

Follow @zoomeye_team's official Twitter/X account and send the message “Dark Web Informer” via DM to receive an extra 15-day membership. 💙

##

CVE-2025-6615
(8.8 HIGH)

EPSS: 0.09%

updated 2025-06-26T21:31:13

1 posts

A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formAutoDetecWAN_wizard4 of the file /goform/formAutoDetecWAN_wizard4. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only a

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-20282
(10.0 CRITICAL)

EPSS: 0.14%

updated 2025-06-26T21:31:13

1 posts

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system. An a

DarkWebInformer@infosec.exchange at 2025-06-30T19:10:23.000Z ##

🚨CVE-2025-20281 & CVE-2025-20282: Unauthenticated RCE Vulnerabilities in Cisco ISE and ISE-PIC

• CVSS: 10
• ZoomEye Dork: app="Cisco ISE"
• Results: 1,937
• Advisory:
github.com/advisories/GHSA-rc4f-42xm-hvjwgithub.com/advisories/GHSA-w8p2-wjjr-hr24

• PoC: github.com/abrewer251/CVE-2025-20281-2-Citrix-ISE-RCE

• ZoomEye Search: zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBJU0Ui

—————

Follow @zoomeye_team's official Twitter/X account and send the message “Dark Web Informer” via DM to receive an extra 15-day membership. 💙

##

CVE-2025-32977
(9.7 CRITICAL)

EPSS: 0.02%

updated 2025-06-26T21:31:13

1 posts

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to upload backup files to the system. While signature validation is implemented, weaknesses in the validation process can be exploited to upload malicious backup content that could co

CVE-2025-6565
(8.8 HIGH)

EPSS: 0.19%

updated 2025-06-26T21:31:09

1 posts

A vulnerability was found in Netgear WNCE3001 1.0.0.50. It has been classified as critical. This affects the function http_d of the component HTTP POST Request Handler. The manipulation of the argument Host leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-36537
(7.0 None)

EPSS: 0.01%

updated 2025-06-26T21:31:09

1 posts

Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.

cR0w@infosec.exchange at 2025-06-30T20:15:16.000Z ##

Oh hey, now if the baddies get your box, you can privesc to get it back.

teamviewer.com/en/resources/tr

Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-32976
(8.8 HIGH)

EPSS: 0.10%

updated 2025-06-26T21:31:09

1 posts

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass TOTP-based 2FA requirements. The vulnerability exists in the 2FA validation process and can be explo

CVE-2025-34037(CVSS UNKNOWN)

EPSS: 2.46%

updated 2025-06-26T21:31:08

1 posts

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This vulnerability is exploited in the wild by the "TheMoon" w

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6559
(9.8 CRITICAL)

EPSS: 0.62%

updated 2025-06-26T21:31:08

1 posts

Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The affected models are out of support; replacing the device is recommended.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-32975
(10.0 CRITICAL)

EPSS: 0.12%

updated 2025-06-26T21:31:08

1 posts

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead

CVE-2025-34034(CVSS UNKNOWN)

EPSS: 0.05%

updated 2025-06-26T21:31:08

1 posts

A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default and hardcoded user accounts that are not disclosed in public documentation. These accounts allow unauthenticated or low-privilege attackers to gain administrative access to the device’s web interface.

cR0w@infosec.exchange at 2025-06-30T18:57:43.000Z ##

sigh

sev:CRIT 9.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default and hardcoded user accounts that are not disclosed in public documentation. These accounts allow unauthenticated or low-privilege attackers to gain administrative access to the device’s web interface.

And those creds are:

blueangel:blueangel
root:abnareum10
root:Admin@tbroad
root:superuser
user:user
guest:guest

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-34041(CVSS UNKNOWN)

EPSS: 1.03%

updated 2025-06-26T21:31:08

1 posts

An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response (EDR) management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious HTTP requests to the EDR Manager interface, leading to arbitrary command execution with elevated privileges. This flaw only affects the Chines

cR0w@infosec.exchange at 2025-06-30T18:57:37.000Z ##

LMAO. It's an older vuln and was added to CNVD in 2020 but just got a CVE last week. 🥳

sangfor.com/blog/cybersecurity

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

An OS command injection vulnerability exists in the Chinese versions of Sangfor Endpoint Detection and Response (EDR) management platform versions 3.2.16, 3.2.17, and 3.2.19. The vulnerability allows unauthenticated attackers to construct and send malicious HTTP requests to the EDR Manager interface, leading to arbitrary command execution with elevated privileges. This flaw only affects the Chinese-language EDR builds.

cnvd.org.cn/flaw/show/CNVD-202

nvd.nist.gov/vuln/detail/CVE-2

And FWIW, ShadowServer shows EITW in CN.

dashboard.shadowserver.org/sta

##

CVE-2025-6560
(9.8 CRITICAL)

EPSS: 0.11%

updated 2025-06-26T18:58:14.280000

1 posts

Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials.  The affected models are out of support; replacing the device is recommended.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-48469
(9.6 CRITICAL)

EPSS: 0.04%

updated 2025-06-26T18:58:14.280000

1 posts

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-52570
(0 None)

EPSS: 0.06%

updated 2025-06-26T18:58:14.280000

1 posts

Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections (TCP, UDP and Unix socket) for the services letmeind and letmeinfwd. Therefore, the command line option num-connections is not effective and does not limit the number of simultaneously incoming connections. This

cR0w@infosec.exchange at 2025-06-30T19:57:34.000Z ##

Wait, we're still doing port knocking? I thought that was a lost art that got snuffed out by the "obscurity does not provide security" nerds.

github.com/mbuesch/letmein/sec

Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections (TCP, UDP and Unix socket) for the services letmeind and letmeinfwd. Therefore, the command line option num-connections is not effective and does not limit the number of simultaneously incoming connections. This issue has been patched in version 10.2.1.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-52562
(10.0 CRITICAL)

EPSS: 1.48%

updated 2025-06-26T18:58:14.280000

1 posts

Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious locale and namespace parameters. This allows the attacker to include an

cR0w@infosec.exchange at 2025-06-30T19:01:17.000Z ##

Oh my. Perfect 10 ../ in a KVM server management panel.

github.com/ConvoyPanel/panel/s

sev:CRIT 10.0 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious locale and namespace parameters. This allows the attacker to include and execute arbitrary PHP files on the server. This issue has been patched in version 4.4.1. A temporary workaround involves implementing strict Web Application Firewall (WAF) rules to incoming requests targeting the vulnerable endpoints.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-32978
(7.5 HIGH)

EPSS: 0.06%

updated 2025-06-26T18:58:14.280000

1 posts

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to replace system licenses through a web interface intended for license renewal. Attackers can exploit this to replace valid licenses with expired or trial licenses, causing denial of

CVE-2025-34049
(0 None)

EPSS: 0.63%

updated 2025-06-26T18:57:43.670000

1 posts

An OS command injection vulnerability exists in the OptiLink ONT1GEW GPON router firmware version V2.1.11_X101 Build 1127.190306 and earlier. The router’s web management interface fails to properly sanitize user input in the target_addr parameter of the formTracert and formPing administrative endpoints. An authenticated attacker can inject arbitrary operating system commands, which are executed wi

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-34042
(0 None)

EPSS: 0.66%

updated 2025-06-26T18:57:43.670000

1 posts

An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which are unsafely embedded into backend system calls without proper input sanitization. Successful exploitat

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6617
(8.8 HIGH)

EPSS: 0.09%

updated 2025-06-26T18:57:43.670000

1 posts

A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-36038
(9.0 CRITICAL)

EPSS: 0.24%

updated 2025-06-26T18:57:43.670000

1 posts

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

cR0w@infosec.exchange at 2025-06-30T20:09:20.000Z ##

Oof.

ibm.com/support/pages/node/723

sev:CRIT 9.0 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2024-6174
(8.8 HIGH)

EPSS: 0.02%

updated 2025-06-26T18:57:43.670000

1 posts

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

cR0w@infosec.exchange at 2025-06-30T14:42:05.000Z ##

Wat

sev:HIGH 8.8 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-34043(CVSS UNKNOWN)

EPSS: 0.40%

updated 2025-06-26T18:31:35

1 posts

A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests. These commands are executed with the privileges of the web server process, enabling remote code exec

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-34044(CVSS UNKNOWN)

EPSS: 0.12%

updated 2025-06-26T18:31:34

1 posts

A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-34048(CVSS UNKNOWN)

EPSS: 0.26%

updated 2025-06-26T18:31:34

1 posts

A path traversal vulnerability exists in the web management interface of D-Link DSL-2730U, DSL-2750U, and DSL-2750E ADSL routers with firmware versions IN_1.02, SEA_1.04, and SEA_1.07. The vulnerability is due to insufficient input validation on the getpage parameter within the /cgi-bin/webproc CGI script. This flaw allows an unauthenticated remote attacker to perform path traversal attacks by sup

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6400
(8.8 HIGH)

EPSS: 0.17%

updated 2025-06-25T20:13:52.420000

1 posts

A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formPortFw of the component HTTP POST Message Handler. The manipulation of the argument service_type leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6399
(8.8 HIGH)

EPSS: 0.17%

updated 2025-06-25T20:13:30.100000

1 posts

A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6372
(8.8 HIGH)

EPSS: 0.03%

updated 2025-06-25T20:09:56.243000

1 posts

A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formSetWizard1 of the file /goform/formSetWizard1. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6369
(8.8 HIGH)

EPSS: 0.03%

updated 2025-06-25T20:09:28.010000

1 posts

A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01. Affected is the function formdumpeasysetup of the file /goform/formdumpeasysetup. The manipulation of the argument curTime/config.save_network_enabled leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability on

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-44531
(7.5 HIGH)

EPSS: 0.05%

updated 2025-06-24T21:30:28

1 posts

An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is received during a Bluetooth connection attempt.

cR0w@infosec.exchange at 2025-06-30T20:16:07.000Z ##

Get your Flippers out.

github.com/yangting111/BLE_TES

An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is received during a Bluetooth connection attempt.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2024-56731
(10.0 CRITICAL)

EPSS: 0.33%

updated 2025-06-24T19:00:21

1 posts

### Summary Due to the insufficient patch for the CVE-2024-39931, it's still possible to delete files under the `.git` directory and achieve remote command execution. ### Details In the patch for CVE-2024-39931, the following check is added: https://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9 ```diff + // 🚨 SECURITY: Prevent uploading files into the ".git" directory + if

cR0w@infosec.exchange at 2025-06-30T20:03:10.000Z ##

Woohoo! Another perfect 10 from last week. And this could hit hard. 🥳

github.com/gogs/gogs/security/

sev:CRIT 10.0 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-6374
(8.8 HIGH)

EPSS: 0.03%

updated 2025-06-23T21:31:56

1 posts

A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formSetACLFilter of the file /goform/formSetACLFilter. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6402
(8.8 HIGH)

EPSS: 0.16%

updated 2025-06-23T21:31:56

1 posts

A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6511
(8.8 HIGH)

EPSS: 0.19%

updated 2025-06-23T20:16:21.633000

1 posts

A vulnerability classified as critical has been found in Netgear EX6150 1.0.0.46_1.0.76. This affects the function sub_410090. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-34029
(0 None)

EPSS: 1.10%

updated 2025-06-23T20:16:21.633000

1 posts

An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commands directly, resulting in command execution as the root user.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-34021
(0 None)

EPSS: 0.06%

updated 2025-06-23T20:16:21.633000

1 posts

A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The application fails to validate user-supplied input in JSON POST parameters such as ipnotify_address and url, which are used by internal mechanisms to perform ima

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-27636
(5.6 MEDIUM)

EPSS: 43.34%

updated 2025-06-23T18:54:52.400000

2 posts

Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header fil

2 repos

https://github.com/enochgitgamefied/CVE-2025-27636-Practical-Lab

https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC

cR0w@infosec.exchange at 2025-07-03T12:48:29.000Z ##

Unit42 has a good write-up on some ITW Tomcat and Camel shenanigans exploiting CVE-2025-24813, CVE-2025-27636, and CVE-2025-29891. IOCs in the post.

But does anyone know if this is a typo by the article or if there are actual files with the .sesson extension? Seems like a good indicator to search on if it's not a typo.

As noted in our earlier analysis, exploits for CVE-2025-24813 use a name appended by .sesson in the initial HTTP request. This .session file contains the code the vulnerable host will run if an exploit is successful.

Edit: Confirmed typo per this response: infosec.exchange/@0xThiebaut/1

unit42.paloaltonetworks.com/ap

#threatIntel

##

LCSC_IE@infosec.exchange at 2025-07-03T11:49:00.000Z ##

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟑 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Microsoft to Lay Off 9,000 Employees, Affecting 4% of Workforce

reuters.com/business/world-at-

2. Hunters International Ransomware Shuts Down, Offers Free Decryptors to Victims

cyberinsider.com/hunters-inter

3. UK charity bank branded a 'disaster' after platform migration goes wrong

theregister.com/2025/07/03/uk_

4. Police warn of SMS scams following prison sentence for criminal who conducted smishing campaign

ukfinance.org.uk/news-and-insi

5. Large Language Models (LLMs) Are Falling for Phishing Scams: What Happens When AI Gives You the Wrong URL?

netcraft.com/blog/large-langua

6. Russia’s Cyber Warriors Assail NATO-Linked Private Companies

cepa.org/article/russias-cyber

7. US probes negotiator suspected of taking crypto ransomware money

cointelegraph.com/news/digital

8. Cyberattacks Disrupt Iran’s Bread Distribution, Payments Remain Frozen

iranwire.com/en/news/142915-cy

9. Spain arrests hackers who targeted politicians and journalists

policia.es/_es/comunicacion_pr

10. A third of organisations take more than 90 days to remediate threats

itsecurityguru.org/2025/07/02/

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Irish Eyecare software firm Ocuco investigating cyber-attack

thecurrency.news/articles/1946

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack

unit42.paloaltonetworks.com/ap

2. Snake Keyloggers Exploit Java Tools to Bypass Security – Active IOCs

rewterz.com/threat-advisory/sn

3. Who are DragonForce Ransomware Group?

bridewell.com/insights/blogs/d

4. Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign Using Thousands of Websites to Spoof Popular Retail Brands

silentpush.com/blog/fake-marke

5. Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

wiz.io/blog/exposed-jdwp-explo

6. Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

arcticwolf.com/resources/blog/

7. North Korean APT Kimsuky aka Black Banshee – Active IOCs

rewterz.com/threat-advisory/no

8. DarkTortilla Malware – Active IOCs

rewterz.com/threat-advisory/da

---

𝐀𝐏𝐓 𝐈𝐎𝐂𝐬:

1. Lazarus: Source VT
yourdomainhost[.]store
api[.]yourdomainhost[.]store

2. Kimsuky: Source Validin
Accounts-mysticete[.]servepics[.]com
freedrive[.]servehttp[.]com
login-accounts[.]servehttp[.]com
myaccounts-profile[.]servehttp[.]com
mydocs[.]onthewifi[.]com
securedrive-mofa[.]servehttp[.]com
translate[.]onthewifi[.]com
undocs[.]ddns[.]net
undocs[.]myvnc[.]com
undocs[.]servehttp[.]com

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. Automating macOS Incident Response: DFIR-as-Code in Action Against AppleProcessHub

abstract.security/blog/automat

2. Using Staging Folders For Threat Hunting

knowyouradversary.ru/2025/07/1

3. PDFs: Portable documents, or perfect deliveries for phish?

blog.talosintelligence.com/pdf

4. EscapeRoute: Breaking the Scope of Anthropic’s Filesystem MCP Server
(CVE-2025-53109 & CVE-2025-53110)

cymulate.com/blog/cve-2025-531

5. Yet another ZIP trick

hackarcana.com/article/yet-ano

6. Malware development trick 48: leveraging Office macros for malware. Simple VBA example.

cocomelonc.github.io/malware/2

7. Hijacked by a Text: Understanding and Preventing SIM Swapping Attack

bitsight.com/blog/what-is-sim-

8. CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries

crowdstrike.com/en-us/blog/cro

9. DanaBot Lab Analysis

omer-secure.medium.com/danabot

10. ClickFix Campaign: How Clipboard Injection Leads to RAT Infection (Part 1)

h3xstone.medium.com/clickfix-c

11. Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules

any.run/cybersecurity-blog/rel

12. Inside Android Malware Development: Building a C2 Exfiltrator from the UI to the Network

medium.com/@lord_murak/inside-

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. Pro-Russian hacktivism: Shifting alliances, new groups and risks

intel471.com/blog/pro-russian-

2. Insider Risk Lessons from the DPRK IT Worker Crackdown

dtexsystems.com/blog/insider-r

3. Calling Out Russia: France’s Shift on Public Attribution

warontherocks.com/2025/07/call

4. Outsourced Trust: How Coinbase's $400M Problem Started in an Indian Call Center

reco.ai/blog/coinbase-breach

---

##

CVE-2025-6510
(8.8 HIGH)

EPSS: 0.19%

updated 2025-06-23T18:30:33

1 posts

A vulnerability was found in Netgear EX6100 1.0.2.28_1.1.138. It has been rated as critical. Affected by this issue is the function sub_415EF8. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6393
(8.8 HIGH)

EPSS: 0.65%

updated 2025-06-23T15:31:43

1 posts

A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713. It has been classified as critical. Affected is an unknown function of the file /boafrm/formIPv6Addr of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6486
(8.8 HIGH)

EPSS: 0.14%

updated 2025-06-22T18:30:39

1 posts

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6487
(8.8 HIGH)

EPSS: 0.14%

updated 2025-06-22T18:30:31

1 posts

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been rated as critical. This issue affects the function formRoute of the file /boafrm/formRoute. The manipulation of the argument subnet leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6371
(8.8 HIGH)

EPSS: 0.06%

updated 2025-06-21T00:30:38

1 posts

A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affe

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6370
(8.8 HIGH)

EPSS: 0.03%

updated 2025-06-21T00:30:38

1 posts

A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01. Affected by this vulnerability is the function formWlanGuestSetup of the file /goform/formWlanGuestSetup. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects product

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6368
(8.8 HIGH)

EPSS: 0.03%

updated 2025-06-21T00:30:37

1 posts

A vulnerability was found in D-Link DIR-619L 2.06B01. It has been rated as critical. This issue affects the function formSetEmail of the file /goform/formSetEmail. The manipulation of the argument curTime/config.smtp_email_subject leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-6373
(8.8 HIGH)

EPSS: 0.03%

updated 2025-06-21T00:30:37

1 posts

A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWizard1 of the file /goform/formWlSiteSurvey. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products t

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-49132
(10.0 CRITICAL)

EPSS: 23.69%

updated 2025-06-20T22:21:17

1 posts

## Impact Using the `/locales/locale.json` with the `locale` and `namespace` query parameters, a malicious actor is able to execute arbitrary code, without being authenticated. With the ability to execute arbitrary code, this vulnerability can be exploited in an infinite number of ways. It could be used to gain access to the Panel's server, read credentials from the Panel's config (`.env` or ot

Nuclei template

6 repos

https://github.com/63square/CVE-2025-49132

https://github.com/melonlonmeo/CVE-2025-49132

https://github.com/Zen-kun04/CVE-2025-49132

https://github.com/nfoltc/CVE-2025-49132

https://github.com/qiaojojo/CVE-2025-49132_poc

https://github.com/uxieltc/CVE-2025-49132

cR0w@infosec.exchange at 2025-06-30T21:50:38.000Z ##

FYI: There is a ton of scanning for this one for some reason.

/locales/locale.json?locale=../../../pterodactyl&namespace=config/database

/locales/locale.json?locale=../../config/&namespace=database

github.com/Zen-kun04/CVE-2025-

##

CVE-2025-6367
(8.8 HIGH)

EPSS: 0.03%

updated 2025-06-20T21:32:14

1 posts

A vulnerability was found in D-Link DIR-619L 2.06B01. It has been declared as critical. This vulnerability affects unknown code of the file /goform/formSetDomainFilter. The manipulation of the argument curTime/sched_name_%d/url_%d leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-34024(CVSS UNKNOWN)

EPSS: 0.64%

updated 2025-06-20T21:32:14

1 posts

An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user.

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

CVE-2025-34022(CVSS UNKNOWN)

EPSS: 0.26%

updated 2025-06-20T21:32:13

1 posts

A path traversal vulnerability exists in multiple models of Selea Targa IP OCR-ANPR cameras, including iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, and Targa 704 ILB. The /common/get_file.php script in the “Download Archive in Storage” page fails to properly validate user-supplied input to the file parameter. Unauthenticated remote attackers can

cR0w@infosec.exchange at 2025-06-30T20:26:54.000Z ##

Everyone likes vulnerable network devices, right? Cool. Have fun. And as always, poke around the linked repos for more goodies.

Linksys:

exploit-db.com/exploits/31683

nvd.nist.gov/vuln/detail/CVE-2

github.com/CH13hh/tmp_store_cc

nvd.nist.gov/vuln/detail/CVE-2

github.com/feiwuxingxie/cve/bl

nvd.nist.gov/vuln/detail/CVE-2

D-Link:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

github.com/Synmac05/CVE-adviso

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/threat9/routersploi

nvd.nist.gov/vuln/detail/CVE-2

kdev.site/2025/04/02/d-link-82

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603693

nvd.nist.gov/vuln/detail/CVE-2

vuldb.com/?submit.603692

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

github.com/2664521593/mycve/bl

nvd.nist.gov/vuln/detail/CVE-2

Netgear:

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

github.com/xiaobor123/vul-find

nvd.nist.gov/vuln/detail/CVE-2

TOTOLINK:

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/c0nyy/IoT_vuln/blob

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/wudipjq/my_vuln/blo

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

github.com/awindog/cve/blob/ma

nvd.nist.gov/vuln/detail/CVE-2

Tenda:

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

lavender-bicycle-a5a.notion.si

nvd.nist.gov/vuln/detail/CVE-2

Edimax:

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

exploit-db.com/exploits/48377

nvd.nist.gov/vuln/detail/CVE-2

UTT:

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

github.com/d2pq/cve/blob/main/

nvd.nist.gov/vuln/detail/CVE-2

Advantech:

jro.sg/CVEs/CVE-2025-48469/

csa.gov.sg/alerts-and-advisori

nvd.nist.gov/vuln/detail/CVE-2

OptiLink:

exploit-db.com/exploits/49955

nvd.nist.gov/vuln/detail/CVE-2

Sapidio:

twcert.org.tw/tw/cp-132-10197-

nvd.nist.gov/vuln/detail/CVE-2

twcert.org.tw/tw/cp-132-10196-

nvd.nist.gov/vuln/detail/CVE-2

WIFISKY:

s4e.io/tools/wifisky-7-layer-f

nvd.nist.gov/vuln/detail/CVE-2

Vacron NVR:

ssd-disclosure.com/ssd-advisor

nvd.nist.gov/vuln/detail/CVE-2

Beward IP Camera:

cxsecurity.com/issue/WLB-20190

nvd.nist.gov/vuln/detail/CVE-2

Selea Targa IP Cameras:

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cxsecurity.com/issue/WLB-20210

nvd.nist.gov/vuln/detail/CVE-2

cc: @Dio9sys @da_667

##

GossiTheDog@cyberplace.social at 2025-07-05T18:54:14.000Z ##

Updated scan results for CVE-2025-5777: github.com/GossiTheDog/scannin

It's still partial due to bugs, but about 18k servers.

##

AAKL at 2025-07-05T16:50:05.964Z ##

Posted yesterday.

WatchTower: How Much More Must We Bleed? - Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777) labs.watchtowr.com/how-much-mo @watchtower

##

LLMs@activitypub.awakari.com at 2025-07-04T19:13:56.000Z ## How Much More Must We Bleed? - Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777) Before you dive into our latest diatribe, indulge us and join us on a journey. Sit in your chair, sta...


Origin | Interest | Match ##

GossiTheDog@cyberplace.social at 2025-07-05T18:54:14.000Z ##

Updated scan results for CVE-2025-5777: github.com/GossiTheDog/scannin

It's still partial due to bugs, but about 18k servers.

##

AAKL@infosec.exchange at 2025-07-05T16:50:05.000Z ##

Posted yesterday.

WatchTower: How Much More Must We Bleed? - Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777) labs.watchtowr.com/how-much-mo @watchtower #Citrix #cybersecurity #infosec

##

jos1264@social.skynetcloud.site at 2025-07-05T03:01:17.000Z ##

CVE-2025-5777 Detection: A New Critical Vulnerability Dubbed “CitrixBleed 2” in NetScaler ADC Faces Exploitation Risk – Source: socprime.com ciso2ciso.com/cve-2025-5777-de #rssfeedpostgeneratorecho #CyberSecurityNews #CVE-2025-5777 #Latestthreats #Vulnerability #CitrixBleed2 #socprimecom #socprime #Blog #CVE

##

GossiTheDog@cyberplace.social at 2025-07-04T21:08:45.000Z ##

First exploitation details for CVE-2025-5777 - the Netscaler vuln - are out. labs.watchtowr.com/how-much-mo

If you call the login page, it leaks memory in the response 🤣

I don’t want to specify too much extra technical info on this yet - but if you keep leaking the memory via requests, there’s a way to reestablish existing ICA sessions from the leaked memory.

##

nopatience@swecyb.com at 2025-07-04T20:49:55.000Z ##

labs.watchtowr.com/how-much-mo

Have not read this yet, but I'm going to assume it's good... and entertaining.

@GossiTheDog This is what you were talking about right? 🙂

#Threatintel #Cybersecurity #Infosec

##

_r_netsec@infosec.exchange at 2025-07-04T19:28:06.000Z ##

How Much More Must We Bleed? - Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777) - watchTowr Labs labs.watchtowr.com/how-much-mo

##

soc_prime@infosec.exchange at 2025-07-04T14:30:36.000Z ##

Heads up—CitrixBleed 2 reopens old wounds! CVE-2025-5777 puts NetScaler ADC at high risk, enabling user session hijacks & auth bypass. Detect potential exploitation attempts with the latest Sigma rule from SOC Prime Platform.

socprime.com/blog/detect-cve-2

##

GossiTheDog@cyberplace.social at 2025-07-04T10:38:44.000Z ##

I've published my scan in progress of CVE-2025-5777 patching status, listing IPs, hostnames, Citrix Netscaler build numbers and if they're vulnerable to CitrixBleed2.

The scan isn't finished yet so these are only about a quarter of the results - unfortunately my coding skills are shite and it's really slow - should be finished over weekend or early next week.

Also, the SSL certificate hostnames are separated by comma which throws out CSV - sorry, I'll fix that later.

github.com/GossiTheDog/scannin

##

GossiTheDog@cyberplace.social at 2025-07-04T10:20:08.000Z ##

Further suggestions CVE-2025-5777 details will release next week. xcancel.com/Horizon3Attack/sta via horizon3.ai

##

GossiTheDog@cyberplace.social at 2025-07-04T08:27:04.000Z ##

I expect technical details of CVE-2025-5777 exploitation to become available next week.

##

GossiTheDog@cyberplace.social at 2025-07-01T09:42:59.000Z ##

If you see this GitHub PoC for CVE-2025-5777 doing the rounds:

github.com/mingshenhk/CitrixBl

It’s not for CVE-2025-5777. It’s AI generated. The links in the README still have ChatGPT UTM sources.

The PoC itself is for a vuln addressed in 2023 - ChatGPT has hallucinated (made up) the cause of the vuln using an old BishopFox write up of the other vuln.

##

GossiTheDog@cyberplace.social at 2025-07-01T09:36:40.000Z ##

Citrix blog on CVE-2025-5777 and some other ones netscaler.com/blog/news/netsca

##

cisakevtracker@mastodon.social at 2025-06-30T18:00:49.000Z ##

CVE ID: CVE-2025-6543
Vendor: Citrix
Product: NetScaler ADC and Gateway
Date Added: 2025-06-30
Notes: support.citrix.com/support-hom ; netscaler.com/blog/news/netsca ; nvd.nist.gov/vuln/detail/CVE-2
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

jos1264@social.skynetcloud.site at 2025-06-30T13:05:02.000Z ##

CitrixBleed 2 might be actively exploited (CVE-2025-5777) helpnetsecurity.com/2025/06/30 #vulnerability #enterprise #ReliaQuest #Don'tmiss #NetScaler #Hotstuff #Censys #Citrix #News

##

CVE-2025-49596(CVSS UNKNOWN)

EPSS: 0.52%

updated 2025-06-13T22:15:27

2 posts

Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities. Credit: Rémy Marot <bughunters@tenable.com>

1 repos

https://github.com/ashiqrehan-21/MCP-Inspector-CVE-2025-49596

beyondmachines1@infosec.exchange at 2025-07-02T09:01:22.000Z ##

Critical remote code execution flaw reported in Anthropic's MCP Inspector tool

Cybersecurity researchers disclosed a critical vulnerability (CVE-2025-49596, CVSS 9.4) in Anthropic's Model Context Protocol (MCP) Inspector debugging tool that allows remote code execution on developer machines through browser-based attacks exploiting the "0.0.0.0 Day" vulnerability and lack of authentication in default configurations. Attackers can compromise developer systems by tricking them into visiting malicious websites that send unauthorized commands to locally running MCP Inspector instances.

**If you're using Anthropic's MCP Inspector for AI development upgrade to version 0.14.1 or later. There is a fairly trivial exploit of your MCP Inspector tool that only requires you to visit a malicious site for your laptop to be fully compromised. So don't ignore this, update your MCP Inspector.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

_r_netsec@infosec.exchange at 2025-07-02T00:28:05.000Z ##

Critical RCE in Anthropic MCP Inspector (CVE-2025-49596) Enables Browser-Based Exploits | Oligo Security oligo.security/blog/critical-r

##

CVE-2025-22157
(8.8 HIGH)

EPSS: 0.05%

updated 2025-06-12T18:31:14

1 posts

This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user. Atl

DarkWebInformer@infosec.exchange at 2025-07-02T00:06:31.000Z ##

🚨CVE-2025-22157: Privilege Escalation Vulnerability in Jira Core Data Center

darkwebinformer.com/cve-2025-2

——————

Follow @zoomeye_team's official Twitter/X account and send the message “Dark Web Informer” via DM to receive an extra 15-day membership.

##

CVE-2025-33073
(8.8 HIGH)

EPSS: 0.39%

updated 2025-06-12T16:06:39.330000

1 posts

Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

2 repos

https://github.com/mverschu/CVE-2025-33073

https://github.com/obscura-cert/CVE-2025-33073

kpwn@infosec.exchange at 2025-07-03T13:09:02.000Z ##

Rank 3: CVE-2025-33073
Product: Microsoft Windows
CVSS: High (8.8)

A privilege-escalation vulnerability in Microsoft Windows Kerberos authentication over SMB allows a low-privileged attacker to coerce a Windows host into authenticating to their system and then relay its computer account's Kerberos ticket back to itself, resulting in NT AUTHORITY\SYSTEM access.

Post by @RedTeamPentesting:
mastodon.social/@RedTeamPentes

##

CVE-2025-48927
(5.3 MEDIUM)

EPSS: 11.15%

updated 2025-05-28T18:33:28

3 posts

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.

beyondmachines1@infosec.exchange at 2025-07-04T09:01:18.000Z ##

CISA warns of active attacks on Signal clone TeleMessage

CISA has issued a warning about two actively exploited vulnerabilities in TeleMessage TM SGNL, a Signal clone used by national security staffers and government officials, including a Spring Boot Actuator misconfiguration (CVE-2025-48927) that exposes memory dumps and a local access vulnerability (CVE-2025-48928) enabling password extraction.

**If you're using TeleMessage TM SGNL, start patching it today, because it's being actively exploited. Alternatively, stop using the software entirely. Switch back to standard Signal or another approved properly encrypted messaging app since TM SGNL has already been breached and continues to be attacked.**
#cybersecurity #infosec #attack #activeattack
beyondmachines.net/event_detai

##

AAKL@infosec.exchange at 2025-07-01T19:28:38.000Z ##

CISA has added to the KEV catalogue:

- CVE-2025-48927: TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Vulnerability cve.org/CVERecord?id=CVE-2025-

- CVE-2025-48928: TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere Vulnerability cve.org/CVERecord?id=CVE-2025-

From yesterday:

- CVE-2025-6543: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability cve.org/CVERecord?id=CVE-2025- #CISA #cybersecurity #infosec

##

cisakevtracker@mastodon.social at 2025-07-01T18:01:08.000Z ##

CVE ID: CVE-2025-48927
Vendor: TeleMessage
Product: TM SGNL
Date Added: 2025-07-01
Notes: It is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue use of the product. ; nvd.nist.gov/vuln/detail/CVE-2
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2010-2772
(7.8 HIGH)

EPSS: 0.08%

updated 2025-04-11T00:51:21.963000

1 posts

Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stuxnet worm, a different vulnerability than CVE-2010-2568.

maxeddy@infosec.exchange at 2025-07-02T14:44:17.000Z ##

Other options:
Exfiltrator
Malicious Payload
CVE-2010-2772

##

CVE-2025-24813
(9.8 CRITICAL)

EPSS: 93.98%

updated 2025-04-03T13:23:54

2 posts

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able t

Nuclei template

37 repos

https://github.com/iSee857/CVE-2025-24813-PoC

https://github.com/charis3306/CVE-2025-24813

https://github.com/gregk4sec/CVE-2025-24813

https://github.com/Mattb709/CVE-2025-24813-Scanner

https://github.com/beyond-devsecops/CVE-2025-24813

https://github.com/hakankarabacak/CVE-2025-24813

https://github.com/michael-david-fry/Apache-Tomcat-Vulnerability-POC-CVE-2025-24813

https://github.com/Erosion2020/CVE-2025-24813-vulhub

https://github.com/x1ongsec/CVE-2025-24813

https://github.com/maliqto/PoC-CVE-2025-24813

https://github.com/absholi7ly/POC-CVE-2025-24813

https://github.com/u238/Tomcat-CVE_2025_24813

https://github.com/AlperenY-cs/CVE-2025-24813

https://github.com/n0n-zer0/Spring-Boot-Tomcat-CVE-2025-24813

https://github.com/manjula-aw/CVE-2025-24813

https://github.com/GadaLuBau1337/CVE-2025-24813

https://github.com/Heimd411/CVE-2025-24813-noPoC

https://github.com/f8l124/CVE-2025-24813-POC

https://github.com/La3B0z/CVE-2025-24813-POC

https://github.com/msadeghkarimi/CVE-2025-24813-Exploit

https://github.com/mbanyamer/Apache-Tomcat---Remote-Code-Execution-via-Session-Deserialization-CVE-2025-24813-

https://github.com/yaleman/cve-2025-24813-poc

https://github.com/Mattb709/CVE-2025-24813-PoC-Apache-Tomcat-RCE

https://github.com/tonyarris/CVE-2025-24813-PoC

https://github.com/Alaatk/CVE-2025-24813-POC

https://github.com/B1gN0Se/Tomcat-CVE-2025-24813

https://github.com/imbas007/CVE-2025-24813-apache-tomcat

https://github.com/issamjr/CVE-2025-24813-Scanner

https://github.com/horsehacks/CVE-2025-24813-checker

https://github.com/N0c1or/CVE-2025-24813_POC

https://github.com/Eduardo-hardvester/CVE-2025-24813

https://github.com/AsaL1n/CVE-2025-24813

https://github.com/ps-interactive/lab-cve-2025-24813

https://github.com/fatkz/CVE-2025-24813

https://github.com/Franconyu/Poc_for_CVE-2025-24813

https://github.com/FY036/cve-2025-24813_poc

https://github.com/MuhammadWaseem29/CVE-2025-24813

cR0w@infosec.exchange at 2025-07-03T12:48:29.000Z ##

Unit42 has a good write-up on some ITW Tomcat and Camel shenanigans exploiting CVE-2025-24813, CVE-2025-27636, and CVE-2025-29891. IOCs in the post.

But does anyone know if this is a typo by the article or if there are actual files with the .sesson extension? Seems like a good indicator to search on if it's not a typo.

As noted in our earlier analysis, exploits for CVE-2025-24813 use a name appended by .sesson in the initial HTTP request. This .session file contains the code the vulnerable host will run if an exploit is successful.

Edit: Confirmed typo per this response: infosec.exchange/@0xThiebaut/1

unit42.paloaltonetworks.com/ap

#threatIntel

##

LCSC_IE@infosec.exchange at 2025-07-03T11:49:00.000Z ##

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟑 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Microsoft to Lay Off 9,000 Employees, Affecting 4% of Workforce

reuters.com/business/world-at-

2. Hunters International Ransomware Shuts Down, Offers Free Decryptors to Victims

cyberinsider.com/hunters-inter

3. UK charity bank branded a 'disaster' after platform migration goes wrong

theregister.com/2025/07/03/uk_

4. Police warn of SMS scams following prison sentence for criminal who conducted smishing campaign

ukfinance.org.uk/news-and-insi

5. Large Language Models (LLMs) Are Falling for Phishing Scams: What Happens When AI Gives You the Wrong URL?

netcraft.com/blog/large-langua

6. Russia’s Cyber Warriors Assail NATO-Linked Private Companies

cepa.org/article/russias-cyber

7. US probes negotiator suspected of taking crypto ransomware money

cointelegraph.com/news/digital

8. Cyberattacks Disrupt Iran’s Bread Distribution, Payments Remain Frozen

iranwire.com/en/news/142915-cy

9. Spain arrests hackers who targeted politicians and journalists

policia.es/_es/comunicacion_pr

10. A third of organisations take more than 90 days to remediate threats

itsecurityguru.org/2025/07/02/

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Irish Eyecare software firm Ocuco investigating cyber-attack

thecurrency.news/articles/1946

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack

unit42.paloaltonetworks.com/ap

2. Snake Keyloggers Exploit Java Tools to Bypass Security – Active IOCs

rewterz.com/threat-advisory/sn

3. Who are DragonForce Ransomware Group?

bridewell.com/insights/blogs/d

4. Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign Using Thousands of Websites to Spoof Popular Retail Brands

silentpush.com/blog/fake-marke

5. Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

wiz.io/blog/exposed-jdwp-explo

6. Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

arcticwolf.com/resources/blog/

7. North Korean APT Kimsuky aka Black Banshee – Active IOCs

rewterz.com/threat-advisory/no

8. DarkTortilla Malware – Active IOCs

rewterz.com/threat-advisory/da

---

𝐀𝐏𝐓 𝐈𝐎𝐂𝐬:

1. Lazarus: Source VT
yourdomainhost[.]store
api[.]yourdomainhost[.]store

2. Kimsuky: Source Validin
Accounts-mysticete[.]servepics[.]com
freedrive[.]servehttp[.]com
login-accounts[.]servehttp[.]com
myaccounts-profile[.]servehttp[.]com
mydocs[.]onthewifi[.]com
securedrive-mofa[.]servehttp[.]com
translate[.]onthewifi[.]com
undocs[.]ddns[.]net
undocs[.]myvnc[.]com
undocs[.]servehttp[.]com

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. Automating macOS Incident Response: DFIR-as-Code in Action Against AppleProcessHub

abstract.security/blog/automat

2. Using Staging Folders For Threat Hunting

knowyouradversary.ru/2025/07/1

3. PDFs: Portable documents, or perfect deliveries for phish?

blog.talosintelligence.com/pdf

4. EscapeRoute: Breaking the Scope of Anthropic’s Filesystem MCP Server
(CVE-2025-53109 & CVE-2025-53110)

cymulate.com/blog/cve-2025-531

5. Yet another ZIP trick

hackarcana.com/article/yet-ano

6. Malware development trick 48: leveraging Office macros for malware. Simple VBA example.

cocomelonc.github.io/malware/2

7. Hijacked by a Text: Understanding and Preventing SIM Swapping Attack

bitsight.com/blog/what-is-sim-

8. CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries

crowdstrike.com/en-us/blog/cro

9. DanaBot Lab Analysis

omer-secure.medium.com/danabot

10. ClickFix Campaign: How Clipboard Injection Leads to RAT Infection (Part 1)

h3xstone.medium.com/clickfix-c

11. Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules

any.run/cybersecurity-blog/rel

12. Inside Android Malware Development: Building a C2 Exfiltrator from the UI to the Network

medium.com/@lord_murak/inside-

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. Pro-Russian hacktivism: Shifting alliances, new groups and risks

intel471.com/blog/pro-russian-

2. Insider Risk Lessons from the DPRK IT Worker Crackdown

dtexsystems.com/blog/insider-r

3. Calling Out Russia: France’s Shift on Public Attribution

warontherocks.com/2025/07/call

4. Outsourced Trust: How Coinbase's $400M Problem Started in an Indian Call Center

reco.ai/blog/coinbase-breach

---

##

CVE-2025-29891
(4.2 MEDIUM)

EPSS: 0.09%

updated 2025-03-19T15:44:53

2 posts

Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.9.0 before 4.10.2, from 4.0.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific

cR0w@infosec.exchange at 2025-07-03T12:48:29.000Z ##

Unit42 has a good write-up on some ITW Tomcat and Camel shenanigans exploiting CVE-2025-24813, CVE-2025-27636, and CVE-2025-29891. IOCs in the post.

But does anyone know if this is a typo by the article or if there are actual files with the .sesson extension? Seems like a good indicator to search on if it's not a typo.

As noted in our earlier analysis, exploits for CVE-2025-24813 use a name appended by .sesson in the initial HTTP request. This .session file contains the code the vulnerable host will run if an exploit is successful.

Edit: Confirmed typo per this response: infosec.exchange/@0xThiebaut/1

unit42.paloaltonetworks.com/ap

#threatIntel

##

LCSC_IE@infosec.exchange at 2025-07-03T11:49:00.000Z ##

🟥𝐋𝐂𝐒𝐂-𝐈𝐄 𝐃𝐚𝐢𝐥𝐲 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐅𝐢𝐧𝐝𝐢𝐧𝐠𝐬-𝟑 𝐉𝐮𝐥𝐲 𝟐𝟎𝟐𝟓🟥

𝐍𝐞𝐰𝐬:

1. Microsoft to Lay Off 9,000 Employees, Affecting 4% of Workforce

reuters.com/business/world-at-

2. Hunters International Ransomware Shuts Down, Offers Free Decryptors to Victims

cyberinsider.com/hunters-inter

3. UK charity bank branded a 'disaster' after platform migration goes wrong

theregister.com/2025/07/03/uk_

4. Police warn of SMS scams following prison sentence for criminal who conducted smishing campaign

ukfinance.org.uk/news-and-insi

5. Large Language Models (LLMs) Are Falling for Phishing Scams: What Happens When AI Gives You the Wrong URL?

netcraft.com/blog/large-langua

6. Russia’s Cyber Warriors Assail NATO-Linked Private Companies

cepa.org/article/russias-cyber

7. US probes negotiator suspected of taking crypto ransomware money

cointelegraph.com/news/digital

8. Cyberattacks Disrupt Iran’s Bread Distribution, Payments Remain Frozen

iranwire.com/en/news/142915-cy

9. Spain arrests hackers who targeted politicians and journalists

policia.es/_es/comunicacion_pr

10. A third of organisations take more than 90 days to remediate threats

itsecurityguru.org/2025/07/02/

---

𝐆𝐥𝐨𝐛𝐚𝐥 𝐁𝐫𝐞𝐚𝐜𝐡 𝐍𝐞𝐰𝐬 𝐚𝐧𝐝 𝐃𝐚𝐭𝐚 𝐋𝐞𝐚𝐤𝐬:

1. Irish Eyecare software firm Ocuco investigating cyber-attack

thecurrency.news/articles/1946

---

𝐓𝐚𝐜𝐭𝐢𝐜𝐚𝐥 𝐑𝐞𝐩𝐨𝐫𝐭𝐬 𝐰𝐢𝐭𝐡 𝐈𝐎𝐂𝐬:

1. Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack

unit42.paloaltonetworks.com/ap

2. Snake Keyloggers Exploit Java Tools to Bypass Security – Active IOCs

rewterz.com/threat-advisory/sn

3. Who are DragonForce Ransomware Group?

bridewell.com/insights/blogs/d

4. Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign Using Thousands of Websites to Spoof Popular Retail Brands

silentpush.com/blog/fake-marke

5. Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

wiz.io/blog/exposed-jdwp-explo

6. Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools

arcticwolf.com/resources/blog/

7. North Korean APT Kimsuky aka Black Banshee – Active IOCs

rewterz.com/threat-advisory/no

8. DarkTortilla Malware – Active IOCs

rewterz.com/threat-advisory/da

---

𝐀𝐏𝐓 𝐈𝐎𝐂𝐬:

1. Lazarus: Source VT
yourdomainhost[.]store
api[.]yourdomainhost[.]store

2. Kimsuky: Source Validin
Accounts-mysticete[.]servepics[.]com
freedrive[.]servehttp[.]com
login-accounts[.]servehttp[.]com
myaccounts-profile[.]servehttp[.]com
mydocs[.]onthewifi[.]com
securedrive-mofa[.]servehttp[.]com
translate[.]onthewifi[.]com
undocs[.]ddns[.]net
undocs[.]myvnc[.]com
undocs[.]servehttp[.]com

---

𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 / 𝐃𝐅𝐈𝐑 / 𝐌𝐚𝐥𝐰𝐚𝐫𝐞:

1. Automating macOS Incident Response: DFIR-as-Code in Action Against AppleProcessHub

abstract.security/blog/automat

2. Using Staging Folders For Threat Hunting

knowyouradversary.ru/2025/07/1

3. PDFs: Portable documents, or perfect deliveries for phish?

blog.talosintelligence.com/pdf

4. EscapeRoute: Breaking the Scope of Anthropic’s Filesystem MCP Server
(CVE-2025-53109 & CVE-2025-53110)

cymulate.com/blog/cve-2025-531

5. Yet another ZIP trick

hackarcana.com/article/yet-ano

6. Malware development trick 48: leveraging Office macros for malware. Simple VBA example.

cocomelonc.github.io/malware/2

7. Hijacked by a Text: Understanding and Preventing SIM Swapping Attack

bitsight.com/blog/what-is-sim-

8. CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries

crowdstrike.com/en-us/blog/cro

9. DanaBot Lab Analysis

omer-secure.medium.com/danabot

10. ClickFix Campaign: How Clipboard Injection Leads to RAT Infection (Part 1)

h3xstone.medium.com/clickfix-c

11. Release Notes: Detonation Actions, Enhanced QR Extraction, and 1,400+ New Detection Rules

any.run/cybersecurity-blog/rel

12. Inside Android Malware Development: Building a C2 Exfiltrator from the UI to the Network

medium.com/@lord_murak/inside-

---

𝐋𝐢𝐠𝐡𝐭 𝐑𝐞𝐚𝐝𝐢𝐧𝐠:

1. Pro-Russian hacktivism: Shifting alliances, new groups and risks

intel471.com/blog/pro-russian-

2. Insider Risk Lessons from the DPRK IT Worker Crackdown

dtexsystems.com/blog/insider-r

3. Calling Out Russia: France’s Shift on Public Attribution

warontherocks.com/2025/07/call

4. Outsourced Trust: How Coinbase's $400M Problem Started in an Indian Call Center

reco.ai/blog/coinbase-breach

---

##

CVE-2025-1094
(8.1 HIGH)

EPSS: 83.63%

updated 2025-02-21T18:31:09

1 posts

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, i

5 repos

https://github.com/shacojx/CVE-2025-1094-Exploit

https://github.com/aninfosec/CVE-2025-1094

https://github.com/ishwardeepp/CVE-2025-1094-PoC-Postgre-SQLi

https://github.com/soltanali0/CVE-2025-1094-Exploit

https://github.com/B1ack4sh/Blackash-CVE-2025-1094

kpwn@infosec.exchange at 2025-07-03T13:10:01.000Z ##

Rank 1: CVE-2025-1094 "CitrixBleed 2"
Product: NetScaler ADC
CVSS: Critical (9.3)

A vulnerability in the input validation of NetScaler Application Delivery Controller (ADC) allows an unauthenticated remote attacker to read memory when configured as a Gateway or AAA virtual server. The memory may include sensitive information like session tokens.

Post by @GossiTheDog:
cyberplace.social/@GossiTheDog

##

CVE-2024-55591
(9.8 CRITICAL)

EPSS: 94.25%

updated 2025-01-14T15:31:02

1 posts

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Nuclei template

10 repos

https://github.com/UMChacker/CVE-2024-55591-POC

https://github.com/sysirq/fortios-auth-bypass-exploit-CVE-2024-55591

https://github.com/watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591

https://github.com/sysirq/fortios-auth-bypass-poc-CVE-2024-55591

https://github.com/virus-or-not/CVE-2024-55591

https://github.com/0x7556/CVE-2024-55591

https://github.com/binarywarm/exp-cmd-add-admin-vpn-CVE-2024-55591

https://github.com/rawtips/CVE-2024-55591

https://github.com/exfil0/CVE-2024-55591-POC

https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591

DarkWebInformer@infosec.exchange at 2025-07-04T18:08:13.000Z ##

🚨Alleged Sale of Mass Exploit for FortiGate targeting CVE-2024-55591

##

CVE-2019-11932
(8.8 HIGH)

EPSS: 80.16%

updated 2025-01-13T15:21:41

1 posts

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.

21 repos

https://github.com/tucommenceapousser/CVE-2019-11932deta

https://github.com/tucommenceapousser/CVE-2019-11932

https://github.com/SmoZy92/CVE-2019-11932

https://github.com/BadAssAiras/hello

https://github.com/Tabni/https-github.com-awakened1712-CVE-2019-11932

https://github.com/Err0r-ICA/WhatsPayloadRCE

https://github.com/infiniteLoopers/CVE-2019-11932

https://github.com/JasonJerry/WhatsRCE

https://github.com/awakened1712/CVE-2019-11932

https://github.com/primebeast/CVE-2019-11932

https://github.com/valbrux/CVE-2019-11932-SupportApp

https://github.com/fastmo/CVE-2019-11932

https://github.com/k3vinlusec/WhatsApp-Double-Free-Vulnerability_CVE-2019-11932

https://github.com/mRanonyMousTZ/CVE-2019-11932-whatsApp-exploit

https://github.com/dashtic172/https-github.com-awakened171

https://github.com/zxn1/CVE-2019-11932

https://github.com/0759104103/cd-CVE-2019-11932

https://github.com/kal1gh0st/WhatsAppHACK-RCE

https://github.com/TulungagungCyberLink/CVE-2019-11932

https://github.com/dorkerdevil/CVE-2019-11932

https://github.com/starling021/CVE-2019-11932-SupportApp

CVE-2024-56337(CVSS UNKNOWN)

EPSS: 9.71%

updated 2025-01-08T16:05:13

2 posts

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to t

1 repos

https://github.com/SleepingBag945/CVE-2024-50379

cR0w@infosec.exchange at 2025-07-01T18:34:58.000Z ##

@Sempf Are you specifically asking about EITW when the mitigation for CVE-2024-50379 was applied or regardless of the CVE-2024-50379 mitigation since CVE-2024-56337 was basically a bypass for the incomplete CVE-2024-50379 fix, right?

##

Sempf@infosec.exchange at 2025-07-01T18:25:28.000Z ##

Hey vulnerability people: Any scuttlebutt on active exploitation of CVE-2024-56337? It isn't in the KEV but ... well ....

##

cR0w@infosec.exchange at 2025-07-01T18:34:58.000Z ##

@Sempf Are you specifically asking about EITW when the mitigation for CVE-2024-50379 was applied or regardless of the CVE-2024-50379 mitigation since CVE-2024-56337 was basically a bypass for the incomplete CVE-2024-50379 fix, right?

##

CVE-2024-12856
(7.2 HIGH)

EPSS: 77.16%

updated 2024-12-27T18:15:23.677000

1 posts

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnera

1 repos

https://github.com/nu113d/CVE-2024-12856

cR0w@infosec.exchange at 2025-07-03T14:53:59.000Z ##

Oh, goodie. Another botnet. This one is exploiting CVE-2024-3721 and CVE-2024-12856 in DVRs and routers to launch DDoS attacks.

fortinet.com/blog/threat-resea

IOCs

Hosts

45[.]135[.]194[.]34
83[.]150[.]218[.]93
14[.]103[.]145[.]202
14[.]103[.]145[.]211
154[.]91[.]254[.]95
78[.]153[.]149[.]90

Files

Downloader

c88f60dbae08519f2f81bb8efa7e6016c6770e66e58d77ab6384069a515e451c
eb3e2a6a50f029fc646e2c3483157ab112f4f017406c3aabedaae0c94e0969f6
f4cd7ab04b1744babef19d147124bfc0e9e90d557408cc2d652d7192df61bda9

RondoDox

e3c080e322862d065649c468d20f620c3670d841c30c3fe5385e37f4f10172e7
e62df17150fcb7fea32ff459ef47cdd452a21269efe9252bde70377fd2717c10
53e2c2d83813d1284ddb8c68b1572b17cca95cfc36a55a7517bf45ff40828be5
43d4847bf237c445ed2e846a106e1f55abefef5c3a8545bd5e4cad20f5deb9a4
4c2429fc8b8ec61da41cbba1b8184ec45fa93a9841b4ca48094bba7741b826b8
694d729d67f1b0c06702490bfab1df3a96fe040fe5d07efa5c92356c329757be
edae3b75deb8013bd48ac4534cca345b90938a2abb91672467c2bf9ae81ff683
0814a0781ab30fca069a085dba201d6fd0f414498fafa4bb42859786d91d4781
59b4deee977e9e27b60e7e179d54a1ce8e56624e73b799523416eee828bfaf76
9f916a552efc6775367a31357a633dc0be01879830d3fddccdf3c40b26e50afd
0a9ebbecc8ec58c253039520304ca373cfb8d1674d67993e6485e244a77d6ec9
6c81fd73b4bef6fef379cbefdcce7f374ea7e6bf1bf0917cf4ca7b72d4cee788
a55a3859a203ca2bae7399295f92aeae61d845ffa173c1938f938f5c148eef99
57573779f9a62eecb80737d41d42165af8bb9884579c50736766abb63d2835ba
3daa53204978b7797bd53f5c964eed7a73d971517a764785ce3ab65a9423c2e7
8bf8928bc255e73e0b5b0ce13747c64d82d5f2647da129f189138773733ac21f
20a24b179bdbbdcc0053838c0484ea25eff6976f2b8cb5630ab4efb28b0f06b5
42aa715573c7d2fca01914504cb7336db715d73d1e20d23e4bd37f2e4f4fe389
c9278ce988343606350a94156ca28ee28bd605d1d95c810a16866eee1f997598
a197f60d5f5641f2c56576b4c867d141612c6e00db29c512f266835510b8a62d
8250d289c5ec87752cec1af31eed0347cf2dd54dc0fbeea645319c4dae238ee2
d02414a54e97ad26748812002610f1491a2a746e9ba0f9d05de3d47d7bab4f5e
c123a91fdacd9a4c0bcf800d6b7db5162cfd11cb71e260647ef0f2c60978ebfc
ef708fec1afbea4fb32b586e0dacf0d228c375a532008d81453c367256afea5a
305507f34c14c72cab35715b7f7b25b32352a8e19b8a283003aaf539d12ca517
937e6ab0dfcedfa23eced7b52d3899b0847df3fcb7a9c326b71027a7ab5f5b93

cc: @Dio9sys @da_667 since this seems like the kind of thing you might want to sig / tag.

##

CVE-2024-39931
(10.0 CRITICAL)

EPSS: 1.37%

updated 2024-12-23T20:38:21

1 posts

### Impact Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance. ### Patches Deletion of `.git` files has been prohibited (https://github.com/gogs/gogs/pull/7870). Users should upgrade to 0.13.1 or the late

cR0w@infosec.exchange at 2025-06-30T20:03:10.000Z ##

Woohoo! Another perfect 10 from last week. And this could hit hard. 🥳

github.com/gogs/gogs/security/

sev:CRIT 10.0 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2024-6874
(4.3 MEDIUM)

EPSS: 0.24%

updated 2024-11-21T09:50:26.493000

2 posts

libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This

CVE-2024-3721
(6.3 MEDIUM)

EPSS: 57.40%

updated 2024-04-13T12:30:30

1 posts

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573

cR0w@infosec.exchange at 2025-07-03T14:53:59.000Z ##

Oh, goodie. Another botnet. This one is exploiting CVE-2024-3721 and CVE-2024-12856 in DVRs and routers to launch DDoS attacks.

fortinet.com/blog/threat-resea

IOCs

Hosts

45[.]135[.]194[.]34
83[.]150[.]218[.]93
14[.]103[.]145[.]202
14[.]103[.]145[.]211
154[.]91[.]254[.]95
78[.]153[.]149[.]90

Files

Downloader

c88f60dbae08519f2f81bb8efa7e6016c6770e66e58d77ab6384069a515e451c
eb3e2a6a50f029fc646e2c3483157ab112f4f017406c3aabedaae0c94e0969f6
f4cd7ab04b1744babef19d147124bfc0e9e90d557408cc2d652d7192df61bda9

RondoDox

e3c080e322862d065649c468d20f620c3670d841c30c3fe5385e37f4f10172e7
e62df17150fcb7fea32ff459ef47cdd452a21269efe9252bde70377fd2717c10
53e2c2d83813d1284ddb8c68b1572b17cca95cfc36a55a7517bf45ff40828be5
43d4847bf237c445ed2e846a106e1f55abefef5c3a8545bd5e4cad20f5deb9a4
4c2429fc8b8ec61da41cbba1b8184ec45fa93a9841b4ca48094bba7741b826b8
694d729d67f1b0c06702490bfab1df3a96fe040fe5d07efa5c92356c329757be
edae3b75deb8013bd48ac4534cca345b90938a2abb91672467c2bf9ae81ff683
0814a0781ab30fca069a085dba201d6fd0f414498fafa4bb42859786d91d4781
59b4deee977e9e27b60e7e179d54a1ce8e56624e73b799523416eee828bfaf76
9f916a552efc6775367a31357a633dc0be01879830d3fddccdf3c40b26e50afd
0a9ebbecc8ec58c253039520304ca373cfb8d1674d67993e6485e244a77d6ec9
6c81fd73b4bef6fef379cbefdcce7f374ea7e6bf1bf0917cf4ca7b72d4cee788
a55a3859a203ca2bae7399295f92aeae61d845ffa173c1938f938f5c148eef99
57573779f9a62eecb80737d41d42165af8bb9884579c50736766abb63d2835ba
3daa53204978b7797bd53f5c964eed7a73d971517a764785ce3ab65a9423c2e7
8bf8928bc255e73e0b5b0ce13747c64d82d5f2647da129f189138773733ac21f
20a24b179bdbbdcc0053838c0484ea25eff6976f2b8cb5630ab4efb28b0f06b5
42aa715573c7d2fca01914504cb7336db715d73d1e20d23e4bd37f2e4f4fe389
c9278ce988343606350a94156ca28ee28bd605d1d95c810a16866eee1f997598
a197f60d5f5641f2c56576b4c867d141612c6e00db29c512f266835510b8a62d
8250d289c5ec87752cec1af31eed0347cf2dd54dc0fbeea645319c4dae238ee2
d02414a54e97ad26748812002610f1491a2a746e9ba0f9d05de3d47d7bab4f5e
c123a91fdacd9a4c0bcf800d6b7db5162cfd11cb71e260647ef0f2c60978ebfc
ef708fec1afbea4fb32b586e0dacf0d228c375a532008d81453c367256afea5a
305507f34c14c72cab35715b7f7b25b32352a8e19b8a283003aaf539d12ca517
937e6ab0dfcedfa23eced7b52d3899b0847df3fcb7a9c326b71027a7ab5f5b93

cc: @Dio9sys @da_667 since this seems like the kind of thing you might want to sig / tag.

##

CVE-2023-36934
(9.1 CRITICAL)

EPSS: 93.06%

updated 2024-04-04T05:23:52

1 posts

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MO

Nuclei template

LMGsecurity@infosec.exchange at 2025-06-30T13:51:47.000Z ##

New mass scanning activity may be the first step in another MOVEit attack.

Hackers are actively scanning the internet for exposed MOVEit systems—hundreds of unique IPs every day—suggesting the early stages of coordinated exploitation.

Threat intel firm GreyNoise warns this is the same pattern seen weeks before past mass attacks. Known MOVEit vulnerabilities, such as CVE-2023-34362 and CVE-2023-36934, are already being tested in the wild.

If your MOVEit Transfer instance is online and unmonitored, you may already be on an attacker’s target list.

Now’s the time to:
• Patch all known MOVEit vulnerabilities
• Limit public-facing access
• Monitor for scan activity and open ports
• Block IPs identified by threat intelligence feeds
• Harden file transfer environments and deploy honeypots if needed

Scanning isn’t random—it’s reconnaissance. Act now before scanning turns into breach.

Read the article for details: cuinfosecurity.com/scans-probi

#MOVEit #Cybersecurity #MassScanning #ThreatIntel #AttackSurface #LMGSecurity #Infosec #ITsecurity #databreach #CISO #DFIR #pentesting #pentest #penetrationtesting

##

CVE-2023-34362
(9.8 CRITICAL)

EPSS: 94.48%

updated 2024-04-04T04:29:06

2 posts

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an

Nuclei template

11 repos

https://github.com/Chinyemba-ck/MOVEit-CVE-2023-34362

https://github.com/deepinstinct/MOVEit_CVE-2023-34362_IOCs

https://github.com/aditibv/MOVEit-CVE-2023-34362

https://github.com/toorandom/moveit-payload-decrypt-CVE-2023-34362

https://github.com/errorfiathck/MOVEit-Exploit

https://github.com/horizon3ai/CVE-2023-34362

https://github.com/kenbuckler/MOVEit-CVE-2023-34362

https://github.com/Malwareman007/CVE-2023-34362

https://github.com/sfewer-r7/CVE-2023-34362

https://github.com/glen-pearson/MoveIT-CVE-2023-34362-RCE

https://github.com/lithuanian-g/cve-2023-34362-iocs

cR0w@infosec.exchange at 2025-07-01T17:58:48.000Z ##

Okay, I spent some time going through some of my MOVEit logs and I think I see at least part of what's going on with the increase in MOVEit scans noted by @greynoise.

One thing I have noticed is a group of GCP hosts performing high volume scans against the MOVEit servers every seven days, but not against adjacent servers or other servers for the same orgs. This kind of makes it look targeted but the scans are generic kitchen sink vuln scans.

I did notice that some of these and other scanners I've seen over the past few months now have a couple requests that appear to be testing for CVE-2023-34362 mixed in to their other requests. It's like they loaded their automated scanners with updated payload lists.

There are a lot of Cloudflare and AWS IPs in the logs, as indicated by GreyNoise in their blog post. There are not a lot of unique Google IPs but I'm seeing a ton of noise from the ones I do see. But only every seven days. The servers I have logs for all block Tencent so I can't confirm the activity from their infrastructure.

I have also put my juicy eyes on every single GET and POST sent to these MOVEit Transfer servers for the past 60 days and I do not see any payloads that appear to be new or novel. That's not to say there isn't anything new going on, but I'm now comfortable with treating MOVEit servers with the same concern as before the GreyNoise blog post as I don't see any indication of impending action. There may be some WAF or rate limit or geolocation filter testing going on that's disguised as generic scans, but I have no evidence to suggest that's the case.

Caveat: I have relatively low visibility into what's going on at scale like GreyNoise does so take this with a grain of salt and if it's of interest, go confirm it yourself. This is intended to be informational, not actionable.

#threatIntel #MOVEit

##

LMGsecurity@infosec.exchange at 2025-06-30T13:51:47.000Z ##

New mass scanning activity may be the first step in another MOVEit attack.

Hackers are actively scanning the internet for exposed MOVEit systems—hundreds of unique IPs every day—suggesting the early stages of coordinated exploitation.

Threat intel firm GreyNoise warns this is the same pattern seen weeks before past mass attacks. Known MOVEit vulnerabilities, such as CVE-2023-34362 and CVE-2023-36934, are already being tested in the wild.

If your MOVEit Transfer instance is online and unmonitored, you may already be on an attacker’s target list.

Now’s the time to:
• Patch all known MOVEit vulnerabilities
• Limit public-facing access
• Monitor for scan activity and open ports
• Block IPs identified by threat intelligence feeds
• Harden file transfer environments and deploy honeypots if needed

Scanning isn’t random—it’s reconnaissance. Act now before scanning turns into breach.

Read the article for details: cuinfosecurity.com/scans-probi

#MOVEit #Cybersecurity #MassScanning #ThreatIntel #AttackSurface #LMGSecurity #Infosec #ITsecurity #databreach #CISO #DFIR #pentesting #pentest #penetrationtesting

##

CVE-2022-38392
(5.3 MEDIUM)

EPSS: 0.08%

updated 2023-09-18T05:03:19

1 posts

A certain 5400 RPM OEM hard drive, as shipped with laptop PCs in approximately 2005, allows physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video.

paco@infosec.exchange at 2025-07-03T15:15:10.000Z ##

Somehow I missed this CVE when it came out in 2022.

I think it's called a Jackson-in-the-Middle attack.

Certain 5400 RPM hard drives, ... allow physically proximate attackers to cause a ... device malfunction ... via a resonant-frequency attack with the audio signal from the Rhythm Nation music video.

I like that CVE links to a YouTube video where someone tried to reproduce it.

#CVE #NVD #JanetJackson

##

CVE-2025-48952
(0 None)

EPSS: 0.06%

3 posts

N/A

offseq at 2025-07-05T00:00:59.441Z ##

🔒 NetAlertX <25.6.7 faces a CRITICAL auth bypass (CVE-2025-48952). PHP's loose comparison allows attackers to skip password checks via 'magic hashes.' Patch to 25.6.7+ ASAP! radar.offseq.com/threat/cve-20

##

cR0w at 2025-07-04T23:15:31.214Z ##

LOL. Whoopsie.

github.com/jokob-sk/NetAlertX/

sev:CRIT 9.4 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the == operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of == instead of the strict ===, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability.

nvd.nist.gov/vuln/detail/CVE-2

##

cR0w@infosec.exchange at 2025-07-04T23:15:31.000Z ##

LOL. Whoopsie.

github.com/jokob-sk/NetAlertX/

sev:CRIT 9.4 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the == operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of == instead of the strict ===, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-1735
(0 None)

EPSS: 0.00%

1 posts

N/A

PostgreSQL@activitypub.awakari.com at 2025-07-04T08:50:27.000Z ## Critical PHP Vulnerabilities Expose Systems to SQL Injection & DoS Attacks – Update Immediately A newly disclosed security vulnerability (CVE-2025-1735) in the PHP pgsql extension has raised ...

#Cyber #Security #News #Cybersecurity #Dos #Attack #SQL #Cyber #Security #Cyber #security

Origin | Interest | Match ##

beyondmachines1@infosec.exchange at 2025-07-04T08:01:18.000Z ##

Critical vulnerability in Wing FTP Server enables remote code execution, server takeover

A maximum-severity vulnerability (CVE-2025-47812) in Wing FTP Server allows unauthenticated attackers to achieve complete system compromise through NULL byte injection in the username parameter at the /loginok.html endpoint, enabling arbitrary Lua code execution with root or SYSTEM privileges.

**If you're running Wing FTP Server (any version up to 7.4.3), time to make an URGENT patch, because hackers can easily hijack the entire server. Immediately update to version 7.4.4 or isolate the server from the internet, then plan a quick patch. Patching for this issue is not optional!**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

DarkWebInformer@infosec.exchange at 2025-07-01T21:51:59.000Z ##

🚨CVE-2025-47812: Wing FTP Server Remote Code Execution (RCE) Exploit

Link: github.com/4m3rr0r/CVE-2025-47

Writeup: rcesecurity.com/2025/06/what-t

##

campuscodi@mastodon.social at 2025-07-01T17:04:21.000Z ##

RCE Security has found major vulnerabilities in the Wind FTP server.

Attackers can bypass authentication on the server's web interface just by appending a NULL byte to the username followed by any random string.

rcesecurity.com/2025/06/what-t

##

_r_netsec@infosec.exchange at 2025-06-30T19:58:06.000Z ##

What the NULL?! Wing FTP Server RCE (CVE-2025-47812) rcesecurity.com/2025/06/what-t

##

CVE-2025-53367
(0 None)

EPSS: 0.01%

2 posts

N/A

cR0w@infosec.exchange at 2025-07-03T21:46:57.000Z ##

github.blog/security/vulnerabi

sev:HIGH 8.4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.

cve.org/CVERecord?id=CVE-2025-

##

Ubuntu@activitypub.awakari.com at 2025-07-03T20:52:20.000Z ## CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre DjVuLibre has a vulnerability that could enable an attacker to gain code execution on a Linux Desktop system when the user tries to o...

#Security #Vulnerability #research #CVE #GitHub #Security #Lab #linux #open #source

Origin | Interest | Match ##

CVE-2025-52891
(0 None)

EPSS: 0.05%

1 posts

N/A

cR0w@infosec.exchange at 2025-07-02T15:30:06.000Z ##

Whoopsie. DoS in ModSecurity.

github.com/owasp-modsecurity/M

sev:MED 6.5 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg ), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-0038
(0 None)

EPSS: 0.00%

1 posts

N/A

AAKL@infosec.exchange at 2025-07-02T15:22:27.000Z ##

AMD advisory, from yesterday. Medium severity:

CVE-2025-0038:  Zynq™ UltraScale+™ SoC Overwriting Protected Memory Regions Through PMU Firmware amd.com/en/resources/product-s #AMD #cybersecurity #infosec

##

CVE-2025-49588
(0 None)

EPSS: 0.04%

1 posts

N/A

cR0w@infosec.exchange at 2025-07-02T14:53:02.000Z ##

Hilarious LFI in Linkwarden.

github.com/linkwarden/linkward

sev:HIGH 8.7 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. In version 2.10.2, the server accepts links of format file:///etc/passwd and doesn't do any validation before sending them to parsers and playwright, this can result in leak of other user's links (and in some cases it might be possible to leak environment secrets). This issue has been patched in version 2.10.3 which has not been made public at time of publication.

nvd.nist.gov/vuln/detail/CVE-2

##

_r_netsec@infosec.exchange at 2025-07-02T10:43:06.000Z ##

Remote code execution in CentOS Web Panel - CVE-2025-48703 fenrisk.com/rce-centos-webpanel

##

golang@activitypub.awakari.com at 2025-07-01T07:00:00.000Z ## Notepad++ 8.8.2 available The update fixes a security vulnerability and much more. An update to version 8.8.2 is available for Notepad++ . This is also a security update that fixes CVE-2025-49144 ....

#News

Origin | Interest | Match ##

ChrisShort@hachyderm.io at 2025-06-30T22:24:31.000Z ##

CVE Record: CVE-2025-49144 - Notepad++ Privilege Escalation In Installer Via Uncontrolled Executable Search Path #SuggestedRead #devopsish cve.org/CVERecord?id=CVE-2025-

##

CVE-2025-53104
(0 None)

EPSS: 0.27%

1 posts

N/A

cR0w@infosec.exchange at 2025-07-01T19:10:05.000Z ##

Command injection in the discussion-to-slack workflow in gluestack-ui.

github.com/gluestack/gluestack

sev:CRIT 9.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commit e6b4271, a command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields (title, body, etc.) were directly interpolated into shell commands in a run: block. An attacker could craft a malicious GitHub Discussion title or body (e.g., $(curl ...)) to execute arbitrary shell commands on the Actions runner. This issue has been fixed in commit e6b4271 where the discussion-to-slack.yml workflow was removed. Users should remove the discussion-to-slack.yml workflow if using a fork or derivative of this repository.

nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2025-53094
(0 None)

EPSS: 0.06%

1 posts

N/A

cR0w@infosec.exchange at 2025-06-30T14:03:27.000Z ##

I know a bunch of you nerds like playing with ESP32s, etc.

sev:HIGH 8.7 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP headers within AsyncWebHeader.cpp. Unsanitized input allows attackers to inject CR (\r) or LF (\n) characters into header names or values, leading to arbitrary header or response manipulation. Manipulation of HTTP headers and responses can enable a wide range of attacks, making the severity of this vulnerability high. A fix is available at pull request 211 and is expected to be part of version 3.7.9.

nvd.nist.gov/vuln/detail/CVE-2

##

Visit counter For Websites