Question: How to: CVE-2025-24893 (2025-02-20)

Answer:
```
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
```
- [iSee857/CVE-2025-24893-PoC](https://github.com/iSee857/CVE-2025-24893-PoC)
- [Artemir7/CVE-2025-24893-EXP](https://github.com/Artemir7/CVE-2025-24893-EXP)
- [nopgadget/CVE-2025-24893](https://github.com/nopgadget/CVE-2025-24893)
- [Kai7788/CVE-2025-24893-RCE-PoC](https://github.com/Kai7788/CVE-2025-24893-RCE-PoC)
- [AliElKhatteb/CVE-2024-32019-POC](https://github.com/AliElKhatteb/CVE-2024-32019-POC)
- [dhiaZnaidi/CVE-2025-24893-PoC](https://github.com/dhiaZnaidi/CVE-2025-24893-PoC)
- [hackersonsteroids/cve-2025-24893](https://github.com/hackersonsteroids/cve-2025-24893)
- [Infinit3i/CVE-2025-24893](https://github.com/Infinit3i/CVE-2025-24893)
- [AzureADTrent/CVE-2025-24893-Reverse-Shell](https://github.com/AzureADTrent/CVE-2025-24893-Reverse-Shell)
- [gunzf0x/CVE-2025-24893](https://github.com/gunzf0x/CVE-2025-24893)
- [dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC](https://github.com/dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC)
- [zs1n/CVE-2025-24893](https://github.com/zs1n/CVE-2025-24893)
- [investigato/cve-2025-24893-poc](https://github.com/investigato/cve-2025-24893-poc)
- [570RMBR3AK3R/xwiki-cve-2025-24893-poc](https://github.com/570RMBR3AK3R/xwiki-cve-2025-24893-poc)
- [IIIeJlyXaKapToIIIKu/CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch](https://github.com/IIIeJlyXaKapToIIIKu/CVE-2025-24893-XWiki-unauthenticated-RCE-via-SolrSearch)
- [mah4nzfr/CVE-2025-24893](https://github.com/mah4nzfr/CVE-2025-24893)
- [Th3Gl0w/CVE-2025-24893-POC](https://github.com/Th3Gl0w/CVE-2025-24893-POC)
- [Hex00-0x4/CVE-2025-24893-XWiki-RCE](https://github.com/Hex00-0x4/CVE-2025-24893-XWiki-RCE)
- [The-Red-Serpent/CVE-2025-24893](https://github.com/The-Red-Serpent/CVE-2025-24893)
- [alaxar/CVE-2025-24893](https://github.com/alaxar/CVE-2025-24893)
- [D3Ext/CVE-2025-24893](https://github.com/D3Ext/CVE-2025-24893)
- [Retro023/CVE-2025-24893-POC](https://github.com/Retro023/CVE-2025-24893-POC)
- [CMassa/CVE-2025-24893](https://github.com/CMassa/CVE-2025-24893)
- [x0da6h/POC-for-CVE-2025-24893](https://github.com/x0da6h/POC-for-CVE-2025-24893)
- [ibadovulfat/CVE-2025-24893_HackTheBox-Editor-Writeup](https://github.com/ibadovulfat/CVE-2025-24893_HackTheBox-Editor-Writeup)
- [torjan0/xwiki_solrsearch-rce-exploit](https://github.com/torjan0/xwiki_solrsearch-rce-exploit)
- [b0ySie7e/CVE-2025-24893](https://github.com/b0ySie7e/CVE-2025-24893)
- [andwati/CVE-2025-24893](https://github.com/andwati/CVE-2025-24893)
- [Bishben/xwiki-15.10.8-reverse-shell-cve-2025-24893](https://github.com/Bishben/xwiki-15.10.8-reverse-shell-cve-2025-24893)
- [80Ottanta80/CVE-2025-24893-PoC](https://github.com/80Ottanta80/CVE-2025-24893-PoC)
- [Ashwesker/Ashwesker-CVE-2025-24893](https://github.com/Ashwesker/Ashwesker-CVE-2025-24893)
- [0xDTC/XWiki-Platform-RCE-CVE-2025-24893](https://github.com/0xDTC/XWiki-Platform-RCE-CVE-2025-24893)
- [o0wo0o/CVE-2025-24893_Shell](https://github.com/o0wo0o/CVE-2025-24893_Shell)
- [WhiteDominion/CVE-2025-24893](https://github.com/WhiteDominion/CVE-2025-24893)
- [BreakingRohit/CVE-2025-24893-PoC](https://github.com/BreakingRohit/CVE-2025-24893-PoC)
- [TomKingori/xwiki-cve-2025-24893-exploit](https://github.com/TomKingori/xwiki-cve-2025-24893-exploit)


Question: How to: CVE-2025-24963 (2025-02-04)

Answer:
```
Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by `browser.api.host: true`, an attacker can send a request to that handler from remote to get the content of arbitrary files.This `__screenshot-error` handler on the browser mode HTTP server responds any file on the file system. This code was added by commit `2d62051`. Users explicitly exposing the browser mode server to the network by `browser.api.host: true` may get any files exposed. This issue has been addressed in versions 2.1.9 and 3.0.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
```
- [0xdeviner/CVE-2025-24963](https://github.com/0xdeviner/CVE-2025-24963)


Question: How to: CVE-2025-24985 (2025-03-11)

Answer:
```
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
```
- [airbus-cert/cve-2025-24985](https://github.com/airbus-cert/cve-2025-24985)


Question: How to: CVE-2025-25014 (2025-05-06)

Answer:
```
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
```
- [davidxbors/CVE-2025-25014](https://github.com/davidxbors/CVE-2025-25014)
- [Ashwesker/Ashwesker-CVE-2025-25014](https://github.com/Ashwesker/Ashwesker-CVE-2025-25014)


Question: How to: CVE-2025-25062 (2025-02-03)

Answer:
```
An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module.
```
- [rhburt/CVE-2025-25062](https://github.com/rhburt/CVE-2025-25062)


Question: How to: CVE-2025-25064 (2025-02-03)

Answer:
```
SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.
```
- [yelang123/Zimbra10_SQL_Injection](https://github.com/yelang123/Zimbra10_SQL_Injection)


Question: How to: CVE-2025-25101 (2025-02-07)

Answer:
```
Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites allows Cross Site Request Forgery. This issue affects Munk Sites: from n/a through 1.0.7.
```
- [Nxploited/CVE-2025-25101](https://github.com/Nxploited/CVE-2025-25101)


Question: How to: CVE-2025-25163 (2025-02-07)

Answer:
```
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer allows Path Traversal. This issue affects Plugin A/B Image Optimizer: from n/a through 3.3.
```
- [RandomRobbieBF/CVE-2025-25163](https://github.com/RandomRobbieBF/CVE-2025-25163)
- [RootHarpy/CVE-2025-25163-Nuclei-Template](https://github.com/RootHarpy/CVE-2025-25163-Nuclei-Template)


Question: How to: CVE-2025-25231 (2025-08-11)

Answer:
```
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.
```
- [ashkan-pu/CVE-CVE-2025-25231](https://github.com/ashkan-pu/CVE-CVE-2025-25231)


Question: How to: CVE-2025-25256 (2025-08-12)

Answer:
```
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
```
- [watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256](https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256)


Question: How to: CVE-2025-25257 (2025-07-17)

Answer:
```
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
```
- [watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257](https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257)
- [0xbigshaq/CVE-2025-25257](https://github.com/0xbigshaq/CVE-2025-25257)
- [aitorfirm/CVE-2025-25257](https://github.com/aitorfirm/CVE-2025-25257)
- [adilburaksen/CVE-2025-25257-Exploit-Tool](https://github.com/adilburaksen/CVE-2025-25257-Exploit-Tool)
- [imbas007/CVE-2025-25257](https://github.com/imbas007/CVE-2025-25257)
- [Ashwesker/Ashwesker-CVE-2025-25257](https://github.com/Ashwesker/Ashwesker-CVE-2025-25257)
- [0xgh057r3c0n/CVE-2025-25257](https://github.com/0xgh057r3c0n/CVE-2025-25257)
- [mrmtwoj/CVE-2025-25257](https://github.com/mrmtwoj/CVE-2025-25257)
- [TheStingR/CVE-2025-25257](https://github.com/TheStingR/CVE-2025-25257)
- [segfault-it/CVE-2025-25257](https://github.com/segfault-it/CVE-2025-25257)
- [lytianahkone-boop/cve-2025-25257](https://github.com/lytianahkone-boop/cve-2025-25257)


Question: How to: CVE-2025-25279 (2025-02-24)

Answer:
```
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.
```
- [numanturle/CVE-2025-25279](https://github.com/numanturle/CVE-2025-25279)


Question: How to: CVE-2025-25296 (2025-02-14)

Answer:
```
Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Security Policy (CSP), it is only set in report-only mode, making it ineffective at preventing script execution. The vulnerability exists because the upload-example endpoint renders user-provided HTML content without proper sanitization on a GET request. This allows attackers to inject and execute arbitrary JavaScript in victims' browsers by getting them to visit a maliciously crafted URL. This is considered vulnerable because it enables attackers to execute JavaScript in victims' contexts, potentially allowing theft of sensitive data, session hijacking, or other malicious actions. Version 1.16.0 contains a patch for the issue.
```
- [math-x-io/CVE-2025-25296-POC](https://github.com/math-x-io/CVE-2025-25296-POC)


Question: How to: CVE-2025-25369

Answer: - [lkasjkasj/CVE-2025-25369](https://github.com/lkasjkasj/CVE-2025-25369)


Question: How to: CVE-2025-25460 (2025-02-24)

Answer:
```
A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to improper input sanitization of the "TextArea" field in the blog entry submission form.
```
- [RoNiXxCybSeC0101/CVE-2025-25460](https://github.com/RoNiXxCybSeC0101/CVE-2025-25460)


Question: How to: CVE-2025-25461 (2025-02-28)

Answer:
```
A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document.
```
- [RoNiXxCybSeC0101/CVE-2025-25461](https://github.com/RoNiXxCybSeC0101/CVE-2025-25461)


Question: How to: CVE-2025-25599

Answer: - [Certitude-Consulting/CVE-2025-25599](https://github.com/Certitude-Consulting/CVE-2025-25599)


Question: How to: CVE-2025-25612 (2025-03-17)

Answer:
```
FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser.
```
- [secmuzz/CVE-2025-25612](https://github.com/secmuzz/CVE-2025-25612)


Question: How to: CVE-2025-25614 (2025-03-10)

Answer:
```
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.
```
- [armaansidana2003/CVE-2025-25614](https://github.com/armaansidana2003/CVE-2025-25614)


Question: How to: CVE-2025-25615 (2025-03-10)

Answer:
```
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.
```
- [armaansidana2003/CVE-2025-25615](https://github.com/armaansidana2003/CVE-2025-25615)


Question: How to: CVE-2025-25616 (2025-03-10)

Answer:
```
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.
```
- [armaansidana2003/CVE-2025-25616](https://github.com/armaansidana2003/CVE-2025-25616)


Question: How to: CVE-2025-25617 (2025-03-07)

Answer:
```
Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.
```
- [armaansidana2003/CVE-2025-25617](https://github.com/armaansidana2003/CVE-2025-25617)


Question: How to: CVE-2025-25618 (2025-03-17)

Answer:
```
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers.
```
- [armaansidana2003/CVE-2025-25618](https://github.com/armaansidana2003/CVE-2025-25618)


Question: How to: CVE-2025-25620 (2025-03-10)

Answer:
```
Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
```
- [armaansidana2003/CVE-2025-25620](https://github.com/armaansidana2003/CVE-2025-25620)


Question: How to: CVE-2025-25621 (2025-03-17)

Answer:
```
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected endpoint is /courses/teacher/index?teacher_id=2&semester_id=1.
```
- [armaansidana2003/CVE-2025-25621](https://github.com/armaansidana2003/CVE-2025-25621)


Question: How to: CVE-2025-25650 (2025-03-17)

Answer:
```
An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentication.
```
- [AbhijithAJ/Dorset_SmartLock_Vulnerability](https://github.com/AbhijithAJ/Dorset_SmartLock_Vulnerability)


Question: How to: CVE-2025-25705

Answer: - [Cotherm/CVE-2025-25705](https://github.com/Cotherm/CVE-2025-25705)


Question: How to: CVE-2025-25706

Answer: - [Cotherm/CVE-2025-25706](https://github.com/Cotherm/CVE-2025-25706)


Question: How to: CVE-2025-25747 (2025-03-11)

Answer:
```
Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpoint
```
- [huyvo2910/CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS](https://github.com/huyvo2910/CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS)


Question: How to: CVE-2025-25748 (2025-03-11)

Answer:
```
A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.
```
- [huyvo2910/CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7](https://github.com/huyvo2910/CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7)


Question: How to: CVE-2025-25749 (2025-03-11)

Answer:
```
An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.
```
- [huyvo2910/CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7](https://github.com/huyvo2910/CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7)


Question: How to: CVE-2025-25763 (2025-03-06)

Answer:
```
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
```
- [Oyst3r1ng/CVE-2025-25763](https://github.com/Oyst3r1ng/CVE-2025-25763)


Question: How to: CVE-2025-25964

Answer: - [Sudo-Sakib/CVE-2025-25964](https://github.com/Sudo-Sakib/CVE-2025-25964)


Question: How to: CVE-2025-25965

Answer: - [Sudo-Sakib/CVE-2025-25965](https://github.com/Sudo-Sakib/CVE-2025-25965)


Question: How to: CVE-2025-25967 (2025-03-03)

Answer:
```
Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.
```
- [padayali-JD/CVE-2025-25967](https://github.com/padayali-JD/CVE-2025-25967)


Question: How to: CVE-2025-25968 (2025-02-20)

Answer:
```
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.
```
- [padayali-JD/CVE-2025-25968](https://github.com/padayali-JD/CVE-2025-25968)


Question: How to: CVE-2025-26014 (2025-02-21)

Answer:
```
A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.
```
- [vigilante-1337/CVE-2025-26014](https://github.com/vigilante-1337/CVE-2025-26014)


Question: How to: CVE-2025-26054 (2025-04-01)

Answer:
```
Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration.
```
- [rohan-pt/CVE-2025-26054](https://github.com/rohan-pt/CVE-2025-26054)


Question: How to: CVE-2025-26055 (2025-04-01)

Answer:
```
An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter of the Tracert function.
```
- [rohan-pt/CVE-2025-26055](https://github.com/rohan-pt/CVE-2025-26055)


Question: How to: CVE-2025-26056 (2025-04-01)

Answer:
```
A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. The vulnerability is due to improper validation of user-supplied input in the mtrIp parameter. An attacker can exploit this flaw to execute arbitrary operating system commands on the underlying system with the same privileges as the web application process.
```
- [rohan-pt/CVE-2025-26056](https://github.com/rohan-pt/CVE-2025-26056)


Question: How to: CVE-2025-26125 (2025-03-17)

Answer:
```
An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.
```
- [ZeroMemoryEx/CVE-2025-26125](https://github.com/ZeroMemoryEx/CVE-2025-26125)


Question: How to: CVE-2025-26159 (2025-04-22)

Answer:
```
Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field.
```
- [godBADTRY/CVE-2025-26159](https://github.com/godBADTRY/CVE-2025-26159)


Question: How to: CVE-2025-26198 (2025-06-18)

Answer:
```
CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
```
- [tansique-17/CVE-2025-26198](https://github.com/tansique-17/CVE-2025-26198)
- [WailYacoubi9/CVE-2025-26198](https://github.com/WailYacoubi9/CVE-2025-26198)


Question: How to: CVE-2025-26199 (2025-06-18)

Answer:
```
CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access to the same network (e.g., public Wi-Fi or compromised router) can capture login credentials via Man-in-the-Middle (MitM) techniques. If the attacker subsequently uses the credentials to log in and exploit administrative functions (e.g., file upload), this may lead to remote code execution depending on the environment.
```
- [tansique-17/CVE-2025-26199](https://github.com/tansique-17/CVE-2025-26199)


Question: How to: CVE-2025-26206 (2025-03-03)

Answer:
```
Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component
```
- [xibhi/CVE-2025-26206](https://github.com/xibhi/CVE-2025-26206)


Question: How to: CVE-2025-26240

Answer: - [Habuon/CVE-2025-26240](https://github.com/Habuon/CVE-2025-26240)


Question: How to: CVE-2025-26244

Answer: - [JaRm222/CVE-2025-26244](https://github.com/JaRm222/CVE-2025-26244)


Question: How to: CVE-2025-26263 (2025-02-28)

Answer:
```
GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.
```
- [DRAGOWN/CVE-2025-26263](https://github.com/DRAGOWN/CVE-2025-26263)


Question: How to: CVE-2025-26264 (2025-02-27)

Answer:
```
GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise.
```
- [DRAGOWN/CVE-2025-26264](https://github.com/DRAGOWN/CVE-2025-26264)


Question: How to: CVE-2025-26318 (2025-03-04)

Answer:
```
hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.
```
- [Frozenka/CVE-2025-26318](https://github.com/Frozenka/CVE-2025-26318)


Question: How to: CVE-2025-26319 (2025-03-04)

Answer:
```
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
```
- [dorattias/CVE-2025-26319](https://github.com/dorattias/CVE-2025-26319)
- [redpack-kr/CVE-2025-26319](https://github.com/redpack-kr/CVE-2025-26319)


Question: How to: CVE-2025-26326 (2025-02-28)

Answer:
```
A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered by the user and do not have an additional authentication or computer verification mechanism. Tests indicate that more than 1,000 systems use easy-to-guess passwords, many with less than 4 to 6 characters, including common sequences. This allows brute force attacks or trial-and-error attempts by malicious invaders. The vulnerability can be exploited by a remote attacker who knows or can guess the password used in the connection. As a result, the attacker gains complete access to the affected system and can execute commands, modify files, and compromise user security.
```
- [azurejoga/CVE-2025-26326](https://github.com/azurejoga/CVE-2025-26326)


Question: How to: CVE-2025-26399 (2025-09-23)

Answer:
```
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
```
- [rxerium/CVE-2025-26399](https://github.com/rxerium/CVE-2025-26399)


Question: How to: CVE-2025-26417 (2025-08-26)

Answer:
```
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
```
- [uthrasri/CVE-2025-26417](https://github.com/uthrasri/CVE-2025-26417)


Question: How to: CVE-2025-26443 (2025-09-04)

Answer:
```
In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
```
- [Pazhanivelmani/ManagedProvisioning-A10_r33_CVE-2025-26443](https://github.com/Pazhanivelmani/ManagedProvisioning-A10_r33_CVE-2025-26443)


Question: How to: CVE-2025-26465 (2025-02-18)

Answer:
```
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
```
- [rxerium/CVE-2025-26465](https://github.com/rxerium/CVE-2025-26465)
- [dolutech/patch-manual-CVE-2025-26465-e-CVE-2025-26466](https://github.com/dolutech/patch-manual-CVE-2025-26465-e-CVE-2025-26466)


Question: How to: CVE-2025-26466 (2025-02-28)

Answer:
```
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
```
- [rxerium/CVE-2025-26466](https://github.com/rxerium/CVE-2025-26466)
- [mrowkoob/CVE-2025-26466-msf](https://github.com/mrowkoob/CVE-2025-26466-msf)


Question: How to: CVE-2025-26529 (2025-02-24)

Answer:
```
Description information displayed in the site administration live log \nrequired additional sanitizing to prevent a stored XSS risk.
```
- [Astroo18/PoC-CVE-2025-26529](https://github.com/Astroo18/PoC-CVE-2025-26529)
- [hxuu/moodle-cve](https://github.com/hxuu/moodle-cve)


Question: How to: CVE-2025-26633 (2025-03-11)

Answer:
```
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
```
- [sandsoncosta/CVE-2025-26633](https://github.com/sandsoncosta/CVE-2025-26633)
- [mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation](https://github.com/mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation)


Question: How to: CVE-2025-26686 (2025-04-08)

Answer:
```
Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
```
- [mrk336/CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates](https://github.com/mrk336/CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates)
- [alifaraj5723/CVE-2025-26686-poc](https://github.com/alifaraj5723/CVE-2025-26686-poc)


Question: How to: CVE-2025-26788 (2025-02-14)

Answer:
```
StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.
```
- [EQSTLab/CVE-2025-26788](https://github.com/EQSTLab/CVE-2025-26788)


Question: How to: CVE-2025-26794 (2025-02-21)

Answer:
```
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
```
- [OscarBataille/CVE-2025-26794](https://github.com/OscarBataille/CVE-2025-26794)
- [ishwardeepp/CVE-2025-26794-Exim-Mail-SQLi](https://github.com/ishwardeepp/CVE-2025-26794-Exim-Mail-SQLi)


Question: How to: CVE-2025-26865 (2025-03-10)

Answer:
```
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: from 18.12.17 before 18.12.18.  \n\nIt's a regression between 18.12.17 and 18.12.18.\nIn case you use something like that, which is not recommended!\nFor security, only official releases should be used.\n\nIn other words, if you use 18.12.17 you are still safe.\nThe version 18.12.17 is not a affected.\nBut something between 18.12.17 and 18.12.18 is.\n\nIn that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.
```
- [mbadanoiu/CVE-2025-26865](https://github.com/mbadanoiu/CVE-2025-26865)


Question: How to: CVE-2025-26892 (2025-05-19)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/a through 2.2.
```
- [Nxploited/CVE-2025-26892](https://github.com/Nxploited/CVE-2025-26892)


Question: How to: CVE-2025-27007 (2025-05-01)

Answer:
```
Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82.
```
- [absholi7ly/CVE-2025-27007-OttoKit-exploit](https://github.com/absholi7ly/CVE-2025-27007-OttoKit-exploit)


Question: How to: CVE-2025-27152 (2025-03-07)

Answer:
```
axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.
```
- [andreglock/axios-ssrf](https://github.com/andreglock/axios-ssrf)
- [davidblakecoe/axios-CVE-2025-27152-PoC](https://github.com/davidblakecoe/axios-CVE-2025-27152-PoC)


Question: How to: CVE-2025-27210 (2025-07-18)

Answer:
```
An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \r\n\r\nThis vulnerability affects Windows users of `path.join` API.
```
- [absholi7ly/CVE-2025-27210_NodeJS_Path_Traversal_Exploit](https://github.com/absholi7ly/CVE-2025-27210_NodeJS_Path_Traversal_Exploit)
- [Ashwesker/Ashwesker-CVE-2025-27210](https://github.com/Ashwesker/Ashwesker-CVE-2025-27210)
- [mindeddu/Vulnerable-CVE-2025-27210](https://github.com/mindeddu/Vulnerable-CVE-2025-27210)


Question: How to: CVE-2025-27363 (2025-03-11)

Answer:
```
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.
```
- [zhuowei/CVE-2025-27363-proof-of-concept](https://github.com/zhuowei/CVE-2025-27363-proof-of-concept)
- [ov3rf1ow/CVE-2025-27363](https://github.com/ov3rf1ow/CVE-2025-27363)
- [tin-z/CVE-2025-27363](https://github.com/tin-z/CVE-2025-27363)


Question: How to: CVE-2025-27410 (2025-02-28)

Answer:
```
PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.
```
- [shreyas-malhotra/CVE-2025-27410](https://github.com/shreyas-malhotra/CVE-2025-27410)


Question: How to: CVE-2025-27415 (2025-03-19)

Answer:
```
Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.
```
- [jiseoung/CVE-2025-27415-PoC](https://github.com/jiseoung/CVE-2025-27415-PoC)


Question: How to: CVE-2025-27480 (2025-04-08)

Answer:
```
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
```
- [mrk336/CVE-2025-27480-The-Silent-Gateway-Risk](https://github.com/mrk336/CVE-2025-27480-The-Silent-Gateway-Risk)
- [mrk336/CVE-2025-27480](https://github.com/mrk336/CVE-2025-27480)


Question: How to: CVE-2025-27515 (2025-03-05)

Answer:
```
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
```
- [joaovicdev/EXPLOIT-CVE-2025-27515](https://github.com/joaovicdev/EXPLOIT-CVE-2025-27515)


Question: How to: CVE-2025-27519 (2025-03-07)

Answer:
```
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issue exists at /v1/internal/upload-to-local-directory which is enabled when the Local env variable is set to true, such as when Cognita is setup using Docker. Because the docker environment sets up the backend uvicorn server with auto reload enabled, when an attacker overwrites the /app/backend/__init__.py file, the file will automatically be reloaded and executed. This allows an attacker to get remote code execution in the context of the Docker container. This vulnerability is fixed in commit a78bd065e05a1b30a53a3386cc02e08c317d2243.
```
- [Diabl0xE/CVE-2025-27519](https://github.com/Diabl0xE/CVE-2025-27519)


Question: How to: CVE-2025-27520 (2025-04-04)

Answer:
```
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
```
- [amalpvatayam67/day09-bentoml-deser-lab](https://github.com/amalpvatayam67/day09-bentoml-deser-lab)


Question: How to: CVE-2025-27533 (2025-05-07)

Answer:
```
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.\n\nDuring unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.\n\nUsers are recommended to upgrade to version 6.1.6+, 5.19.0+,  5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.\n\nExisting users may implement mutual TLS to mitigate the risk on affected brokers.
```
- [absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ](https://github.com/absholi7ly/CVE-2025-27533-Exploit-for-Apache-ActiveMQ)


Question: How to: CVE-2025-27558 (2025-05-21)

Answer:
```
IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.
```
- [Atlas-ghostshell/CVE-2025-27558_Patching](https://github.com/Atlas-ghostshell/CVE-2025-27558_Patching)


Question: How to: CVE-2025-27580 (2025-04-23)

Answer:
```
NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.
```
- [TrustStackSecurity/CVE-2025-27580](https://github.com/TrustStackSecurity/CVE-2025-27580)


Question: How to: CVE-2025-27581 (2025-04-23)

Answer:
```
NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.
```
- [Henryisnotavailable/CVE-2025-27581](https://github.com/Henryisnotavailable/CVE-2025-27581)


Question: How to: CVE-2025-27590 (2025-03-03)

Answer:
```
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.
```
- [fatkz/CVE-2025-27590](https://github.com/fatkz/CVE-2025-27590)


Question: How to: CVE-2025-27591 (2025-03-11)

Answer:
```
A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
```
- [obamalaolu/CVE-2025-27591](https://github.com/obamalaolu/CVE-2025-27591)
- [rvizx/CVE-2025-27591](https://github.com/rvizx/CVE-2025-27591)
- [BridgerAlderson/CVE-2025-27591-PoC](https://github.com/BridgerAlderson/CVE-2025-27591-PoC)
- [DarksBlackSk/CVE-2025-27591](https://github.com/DarksBlackSk/CVE-2025-27591)
- [dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591](https://github.com/dollarboysushil/Linux-Privilege-Escalation-CVE-2025-27591)
- [alialucas7/CVE-2025-27591_PoC](https://github.com/alialucas7/CVE-2025-27591_PoC)
- [incommatose/CVE-2025-27591-PoC](https://github.com/incommatose/CVE-2025-27591-PoC)
- [00xCanelo/CVE-2025-27591](https://github.com/00xCanelo/CVE-2025-27591)
- [Thekin-ctrl/CVE-2025-27591-Below](https://github.com/Thekin-ctrl/CVE-2025-27591-Below)
- [Cythonic1/CVE-2025-27591](https://github.com/Cythonic1/CVE-2025-27591)
- [umutcamliyurt/CVE-2025-27591](https://github.com/umutcamliyurt/CVE-2025-27591)
- [danil-koltsov/below-log-race-poc](https://github.com/danil-koltsov/below-log-race-poc)
- [VisaiCyber/CVE-2025-27591-below-](https://github.com/VisaiCyber/CVE-2025-27591-below-)
- [0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591](https://github.com/0xDTC/Below-Logger-Symlink-Attack_CVE-2025-27591)
- [0x00Jeff/CVE-2025-27591](https://github.com/0x00Jeff/CVE-2025-27591)
- [Stp1t/CVE-2025-27591](https://github.com/Stp1t/CVE-2025-27591)


Question: How to: CVE-2025-27607 (2025-03-07)

Answer:
```
Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing dependency. This occurred because msgspec-python313-pre was deleted by the owner leaving the name open to being claimed by a third party. If the package was claimed, it would allow them RCE on any Python JSON Logger user who installed the development dependencies on Python 3.13 (e.g. pip install python-json-logger[dev]). This issue has been resolved with 3.3.0.
```
- [Barsug/msgspec-python313-pre](https://github.com/Barsug/msgspec-python313-pre)


Question: How to: CVE-2025-27636 (2025-03-09)

Answer:
```
Bypass/Injection vulnerability in Apache Camel components under particular conditions.\n\nThis issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3.\n\nUsers are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.\n\n\n\nThis vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific\n\nheaders that for some Camel components can alter the behaviours such as the camel-bean component, to call another method\n\non the bean, than was coded in the application. In the camel-jms component, then a malicious header can be used to send\n\nthe message to another queue (on the same broker) than was coded in the application. This could also be seen by using the camel-exec component\n\n\n\n\nThe attacker would need to inject custom headers, such as HTTP protocols. So if you have Camel applications that are\n\ndirectly connected to the internet via HTTP, then an attacker could include malicious HTTP headers in the HTTP requests\n\nthat are send to the Camel application.\n\n\n\n\nAll the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box.\n\nIn these conditions an attacker could be able to forge a Camel header name and make the bean component invoking other methods in the same bean.\n\nIn terms of usage of the default header filter strategy the list of components using that is: \n\n\n  *  camel-activemq\n  *  camel-activemq6\n  *  camel-amqp\n  *  camel-aws2-sqs\n  *  camel-azure-servicebus\n  *  camel-cxf-rest\n  *  camel-cxf-soap\n  *  camel-http\n  *  camel-jetty\n  *  camel-jms\n  *  camel-kafka\n  *  camel-knative\n  *  camel-mail\n  *  camel-nats\n  *  camel-netty-http\n  *  camel-platform-http\n  *  camel-rest\n  *  camel-sjms\n  *  camel-spring-rabbitmq\n  *  camel-stomp\n  *  camel-tahu\n  *  camel-undertow\n  *  camel-xmpp\n\n\n\n\n\n\nThe vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with "Camel", "camel", or "org.apache.camel.". \n\n\nMitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like "cAmel, cAMEL" etc, or in general everything not starting with "Camel", "camel" or "org.apache.camel.".
```
- [akamai/CVE-2025-27636-Apache-Camel-PoC](https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC)
- [enochgitgamefied/CVE-2025-27636-Practical-Lab](https://github.com/enochgitgamefied/CVE-2025-27636-Practical-Lab)


Question: How to: CVE-2025-27817 (2025-06-10)

Answer:
```
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. \n\nSince Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.
```
- [kk12-30/CVE-2025-27817](https://github.com/kk12-30/CVE-2025-27817)
- [iSee857/CVE-2025-27817](https://github.com/iSee857/CVE-2025-27817)


Question: How to: CVE-2025-27840 (2025-03-08)

Answer:
```
Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
```
- [em0gi/CVE-2025-27840](https://github.com/em0gi/CVE-2025-27840)
- [demining/Bluetooth-Attacks-CVE-2025-27840](https://github.com/demining/Bluetooth-Attacks-CVE-2025-27840)
- [ladyg00se/CVE-2025-27840-WIP](https://github.com/ladyg00se/CVE-2025-27840-WIP)


Question: How to: CVE-2025-27893 (2025-03-11)

Answer:
```
In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date, by intercepting and modifying a Copy request via a GenericContent/Record.aspx?id= URI. NOTE: the Supplier analyzed the reported exploitation steps and found that, although the user can modify the immutable field, upon switching to View mode the field is reverted to its original value, without anything being saved to the database (and consequently there is no impact).
```
- [NastyCrow/CVE-2025-27893](https://github.com/NastyCrow/CVE-2025-27893)


Question: How to: CVE-2025-28009 (2025-04-17)

Answer:
```
A SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20.
```
- [0xs4h4/CVE-2025-28009](https://github.com/0xs4h4/CVE-2025-28009)


Question: How to: CVE-2025-28062 (2025-05-05)

Answer:
```
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.
```
- [Thvt0ne/CVE-2025-28062](https://github.com/Thvt0ne/CVE-2025-28062)


Question: How to: CVE-2025-28073 (2025-05-08)

Answer:
```
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.
```
- [mLniumm/CVE-2025-28073](https://github.com/mLniumm/CVE-2025-28073)


Question: How to: CVE-2025-28074 (2025-05-08)

Answer:
```
phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to inject malicious JavaScript.
```
- [mLniumm/CVE-2025-28074](https://github.com/mLniumm/CVE-2025-28074)


Question: How to: CVE-2025-28121 (2025-04-21)

Answer:
```
code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing remote attackers to execute arbitrary code.
```
- [pruthuraut/CVE-2025-28121](https://github.com/pruthuraut/CVE-2025-28121)


Question: How to: CVE-2025-28346

Answer: - [Shubham03007/CVE-2025-28346](https://github.com/Shubham03007/CVE-2025-28346)


Question: How to: CVE-2025-28355 (2025-04-18)

Answer:
```
Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none
```
- [abbisQQ/CVE-2025-28355](https://github.com/abbisQQ/CVE-2025-28355)


Question: How to: CVE-2025-28915 (2025-03-11)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit allows Upload a Web Shell to a Web Server. This issue affects ThemeEgg ToolKit: from n/a through 1.2.9.
```
- [Nxploited/CVE-2025-28915](https://github.com/Nxploited/CVE-2025-28915)
- [Pei4AN/CVE-2025-28915](https://github.com/Pei4AN/CVE-2025-28915)


Question: How to: CVE-2025-29015 (2025-04-17)

Answer:
```
Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php.
```
- [b1tm4r/CVE-2025-29015](https://github.com/b1tm4r/CVE-2025-29015)


Question: How to: CVE-2025-29017 (2025-04-10)

Answer:
```
A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php.
```
- [b1tm4r/CVE-2025-29017](https://github.com/b1tm4r/CVE-2025-29017)


Question: How to: CVE-2025-29018 (2025-04-09)

Answer:
```
A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking System 2.0.0.
```
- [b1tm4r/CVE-2025-29018](https://github.com/b1tm4r/CVE-2025-29018)


Question: How to: CVE-2025-29093 (2025-06-04)

Answer:
```
File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component.
```
- [FraMarcuccio/CVE-2025-29093-Arbitrary-File-Upload](https://github.com/FraMarcuccio/CVE-2025-29093-Arbitrary-File-Upload)


Question: How to: CVE-2025-29094 (2025-06-04)

Answer:
```
Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Marketing/Offers and Content/Pages components.
```
- [FraMarcuccio/CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS](https://github.com/FraMarcuccio/CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS)


Question: How to: CVE-2025-29275

Answer: - [0xBl4nk/CVE-2025-29275](https://github.com/0xBl4nk/CVE-2025-29275)


Question: How to: CVE-2025-29276

Answer: - [0xBl4nk/CVE-2025-29276](https://github.com/0xBl4nk/CVE-2025-29276)


Question: How to: CVE-2025-29277

Answer: - [0xBl4nk/CVE-2025-29277](https://github.com/0xBl4nk/CVE-2025-29277)


Question: How to: CVE-2025-29278

Answer: - [0xBl4nk/CVE-2025-29278](https://github.com/0xBl4nk/CVE-2025-29278)


Question: How to: CVE-2025-29279

Answer: - [0xBl4nk/CVE-2025-29279](https://github.com/0xBl4nk/CVE-2025-29279)


Question: How to: CVE-2025-29306 (2025-03-27)

Answer:
```
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.
```
- [somatrasss/CVE-2025-29306](https://github.com/somatrasss/CVE-2025-29306)
- [verylazytech/CVE-2025-29306](https://github.com/verylazytech/CVE-2025-29306)
- [inok009/FOXCMS-CVE-2025-29306-POC](https://github.com/inok009/FOXCMS-CVE-2025-29306-POC)
- [Mattb709/CVE-2025-29306-PoC-FoxCMS-RCE](https://github.com/Mattb709/CVE-2025-29306-PoC-FoxCMS-RCE)
- [congdong007/CVE-2025-29306_poc](https://github.com/congdong007/CVE-2025-29306_poc)
- [amalpvatayam67/day06-foxcms-rce](https://github.com/amalpvatayam67/day06-foxcms-rce)
- [Ashwesker/Ashwesker-CVE-2025-29306](https://github.com/Ashwesker/Ashwesker-CVE-2025-29306)
- [mantanhacker/Mass-CVE-2025-29306](https://github.com/mantanhacker/Mass-CVE-2025-29306)


Question: How to: CVE-2025-29384 (2025-03-14)

Answer:
```
In Tenda AC9 v1.0 V15.03.05.14_multi, the wanMTU parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
```
- [Otsmane-Ahmed/cve-2025-29384-poc](https://github.com/Otsmane-Ahmed/cve-2025-29384-poc)


Question: How to: CVE-2025-29448 (2025-05-07)

Answer:
```
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causing a denial of service by blocking all future booking availability.
```
- [Abdullah4eb/CVE-2025-29448](https://github.com/Abdullah4eb/CVE-2025-29448)


Question: How to: CVE-2025-29471 (2025-04-15)

Answer:
```
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.
```
- [skraft9/CVE-2025-29471](https://github.com/skraft9/CVE-2025-29471)


Question: How to: CVE-2025-29529 (2025-04-24)

Answer:
```
ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpassword.aspx.
```
- [Yoshik0xF6/CVE-2025-29529](https://github.com/Yoshik0xF6/CVE-2025-29529)


Question: How to: CVE-2025-29556 (2025-07-31)

Answer:
```
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role from creating or modifying users with the Security Officer role without approval. However, a flaw in the account creation process allows an attacker to bypass these restrictions via API request manipulation. An attacker with an Admin access can intercept and modify the API request during user creation, altering the parameters to assign the new account to the ExaGrid Security Officers group without the required approval.
```
- [0xsu3ks/CVE-2025-29556](https://github.com/0xsu3ks/CVE-2025-29556)


Question: How to: CVE-2025-29557 (2025-07-31)

Answer:
```
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issue an HTTP request to retrieve SMTP credentials, including plaintext passwords.
```
- [0xsu3ks/CVE-2025-29557](https://github.com/0xsu3ks/CVE-2025-29557)


Question: How to: CVE-2025-29602 (2025-05-07)

Answer:
```
flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
```
- [harish0x/CVE-2025-29602](https://github.com/harish0x/CVE-2025-29602)


Question: How to: CVE-2025-29628 (2025-07-25)

Answer:
```
An issue in Gardyn 4 allows a remote attacker to obtain sensitive information and execute arbitrary code via a request
```
- [mselbrede/gardyn](https://github.com/mselbrede/gardyn)


Question: How to: CVE-2025-29632 (2025-05-29)

Answer:
```
Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components
```
- [OHnogood/CVE-2025-29632](https://github.com/OHnogood/CVE-2025-29632)


Question: How to: CVE-2025-29705 (2025-04-15)

Answer:
```
code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects.
```
- [yxzrw/CVE-2025-29705](https://github.com/yxzrw/CVE-2025-29705)


Question: How to: CVE-2025-29722 (2025-04-17)

Answer:
```
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints.
```
- [cypherdavy/CVE-2025-29722](https://github.com/cypherdavy/CVE-2025-29722)


Question: How to: CVE-2025-29774 (2025-03-14)

Answer:
```
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.
```
- [demining/Digital-Signature-Forgery-Attack](https://github.com/demining/Digital-Signature-Forgery-Attack)
- [demining/Phantom-Signature-Attack](https://github.com/demining/Phantom-Signature-Attack)


Question: How to: CVE-2025-29775 (2025-03-14)

Answer:
```
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.
```
- [ethicalPap/CVE-2025-29775](https://github.com/ethicalPap/CVE-2025-29775)


Question: How to: CVE-2025-29810 (2025-04-08)

Answer:
```
Improper access control in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
```
- [aleongx/CVE-2025-29810-check](https://github.com/aleongx/CVE-2025-29810-check)


Question: How to: CVE-2025-29824 (2025-04-08)

Answer:
```
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
```
- [encrypter15/CVE-2025-29824](https://github.com/encrypter15/CVE-2025-29824)
- [AfanPan/CVE-2025-29824-Exploit](https://github.com/AfanPan/CVE-2025-29824-Exploit)


Question: How to: CVE-2025-29927 (2025-03-21)

Answer:
```
Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
```
- [serhalp/test-cve-2025-29927](https://github.com/serhalp/test-cve-2025-29927)
- [Ademking/CVE-2025-29927](https://github.com/Ademking/CVE-2025-29927)
- [6mile/nextjs-CVE-2025-29927](https://github.com/6mile/nextjs-CVE-2025-29927)
- [azu/nextjs-cve-2025-29927-poc](https://github.com/azu/nextjs-cve-2025-29927-poc)
- [lirantal/vulnerable-nextjs-14-CVE-2025-29927](https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927)
- [aydinnyunus/CVE-2025-29927](https://github.com/aydinnyunus/CVE-2025-29927)
- [ticofookfook/poc-nextjs-CVE-2025-29927](https://github.com/ticofookfook/poc-nextjs-CVE-2025-29927)
- [t3tra-dev/cve-2025-29927-demo](https://github.com/t3tra-dev/cve-2025-29927-demo)
- [websecnl/CVE-2025-29927-PoC-Exploit](https://github.com/websecnl/CVE-2025-29927-PoC-Exploit)
- [MuhammadWaseem29/CVE-2025-29927-POC](https://github.com/MuhammadWaseem29/CVE-2025-29927-POC)
- [strobes-security/nextjs-vulnerable-app](https://github.com/strobes-security/nextjs-vulnerable-app)
- [RoyCampos/CVE-2025-29927](https://github.com/RoyCampos/CVE-2025-29927)
- [fourcube/nextjs-middleware-bypass-demo](https://github.com/fourcube/nextjs-middleware-bypass-demo)
- [iSee857/CVE-2025-29927](https://github.com/iSee857/CVE-2025-29927)
- [Eve-SatOrU/POC-CVE-2025-29927](https://github.com/Eve-SatOrU/POC-CVE-2025-29927)
- [arvion-agent/next-CVE-2025-29927](https://github.com/arvion-agent/next-CVE-2025-29927)
- [Oyst3r1ng/CVE-2025-29927](https://github.com/Oyst3r1ng/CVE-2025-29927)
- [lem0n817/CVE-2025-29927](https://github.com/lem0n817/CVE-2025-29927)
- [kuzushiki/CVE-2025-29927-test](https://github.com/kuzushiki/CVE-2025-29927-test)
- [ricsirigu/CVE-2025-29927](https://github.com/ricsirigu/CVE-2025-29927)
- [0xWhoknows/CVE-2025-29927](https://github.com/0xWhoknows/CVE-2025-29927)
- [elshaheedy/CVE-2025-29927-Sigma-Rule](https://github.com/elshaheedy/CVE-2025-29927-Sigma-Rule)
- [furmak331/CVE-2025-29927](https://github.com/furmak331/CVE-2025-29927)
- [phoscoder/ghost-route](https://github.com/phoscoder/ghost-route)
- [0xPb1/Next.js-CVE-2025-29927](https://github.com/0xPb1/Next.js-CVE-2025-29927)
- [jeymo092/cve-2025-29927](https://github.com/jeymo092/cve-2025-29927)
- [alihussainzada/CVE-2025-29927-PoC](https://github.com/alihussainzada/CVE-2025-29927-PoC)
- [TheresAFewConors/CVE-2025-29927-Testing](https://github.com/TheresAFewConors/CVE-2025-29927-Testing)
- [0xPThree/next.js_cve-2025-29927](https://github.com/0xPThree/next.js_cve-2025-29927)
- [0xcucumbersalad/cve-2025-29927](https://github.com/0xcucumbersalad/cve-2025-29927)
- [c0dejump/CVE-2025-29927-check](https://github.com/c0dejump/CVE-2025-29927-check)
- [maronnjapan/claude-create-CVE-2025-29927](https://github.com/maronnjapan/claude-create-CVE-2025-29927)
- [kOaDT/poc-cve-2025-29927](https://github.com/kOaDT/poc-cve-2025-29927)
- [yugo-eliatrope/test-cve-2025-29927](https://github.com/yugo-eliatrope/test-cve-2025-29927)
- [emadshanab/CVE-2025-29927](https://github.com/emadshanab/CVE-2025-29927)
- [w3shinew/CVE-2025-29927](https://github.com/w3shinew/CVE-2025-29927)
- [aleongx/CVE-2025-29927](https://github.com/aleongx/CVE-2025-29927)
- [nicknisi/next-attack](https://github.com/nicknisi/next-attack)
- [jmbowes/NextSecureScan](https://github.com/jmbowes/NextSecureScan)
- [aleongx/CVE-2025-29927_Scanner](https://github.com/aleongx/CVE-2025-29927_Scanner)
- [Nekicj/CVE-2025-29927-exploit](https://github.com/Nekicj/CVE-2025-29927-exploit)
- [Heimd411/CVE-2025-29927-PoC](https://github.com/Heimd411/CVE-2025-29927-PoC)
- [m2hcz/PoC-for-Next.js-Middleware](https://github.com/m2hcz/PoC-for-Next.js-Middleware)
- [KaztoRay/CVE-2025-29927-Research](https://github.com/KaztoRay/CVE-2025-29927-Research)
- [nocomp/CVE-2025-29927-scanner](https://github.com/nocomp/CVE-2025-29927-scanner)
- [yuzu-juice/CVE-2025-29927_demo](https://github.com/yuzu-juice/CVE-2025-29927_demo)
- [luq0x/0xMiddleware](https://github.com/luq0x/0xMiddleware)
- [AnonKryptiQuz/NextSploit](https://github.com/AnonKryptiQuz/NextSploit)
- [w2hcorp/CVE-2025-29927-PoC](https://github.com/w2hcorp/CVE-2025-29927-PoC)
- [ferpalma21/Automated-Next.js-Security-Scanner-for-CVE-2025-29927](https://github.com/ferpalma21/Automated-Next.js-Security-Scanner-for-CVE-2025-29927)
- [dante01yoon/CVE-2025-29927](https://github.com/dante01yoon/CVE-2025-29927)
- [ayato-shitomi/WebLab_CVE-2025-29927](https://github.com/ayato-shitomi/WebLab_CVE-2025-29927)
- [Kamal-418/Vulnerable-Lab-NextJS-CVE-


Question: How to: CVE-2025-29972 (2025-05-08)

Answer:
```
Server-Side Request Forgery (SSRF) in Azure allows an authorized attacker to perform spoofing over a network.
```
- [ThemeHackers/CVE-2025-29972](https://github.com/ThemeHackers/CVE-2025-29972)
- [TH-SecForge/CVE-2025-29972](https://github.com/TH-SecForge/CVE-2025-29972)


Question: How to: CVE-2025-30065 (2025-04-01)

Answer:
```
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code\n\n\nUsers are recommended to upgrade to version 1.15.1, which fixes the issue.
```
- [h3st4k3r/CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065)
- [bjornhels/CVE-2025-30065](https://github.com/bjornhels/CVE-2025-30065)
- [ron-imperva/CVE-2025-30065-PoC](https://github.com/ron-imperva/CVE-2025-30065-PoC)
- [mouadk/parquet-rce-poc-CVE-2025-30065](https://github.com/mouadk/parquet-rce-poc-CVE-2025-30065)
- [ThreatRadarAI/TRAI-001-Critical-RCE-Vulnerability-in-Apache-Parquet-CVE-2025-30065-Simulation](https://github.com/ThreatRadarAI/TRAI-001-Critical-RCE-Vulnerability-in-Apache-Parquet-CVE-2025-30065-Simulation)
- [F5-Labs/parquet-canary-exploit-rce-poc-CVE-2025-30065](https://github.com/F5-Labs/parquet-canary-exploit-rce-poc-CVE-2025-30065)
- [Ashwesker/Ashwesker-CVE-2025-30065](https://github.com/Ashwesker/Ashwesker-CVE-2025-30065)


Question: How to: CVE-2025-30066 (2025-03-15)

Answer:
```
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
```
- [OS-pedrogustavobilro/test-changed-files](https://github.com/OS-pedrogustavobilro/test-changed-files)
- [Checkmarx/Checkmarx-CVE-2025-30066-Detection-Tool](https://github.com/Checkmarx/Checkmarx-CVE-2025-30066-Detection-Tool)


Question: How to: CVE-2025-30144 (2025-03-19)

Answer:
```
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 5.0.6, the fast-jwt library does not properly validate the iss claim based on the RFC 7519. The iss (issuer) claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential attack where a malicious actor crafts a JWT with an iss claim structured as ['https://attacker-domain/', 'https://valid-iss']. Due to the permissive validation, the JWT will be deemed valid. Furthermore, if the application relies on external libraries like get-jwks that do not independently validate the iss claim, the attacker can leverage this vulnerability to forge a JWT that will be accepted by the victim application. Essentially, the attacker can insert their own domain into the iss array, alongside the legitimate issuer, and bypass the intended security checks. This issue is fixed in 5.0.6.
```
- [tibrn/CVE-2025-30144](https://github.com/tibrn/CVE-2025-30144)


Question: How to: CVE-2025-30208 (2025-03-24)

Answer:
```
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
```
- [xuemian168/CVE-2025-30208](https://github.com/xuemian168/CVE-2025-30208)
- [ThumpBo/CVE-2025-30208-EXP](https://github.com/ThumpBo/CVE-2025-30208-EXP)
- [kk12-30/CVE-2025-30208](https://github.com/kk12-30/CVE-2025-30208)
- [MiclelsonCN/CVE-2025-30208_POC](https://github.com/MiclelsonCN/CVE-2025-30208_POC)
- [marino-admin/Vite-CVE-2025-30208-Scanner](https://github.com/marino-admin/Vite-CVE-2025-30208-Scanner)
- [Lusensec/CVE-2025-30208](https://github.com/Lusensec/CVE-2025-30208)
- [iSee857/CVE-2025-30208-PoC](https://github.com/iSee857/CVE-2025-30208-PoC)
- [On1onss/CVE-2025-30208](https://github.com/On1onss/CVE-2025-30208)
- [4xura/CVE-2025-30208](https://github.com/4xura/CVE-2025-30208)
- [sadhfdw129/CVE-2025-30208-Vite](https://github.com/sadhfdw129/CVE-2025-30208-Vite)
- [keklick1337/CVE-2025-30208-ViteVulnScanner](https://github.com/keklick1337/CVE-2025-30208-ViteVulnScanner)
- [jackieya/ViteVulScan](https://github.com/jackieya/ViteVulScan)
- [0xshaheen/CVE-2025-30208](https://github.com/0xshaheen/CVE-2025-30208)
- [sumeet-darekar/CVE-2025-30208](https://github.com/sumeet-darekar/CVE-2025-30208)
- [4m3rr0r/CVE-2025-30208-PoC](https://github.com/4m3rr0r/CVE-2025-30208-PoC)
- [lilil3333/Vite-CVE-2025-30208-EXP](https://github.com/lilil3333/Vite-CVE-2025-30208-EXP)
- [imbas007/CVE-2025-30208-template](https://github.com/imbas007/CVE-2025-30208-template)
- [r0ngy40/CVE-2025-30208-Series](https://github.com/r0ngy40/CVE-2025-30208-Series)
- [nkuty/CVE-2025-30208-31125-31486-32395](https://github.com/nkuty/CVE-2025-30208-31125-31486-32395)
- [HaGsec/CVE-2025-30208](https://github.com/HaGsec/CVE-2025-30208)
- [Ashwesker/Ashwesker-CVE-2025-30208](https://github.com/Ashwesker/Ashwesker-CVE-2025-30208)
- [ThemeHackers/CVE-2025-30208](https://github.com/ThemeHackers/CVE-2025-30208)
- [TH-SecForge/CVE-2025-30208](https://github.com/TH-SecForge/CVE-2025-30208)
- [bugdotexe/CVE-2025-30208](https://github.com/bugdotexe/CVE-2025-30208)


Question: How to: CVE-2025-30216 (2025-03-25)

Answer:
```
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a Heap Overflow vulnerability occurs in the `Crypto_TM_ProcessSecurity` function (`crypto_tm.c:1735:8`). When processing the Secondary Header Length of a TM protocol packet, if the Secondary Header Length exceeds the packet's total length, a heap overflow is triggered during the memcpy operation that copies packet data into the dynamically allocated buffer `p_new_dec_frame`. This allows an attacker to overwrite adjacent heap memory, potentially leading to arbitrary code execution or system instability. A patch is available at commit 810fd66d592c883125272fef123c3240db2f170f.
```
- [oliviaisntcringe/CVE-2025-30216-PoC](https://github.com/oliviaisntcringe/CVE-2025-30216-PoC)


Question: How to: CVE-2025-30349 (2025-03-21)

Answer:
```
Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
```
- [natasaka/CVE-2025-30349](https://github.com/natasaka/CVE-2025-30349)


Question: How to: CVE-2025-30397 (2025-05-13)

Answer:
```
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
```
- [mbanyamer/CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free-](https://github.com/mbanyamer/CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free-)
- [Ashwesker/Ashwesker-CVE-2025-30397](https://github.com/Ashwesker/Ashwesker-CVE-2025-30397)


Question: How to: CVE-2025-30400 (2025-05-13)

Answer:
```
Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.
```
- [encrypter15/CVE-2025-30400](https://github.com/encrypter15/CVE-2025-30400)


Question: How to: CVE-2025-30406 (2025-04-03)

Answer:
```
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
```
- [W01fh4cker/CVE-2025-30406](https://github.com/W01fh4cker/CVE-2025-30406)
- [mchklt/CVE-2025-30406](https://github.com/mchklt/CVE-2025-30406)
- [threadpoolx/CVE-2025-30406-CentreStack-Triofox-Deserialization-RCE](https://github.com/threadpoolx/CVE-2025-30406-CentreStack-Triofox-Deserialization-RCE)


Question: How to: CVE-2025-30567 (2025-03-25)

Answer:
```
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wp01ru WP01 allows Path Traversal. This issue affects WP01: from n/a through 2.6.2.
```
- [Oyst3r1ng/CVE-2025-30567](https://github.com/Oyst3r1ng/CVE-2025-30567)


Question: How to: CVE-2025-30712 (2025-04-15)

Answer:
```
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L).
```
- [jamesb5959/CVE-2025-30712-_PoC](https://github.com/jamesb5959/CVE-2025-30712-_PoC)


Question: How to: CVE-2025-30749 (2025-07-15)

Answer:
```
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
```
- [rashedhasan090/AegisJava](https://github.com/rashedhasan090/AegisJava)


Question: How to: CVE-2025-30772 (2025-03-27)

Answer:
```
Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce allows Privilege Escalation. This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through 3.0.4.
```
- [Nxploited/CVE-2025-30772](https://github.com/Nxploited/CVE-2025-30772)


Question: How to: CVE-2025-30911 (2025-04-01)

Answer:
```
Improper Control of Generation of Code ('Code Injection') vulnerability in Rometheme RomethemeKit For Elementor allows Command Injection. This issue affects RomethemeKit For Elementor: from n/a through 1.5.4.
```
- [Nxploited/CVE-2025-30911](https://github.com/Nxploited/CVE-2025-30911)


Question: How to: CVE-2025-30921 (2025-03-27)

Answer:
```
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters allows SQL Injection. This issue affects Newsletters: from n/a through 4.9.9.7.
```
- [DoTTak/CVE-2025-30921](https://github.com/DoTTak/CVE-2025-30921)


Question: How to: CVE-2025-30967 (2025-04-15)

Answer:
```
Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Upload a Web Shell to a Web Server. This issue affects WPJobBoard: from n/a through n/a.
```
- [Anton-ai111/CVE-2025-30967](https://github.com/Anton-ai111/CVE-2025-30967)


Question: How to: CVE-2025-31033 (2025-04-09)

Answer:
```
Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity allows Cross Site Request Forgery. This issue affects Buddypress Humanity: from n/a through 1.2.
```
- [Nxploited/CVE-2025-31033](https://github.com/Nxploited/CVE-2025-31033)


Question: How to: CVE-2025-31125 (2025-03-31)

Answer:
```
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
```
- [sunhuiHi666/CVE-2025-31125](https://github.com/sunhuiHi666/CVE-2025-31125)
- [MuhammadWaseem29/Vitejs-exploit](https://github.com/MuhammadWaseem29/Vitejs-exploit)
- [0xgh057r3c0n/CVE-2025-31125](https://github.com/0xgh057r3c0n/CVE-2025-31125)
- [harshgupptaa/Path-Transversal-CVE-2025-31125-](https://github.com/harshgupptaa/Path-Transversal-CVE-2025-31125-)


Question: How to: CVE-2025-31129 (2025-03-31)

Answer:
```
Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is fixed in 2.17.0 (2.x) and 3.7.0 (3.x).
```
- [cwm1123/CVE-2025-31129](https://github.com/cwm1123/CVE-2025-31129)


Question: How to: CVE-2025-31131 (2025-04-01)

Answer:
```
YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.
```
- [MuhammadWaseem29/CVE-2025-31131](https://github.com/MuhammadWaseem29/CVE-2025-31131)
- [Ashwesker/Ashwesker-CVE-2025-31131](https://github.com/Ashwesker/Ashwesker-CVE-2025-31131)


Question: How to: CVE-2025-31133 (2025-11-06)

Answer:
```
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
```
- [omne-earth/arca](https://github.com/omne-earth/arca)
- [skynet-f-nvidia/CVE-2025-31133](https://github.com/skynet-f-nvidia/CVE-2025-31133)


Question: How to: CVE-2025-31137 (2025-04-01)

Answer:
```
React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this vulnerability allows anyone to spoof the URL used in an incoming Request by putting a URL pathname in the port section of a URL that is part of a Host or X-Forwarded-Host header sent to a Remix/React Router request handler. This issue has been patched and released in Remix 2.16.3 and React Router 7.4.1.
```
- [pouriam23/vulnerability-in-Remix-React-Router-CVE-2025-31137-](https://github.com/pouriam23/vulnerability-in-Remix-React-Router-CVE-2025-31137-)


Question: How to: CVE-2025-31161 (2025-04-03)

Answer:
```
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
```
- [Immersive-Labs-Sec/CVE-2025-31161](https://github.com/Immersive-Labs-Sec/CVE-2025-31161)
- [TX-One/CVE-2025-31161](https://github.com/TX-One/CVE-2025-31161)
- [SUPRAAA-1337/Nuclei_CVE-2025-31161_CVE-2025-2825](https://github.com/SUPRAAA-1337/Nuclei_CVE-2025-31161_CVE-2025-2825)
- [SUPRAAA-1337/CVE-2025-31161_exploit](https://github.com/SUPRAAA-1337/CVE-2025-31161_exploit)
- [0xgh057r3c0n/CVE-2025-31161](https://github.com/0xgh057r3c0n/CVE-2025-31161)
- [Ashwesker/Ashwesker-CVE-2025-31161](https://github.com/Ashwesker/Ashwesker-CVE-2025-31161)
- [ibrahmsql/CVE-2025-31161](https://github.com/ibrahmsql/CVE-2025-31161)
- [r0otk3r/CVE-2025-31161](https://github.com/r0otk3r/CVE-2025-31161)
- [f4dee-backup/CVE-2025-31161](https://github.com/f4dee-backup/CVE-2025-31161)
- [acan0007/CVE-2025-31161](https://github.com/acan0007/CVE-2025-31161)
- [Teexo/CVE-2025-31161](https://github.com/Teexo/CVE-2025-31161)
- [0xDTC/CrushFTP-auth-bypass-CVE-2025-31161](https://github.com/0xDTC/CrushFTP-auth-bypass-CVE-2025-31161)
- [ch3m1cl/CVE-2025-31161](https://github.com/ch3m1cl/CVE-2025-31161)
- [Dairrow/CVE-2025-31161](https://github.com/Dairrow/CVE-2025-31161)


Question: How to: CVE-2025-31200 (2025-04-16)

Answer:
```
A memory corruption issue was addressed with improved bounds checking. This issue is fixed in tvOS 18.4.1, visionOS 2.4.1, iOS iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.
```
- [zhuowei/apple-positional-audio-codec-invalid-header](https://github.com/zhuowei/apple-positional-audio-codec-invalid-header)
- [JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201](https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201)
- [serundengsapi/CVE-2025-31200-iOS-AudioConverter-RCE](https://github.com/serundengsapi/CVE-2025-31200-iOS-AudioConverter-RCE)
- [hunters-sec/CVE-2025-31200](https://github.com/hunters-sec/CVE-2025-31200)


Question: How to: CVE-2025-31258 (2025-05-12)

Answer:
```
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox.
```
- [sureshkumarsat/CVE-2025-31258-PoC](https://github.com/sureshkumarsat/CVE-2025-31258-PoC)
- [wh1te4ever/CVE-2025-31258-PoC](https://github.com/wh1te4ever/CVE-2025-31258-PoC)


Question: How to: CVE-2025-31324 (2025-04-24)

Answer:
```
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
```
- [rxerium/CVE-2025-31324](https://github.com/rxerium/CVE-2025-31324)
- [redrays-io/CVE-2025-31324](https://github.com/redrays-io/CVE-2025-31324)
- [Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools](https://github.com/Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools)
- [moften/CVE-2025-31324](https://github.com/moften/CVE-2025-31324)
- [moften/CVE-2025-31324-NUCLEI](https://github.com/moften/CVE-2025-31324-NUCLEI)
- [Alizngnc/SAP-CVE-2025-31324](https://github.com/Alizngnc/SAP-CVE-2025-31324)
- [ODST-Forge/CVE-2025-31324_PoC](https://github.com/ODST-Forge/CVE-2025-31324_PoC)
- [abrewer251/CVE-2025-31324_PoC_SAP](https://github.com/abrewer251/CVE-2025-31324_PoC_SAP)
- [BlueOWL-overlord/Burp_CVE-2025-31324](https://github.com/BlueOWL-overlord/Burp_CVE-2025-31324)
- [nullcult/CVE-2025-31324-File-Upload](https://github.com/nullcult/CVE-2025-31324-File-Upload)
- [respondiq/jsp-webshell-scanner](https://github.com/respondiq/jsp-webshell-scanner)
- [JonathanStross/CVE-2025-31324](https://github.com/JonathanStross/CVE-2025-31324)
- [Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment](https://github.com/Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment)
- [rf-peixoto/sap_netweaver_cve-2025-31324-](https://github.com/rf-peixoto/sap_netweaver_cve-2025-31324-)
- [NULLTRACE0X/CVE-2025-31324](https://github.com/NULLTRACE0X/CVE-2025-31324)
- [nairuzabulhul/nuclei-template-cve-2025-31324-check](https://github.com/nairuzabulhul/nuclei-template-cve-2025-31324-check)
- [sug4r-wr41th/CVE-2025-31324](https://github.com/sug4r-wr41th/CVE-2025-31324)
- [antichainalysis/sap-netweaver-0day-CVE-2025-31324](https://github.com/antichainalysis/sap-netweaver-0day-CVE-2025-31324)
- [harshitvarma05/CVE-2025-31324-Exploits](https://github.com/harshitvarma05/CVE-2025-31324-Exploits)
- [aristois913/CVE-2025-31324](https://github.com/aristois913/CVE-2025-31324)


Question: How to: CVE-2025-31336

Answer: - [coleleavitt/AAMVA-PDF417-Vulnerability-Research](https://github.com/coleleavitt/AAMVA-PDF417-Vulnerability-Research)


Question: How to: CVE-2025-31486 (2025-04-03)

Answer:
```
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
```
- [iSee857/CVE-2025-31486-PoC](https://github.com/iSee857/CVE-2025-31486-PoC)
- [Ly4j/CVE-2025-31486](https://github.com/Ly4j/CVE-2025-31486)
- [hackmelocal/CVE-2025-31486-Simulation](https://github.com/hackmelocal/CVE-2025-31486-Simulation)


Question: How to: CVE-2025-31644 (2025-05-07)

Answer:
```
When running in Appliance mode, a command injection vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command which may allow an authenticated attacker with administrator role privileges to execute arbitrary system commands. A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
```
- [mbadanoiu/CVE-2025-31644](https://github.com/mbadanoiu/CVE-2025-31644)


Question: How to: CVE-2025-31650 (2025-04-28)

Answer:
```
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
```
- [absholi7ly/TomcatKiller-CVE-2025-31650](https://github.com/absholi7ly/TomcatKiller-CVE-2025-31650)
- [tunahantekeoglu/CVE-2025-31650](https://github.com/tunahantekeoglu/CVE-2025-31650)
- [sattarbug/Analysis-of-TomcatKiller---CVE-2025-31650-Exploit-Tool](https://github.com/sattarbug/Analysis-of-TomcatKiller---CVE-2025-31650-Exploit-Tool)
- [assad12341/DOS-exploit](https://github.com/assad12341/DOS-exploit)
- [assad12341/Dos-exploit-](https://github.com/assad12341/Dos-exploit-)
- [obscura-cert/CVE-2025-31650](https://github.com/obscura-cert/CVE-2025-31650)
- [B1gN0Se/Tomcat-CVE-2025-31650](https://github.com/B1gN0Se/Tomcat-CVE-2025-31650)


Question: How to: CVE-2025-31651 (2025-04-28)

Answer:
```
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible \nfor a specially crafted request to bypass some rewrite rules. If those \nrewrite rules effectively enforced security constraints, those \nconstraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
```
- [gregk4sec/CVE-2025-31651](https://github.com/gregk4sec/CVE-2025-31651)


Question: How to: CVE-2025-31702 (2025-10-15)

Answer:
```
A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may cause tampering with admin password, leading to privilege escalation. Systems with only admin account are not affected.
```
- [itres-labs/CVE-2025-31702](https://github.com/itres-labs/CVE-2025-31702)


Question: How to: CVE-2025-31710 (2025-06-03)

Answer:
```
In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
```
- [Skorpion96/unisoc-su](https://github.com/Skorpion96/unisoc-su)


Question: How to: CVE-2025-31722 (2025-04-02)

Answer:
```
In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.
```
- [Nick6371/CVE-2025-31722](https://github.com/Nick6371/CVE-2025-31722)


Question: How to: CVE-2025-31864 (2025-04-01)

Answer:
```
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Out the Box Beam me up Scotty – Back to Top Button allows Stored XSS. This issue affects Beam me up Scotty – Back to Top Button: from n/a through 1.0.23.
```
- [DoTTak/CVE-2025-31864](https://github.com/DoTTak/CVE-2025-31864)


Question: How to: CVE-2025-31931 (2025-11-11)

Answer:
```
Uncontrolled search path for the Instrumentation and Tracing Technology API (ITT API) software before version 3.25.4 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
```
- [yohanes/POC-CVE-2025-31931](https://github.com/yohanes/POC-CVE-2025-31931)


Question: How to: CVE-2025-32013 (2025-04-06)

Answer:
```
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
```
- [Mohith-T/CVE-2025-32013](https://github.com/Mohith-T/CVE-2025-32013)


Question: How to: CVE-2025-32023 (2025-07-07)

Answer:
```
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
```
- [leesh3288/CVE-2025-32023](https://github.com/leesh3288/CVE-2025-32023)
- [Ashwesker/Ashwesker-CVE-2025-32023](https://github.com/Ashwesker/Ashwesker-CVE-2025-32023)
- [LordBheem/CVE-2025-32023](https://github.com/LordBheem/CVE-2025-32023)


Question: How to: CVE-2025-32094 (2025-08-07)

Answer:
```
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
```
- [perplext/echteeteepee](https://github.com/perplext/echteeteepee)


Question: How to: CVE-2025-32118 (2025-04-04)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance allows Using Malicious Files. This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.13.
```
- [Nxploited/CVE-2025-32118](https://github.com/Nxploited/CVE-2025-32118)


Question: How to: CVE-2025-32140 (2025-04-10)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail allows Upload a Web Shell to a Web Server. This issue affects WP Remote Thumbnail: from n/a through 1.3.1.
```
- [Nxploited/CVE-2025-32140](https://github.com/Nxploited/CVE-2025-32140)


Question: How to: CVE-2025-32206 (2025-04-10)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects allows Upload a Web Shell to a Web Server. This issue affects Processing Projects: from n/a through 1.0.2.
```
- [Nxploited/CVE-2025-32206](https://github.com/Nxploited/CVE-2025-32206)


Question: How to: CVE-2025-32259 (2025-04-10)

Answer:
```
Missing Authorization vulnerability in Alimir WP ULike. This issue affects WP ULike: from n/a through 4.7.9.1.
```
- [HossamEAhmed/wp-ulike-cve-2025-32259-poc](https://github.com/HossamEAhmed/wp-ulike-cve-2025-32259-poc)


Question: How to: CVE-2025-32375 (2025-04-09)

Answer:
```
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8.
```
- [theGEBIRGE/CVE-2025-32375](https://github.com/theGEBIRGE/CVE-2025-32375)