Question: How to: CVE-2025-32395 (2025-04-10)

Answer:
```
Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. For those requests with an invalid request-line (it includes request-target), the spec recommends to reject them with 400 or 301. The same can be said for HTTP 2. On Node and Bun, those requests are not rejected internally and is passed to the user land. For those requests, the value of http.IncomingMessage.url contains #. Vite assumed req.url won't contain # when checking server.fs.deny, allowing those kinds of requests to bypass the check. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) and running the Vite dev server on runtimes that are not Deno (e.g. Node, Bun) are affected. This vulnerability is fixed in 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13.
```
- [ruiwenya/CVE-2025-32395](https://github.com/ruiwenya/CVE-2025-32395)


Question: How to: CVE-2025-32407 (2025-05-16)

Answer:
```
Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attacker to impersonate any and all websites visited by the user. This is a critical misconfiguration in the way the browser validates the identity of the server. It negates the use of HTTPS as a secure channel, allowing for Man-in-the-Middle attacks, stealing sensitive information or modifying incoming and outgoing traffic. NOTE: This vulnerability is in an end-of-life product that is no longer maintained by the vendor.
```
- [diegovargasj/CVE-2025-32407](https://github.com/diegovargasj/CVE-2025-32407)


Question: How to: CVE-2025-32421 (2025-05-14)

Answer:
```
Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the platform does not cache responses based solely on `200 OK` status without explicit `cache-control` headers. Those who self-host Next.js deployments and are unable to upgrade immediately can mitigate this vulnerability by stripping the `x-now-route-matches` header from all incoming requests at the content development network and setting `cache-control: no-store` for all responses under risk. The maintainers of Next.js strongly recommend only caching responses with explicit cache-control headers.
```
- [Delfaster/CVE-2025-32421---Race-Condition-Vulnerability---Next.js](https://github.com/Delfaster/CVE-2025-32421---Race-Condition-Vulnerability---Next.js)


Question: How to: CVE-2025-32429 (2025-07-24)

Answer:
```
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.
```
- [byteReaper77/CVE-2025-32429](https://github.com/byteReaper77/CVE-2025-32429)
- [amir-othman/CVE-2025-32429](https://github.com/amir-othman/CVE-2025-32429)
- [imbas007/CVE-2025-32429-Checker](https://github.com/imbas007/CVE-2025-32429-Checker)


Question: How to: CVE-2025-32432 (2025-04-25)

Answer:
```
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This issue has been patched in versions 3.9.15, 4.14.15, and 5.6.17, and is an additional fix for CVE-2023-41892.
```
- [Chocapikk/CVE-2025-32432](https://github.com/Chocapikk/CVE-2025-32432)
- [Sachinart/CVE-2025-32432](https://github.com/Sachinart/CVE-2025-32432)
- [CTY-Research-1/CVE-2025-32432-PoC](https://github.com/CTY-Research-1/CVE-2025-32432-PoC)
- [Ashwesker/Ashwesker-CVE-2025-32432](https://github.com/Ashwesker/Ashwesker-CVE-2025-32432)
- [bambooqj/CVE-2025-32432](https://github.com/bambooqj/CVE-2025-32432)


Question: How to: CVE-2025-32433 (2025-04-16)

Answer:
```
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
```
- [platsecurity/CVE-2025-32433](https://github.com/platsecurity/CVE-2025-32433)
- [ekomsSavior/POC_CVE-2025-32433](https://github.com/ekomsSavior/POC_CVE-2025-32433)
- [Epivalent/CVE-2025-32433-detection](https://github.com/Epivalent/CVE-2025-32433-detection)
- [darses/CVE-2025-32433](https://github.com/darses/CVE-2025-32433)
- [LemieOne/CVE-2025-32433](https://github.com/LemieOne/CVE-2025-32433)
- [teamtopkarl/CVE-2025-32433](https://github.com/teamtopkarl/CVE-2025-32433)
- [m0usem0use/erl_mouse](https://github.com/m0usem0use/erl_mouse)
- [exa-offsec/ssh_erlangotp_rce](https://github.com/exa-offsec/ssh_erlangotp_rce)
- [omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC](https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC)
- [0xPThree/cve-2025-32433](https://github.com/0xPThree/cve-2025-32433)
- [meloppeitreet/CVE-2025-32433-Remote-Shell](https://github.com/meloppeitreet/CVE-2025-32433-Remote-Shell)
- [ps-interactive/lab_CVE-2025-32433](https://github.com/ps-interactive/lab_CVE-2025-32433)
- [0x7556/CVE-2025-32433](https://github.com/0x7556/CVE-2025-32433)
- [becrevex/CVE-2025-32433](https://github.com/becrevex/CVE-2025-32433)
- [MrDreamReal/CVE-2025-32433](https://github.com/MrDreamReal/CVE-2025-32433)
- [Know56/CVE-2025-32433](https://github.com/Know56/CVE-2025-32433)
- [abrewer251/CVE-2025-32433_Erlang-OTP_PoC](https://github.com/abrewer251/CVE-2025-32433_Erlang-OTP_PoC)
- [ODST-Forge/CVE-2025-32433_PoC](https://github.com/ODST-Forge/CVE-2025-32433_PoC)
- [C9b3rD3vi1/Erlang-OTP-SSH-CVE-2025-32433](https://github.com/C9b3rD3vi1/Erlang-OTP-SSH-CVE-2025-32433)
- [bilalz5-github/Erlang-OTP-SSH-CVE-2025-32433](https://github.com/bilalz5-github/Erlang-OTP-SSH-CVE-2025-32433)
- [vigilante-1337/CVE-2025-32433](https://github.com/vigilante-1337/CVE-2025-32433)
- [Ashwesker/Ashwesker-CVE-2025-32433](https://github.com/Ashwesker/Ashwesker-CVE-2025-32433)
- [Yuri08loveElaina/CVE-2025-32433-Erlang-OTP-SSH-Pre-Auth-RCE-exploit](https://github.com/Yuri08loveElaina/CVE-2025-32433-Erlang-OTP-SSH-Pre-Auth-RCE-exploit)
- [NiteeshPujari/CVE-2025-32433-PoC](https://github.com/NiteeshPujari/CVE-2025-32433-PoC)
- [te0rwx/CVE-2025-32433-Detection](https://github.com/te0rwx/CVE-2025-32433-Detection)
- [Mdusmandasthaheer/CVE-2025-32433](https://github.com/Mdusmandasthaheer/CVE-2025-32433)
- [dollarboysushil/CVE-2025-32433-Erlang-OTP-SSH-Unauthenticated-RCE](https://github.com/dollarboysushil/CVE-2025-32433-Erlang-OTP-SSH-Unauthenticated-RCE)
- [iteride/CVE-2025-32433](https://github.com/iteride/CVE-2025-32433)
- [mirmeweu/cve-2025-32433](https://github.com/mirmeweu/cve-2025-32433)
- [soltanali0/CVE-2025-32433-Eploit](https://github.com/soltanali0/CVE-2025-32433-Eploit)
- [giriaryan694-a11y/cve-2025-32433_rce_exploit](https://github.com/giriaryan694-a11y/cve-2025-32433_rce_exploit)
- [AntonieSoga/Erlang-OTP-PoC_CVE-2025-32433](https://github.com/AntonieSoga/Erlang-OTP-PoC_CVE-2025-32433)


Question: How to: CVE-2025-32434 (2025-04-18)

Answer:
```
PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue has been patched in version 2.6.0.
```
- [cyhe50/cve-2025-32434-poc](https://github.com/cyhe50/cve-2025-32434-poc)
- [B1tBit/CVE-2025-32434-exploit](https://github.com/B1tBit/CVE-2025-32434-exploit)


Question: How to: CVE-2025-32462 (2025-06-30)

Answer:
```
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
```
- [Hacksparo/CVE-2025-32462](https://github.com/Hacksparo/CVE-2025-32462)
- [CryingN/CVE-2025-32462](https://github.com/CryingN/CVE-2025-32462)
- [cybersentinelx1/CVE-2025-32462-Exploit](https://github.com/cybersentinelx1/CVE-2025-32462-Exploit)
- [mylovem313/CVE-2025-32462](https://github.com/mylovem313/CVE-2025-32462)
- [cyberpoul/CVE-2025-32462-POC](https://github.com/cyberpoul/CVE-2025-32462-POC)
- [SpongeBob-369/cve-2025-32462](https://github.com/SpongeBob-369/cve-2025-32462)
- [MAAYTHM/CVE-2025-32462_32463-Lab](https://github.com/MAAYTHM/CVE-2025-32462_32463-Lab)
- [toohau/CVE-2025-32462-32463-Detection-Script-](https://github.com/toohau/CVE-2025-32462-32463-Detection-Script-)
- [j3r1ch0123/CVE-2025-32462](https://github.com/j3r1ch0123/CVE-2025-32462)
- [OffSecPlaybook/CVE-2025-32462-](https://github.com/OffSecPlaybook/CVE-2025-32462-)
- [lakshan-sameera/CVE-2025-32462-and-CVE-2025-32463---Critical-Sudo-Vulnerabilities](https://github.com/lakshan-sameera/CVE-2025-32462-and-CVE-2025-32463---Critical-Sudo-Vulnerabilities)


Question: How to: CVE-2025-32463 (2025-06-30)

Answer:
```
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
```
- [pr0v3rbs/CVE-2025-32463_chwoot](https://github.com/pr0v3rbs/CVE-2025-32463_chwoot)
- [4f-kira/CVE-2025-32463](https://github.com/4f-kira/CVE-2025-32463)
- [K1tt3h/CVE-2025-32463-POC](https://github.com/K1tt3h/CVE-2025-32463-POC)
- [IC3-512/linux-root-kit](https://github.com/IC3-512/linux-root-kit)
- [7r00t/cve-2025-32463-lab](https://github.com/7r00t/cve-2025-32463-lab)
- [SysMancer/CVE-2025-32463](https://github.com/SysMancer/CVE-2025-32463)
- [kh4sh3i/CVE-2025-32463](https://github.com/kh4sh3i/CVE-2025-32463)
- [neko205-mx/CVE-2025-32463_Exploit](https://github.com/neko205-mx/CVE-2025-32463_Exploit)
- [pevinkumar10/CVE-2025-32463](https://github.com/pevinkumar10/CVE-2025-32463)
- [zhaduchanhzz/CVE-2025-32463_POC](https://github.com/zhaduchanhzz/CVE-2025-32463_POC)
- [robbert1978/CVE-2025-32463_POC](https://github.com/robbert1978/CVE-2025-32463_POC)
- [Mikivirus0/sudoinjection](https://github.com/Mikivirus0/sudoinjection)
- [nflatrea/CVE-2025-32463](https://github.com/nflatrea/CVE-2025-32463)
- [san8383/CVE-2025-32463](https://github.com/san8383/CVE-2025-32463)
- [0xAkarii/CVE-2025-32463](https://github.com/0xAkarii/CVE-2025-32463)
- [CIA911/sudo_patch_CVE-2025-32463](https://github.com/CIA911/sudo_patch_CVE-2025-32463)
- [mirchr/CVE-2025-32463-sudo-chwoot](https://github.com/mirchr/CVE-2025-32463-sudo-chwoot)
- [ill-deed/CVE-2025-32463_illdeed](https://github.com/ill-deed/CVE-2025-32463_illdeed)
- [zinzloun/CVE-2025-32463](https://github.com/zinzloun/CVE-2025-32463)
- [yeremeu/CVE-2025-32463_chwoot](https://github.com/yeremeu/CVE-2025-32463_chwoot)
- [cyberpoul/CVE-2025-32463-POC](https://github.com/cyberpoul/CVE-2025-32463-POC)
- [Ashwesker/Ashwesker-CVE-2025-32463](https://github.com/Ashwesker/Ashwesker-CVE-2025-32463)
- [junxian428/CVE-2025-32463](https://github.com/junxian428/CVE-2025-32463)
- [FreeDurok/CVE-2025-32463-PoC](https://github.com/FreeDurok/CVE-2025-32463-PoC)
- [Chocapikk/CVE-2025-32463-lab](https://github.com/Chocapikk/CVE-2025-32463-lab)
- [K3ysTr0K3R/CVE-2025-32463-EXPLOIT](https://github.com/K3ysTr0K3R/CVE-2025-32463-EXPLOIT)
- [SpongeBob-369/cve-2025-32463](https://github.com/SpongeBob-369/cve-2025-32463)
- [lowercasenumbers/CVE-2025-32463_sudo_chroot](https://github.com/lowercasenumbers/CVE-2025-32463_sudo_chroot)
- [abrewer251/CVE-2025-32463_Sudo_PoC](https://github.com/abrewer251/CVE-2025-32463_Sudo_PoC)
- [0xb0rn3/CVE-2025-32463-EXPLOIT](https://github.com/0xb0rn3/CVE-2025-32463-EXPLOIT)
- [morgenm/sudo-chroot-CVE-2025-32463](https://github.com/morgenm/sudo-chroot-CVE-2025-32463)
- [MohamedKarrab/CVE-2025-32463](https://github.com/MohamedKarrab/CVE-2025-32463)
- [dbarquero/cve-2025-32463-lab](https://github.com/dbarquero/cve-2025-32463-lab)
- [krypton-0x00/CVE-2025-32463-Chwoot-POC](https://github.com/krypton-0x00/CVE-2025-32463-Chwoot-POC)
- [Floodnut/CVE-2025-32463](https://github.com/Floodnut/CVE-2025-32463)
- [Rajneeshkarya/CVE-2025-32463](https://github.com/Rajneeshkarya/CVE-2025-32463)
- [MGunturG/CVE-2025-32463](https://github.com/MGunturG/CVE-2025-32463)
- [Maalfer/Sudo-CVE-2021-3156](https://github.com/Maalfer/Sudo-CVE-2021-3156)
- [daryllundy/CVE-2025-32463](https://github.com/daryllundy/CVE-2025-32463)
- [AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462](https://github.com/AdityaBhatt3010/Sudo-Privilege-Escalation-Linux-CVE-2025-32463-and-CVE-2025-32462)
- [ChetanKomal/sudo_exploit](https://github.com/ChetanKomal/sudo_exploit)
- [KaiHT-Ladiant/CVE-2025-32463](https://github.com/KaiHT-Ladiant/CVE-2025-32463)
- [y4ney/CVE-2025-32463-lab](https://github.com/y4ney/CVE-2025-32463-lab)
- [aldoClau98/CVE-2025-32463](https://github.com/aldoClau98/CVE-2025-32463)
- [painoob/CVE-2025-32463](https://github.com/painoob/CVE-2025-32463)
- [Nowafen/CVE-2025-32463](https://github.com/Nowafen/CVE-2025-32463)
- [Yuy0ung/CVE-2025-32463_chwoot](https://github.com/Yuy0ung/CVE-2025-32463_chwoot)
- [hacieda/CVE-2025-32463](https://github.com/hacieda/CVE-2025-32463)
- [blackcat4347/CVE-2025-32463_PoC](https://github.com/blackcat4347/CVE-2025-32463_PoC)
- [ashardev002/CVE-2025-32463_chwoot](https://github.com/ashardev002/CVE-2025-32463_chwoot)
- [mihnasdsad/CVE-2025-32463](https://github.com/mihnasdsad/CVE-2025-32463)
- [D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape](https://github.com/D3ltaFormation/CVE-2025-32463-Sudo-Chroot-Escape)
- [AC8999/CVE-2025-32463](https://github.com/AC8999/CVE-2025-32463)
- [dr4xp/sudo-chroot](https://github.com/dr4xp/sudo-chroot)
- [ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation](https://github.com/ankitpandey383/CVE-2025-32463-Sudo-Privilege-Escalation)
- [justjoeyking/CVE-2025-32463](https://github.com/justjoeyking/CVE-2025-32463)
- [Mr-Alperen/CVE-2025-32463](https://github.com/Mr-Alperen/CVE-2025-32463)
- [aexdyhaxor/CVE-2025-32463](https://git


Question: How to: CVE-2025-32579 (2025-04-11)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts allows Upload a Web Shell to a Web Server. This issue affects Sync Posts: from n/a through 1.0.
```
- [Nxploited/CVE-2025-32579](https://github.com/Nxploited/CVE-2025-32579)


Question: How to: CVE-2025-32583 (2025-04-17)

Answer:
```
Improper Control of Generation of Code ('Code Injection') vulnerability in termel PDF 2 Post allows Remote Code Inclusion. This issue affects PDF 2 Post: from n/a through 2.4.0.
```
- [Nxploited/CVE-2025-32583](https://github.com/Nxploited/CVE-2025-32583)
- [GadaLuBau1337/CVE-2025-32583](https://github.com/GadaLuBau1337/CVE-2025-32583)


Question: How to: CVE-2025-32641 (2025-04-09)

Answer:
```
Cross-Site Request Forgery (CSRF) vulnerability in anantaddons Anant Addons for Elementor allows Cross Site Request Forgery. This issue affects Anant Addons for Elementor: from n/a through 1.1.5.
```
- [Nxploited/CVE-2025-32641](https://github.com/Nxploited/CVE-2025-32641)


Question: How to: CVE-2025-32682 (2025-04-17)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG Lite allows Upload a Web Shell to a Web Server. This issue affects MapSVG Lite: from n/a through 8.5.34.
```
- [Nxploited/CVE-2025-32682](https://github.com/Nxploited/CVE-2025-32682)


Question: How to: CVE-2025-32709 (2025-05-13)

Answer:
```
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
```
- [AdnanSiyat/How-to-Patch-CVE-2025-32709](https://github.com/AdnanSiyat/How-to-Patch-CVE-2025-32709)


Question: How to: CVE-2025-32710 (2025-06-10)

Answer:
```
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
```
- [Sincan2/RCE-CVE-2025-32710](https://github.com/Sincan2/RCE-CVE-2025-32710)


Question: How to: CVE-2025-32711 (2025-06-11)

Answer:
```
Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
```
- [daryllundy/cve-2025-32711](https://github.com/daryllundy/cve-2025-32711)


Question: How to: CVE-2025-32756 (2025-05-13)

Answer:
```
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.7, FortiNDR 7.2.0 through 7.2.4, FortiNDR 7.0.0 through 7.0.6, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0.0 through 7.0.5, FortiRecorder 6.4.0 through 6.4.5, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6, FortiVoice 6.4.0 through 6.4.10 allows a remote unauthenticated attacker to execute arbitrary code or commands via sending HTTP requests with specially crafted hash cookie.
```
- [exfil0/CVE-2025-32756-POC](https://github.com/exfil0/CVE-2025-32756-POC)
- [kn0x0x/CVE-2025-32756-POC](https://github.com/kn0x0x/CVE-2025-32756-POC)
- [Ashwesker/Ashwesker-CVE-2025-32756](https://github.com/Ashwesker/Ashwesker-CVE-2025-32756)
- [alm6no5/CVE-2025-32756-POC](https://github.com/alm6no5/CVE-2025-32756-POC)
- [becrevex/CVE-2025-32756](https://github.com/becrevex/CVE-2025-32756)
- [shan0ar/cve-2025-32756](https://github.com/shan0ar/cve-2025-32756)


Question: How to: CVE-2025-32778 (2025-04-15)

Answer:
```
Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project (Lissy93/web-check). The issue stems from user-controlled input (url) being passed unsanitized into a shell command using exec(), allowing attackers to execute arbitrary system commands on the underlying host. This could be exploited by sending crafted url parameters to extract files or even establish remote access. The vulnerability has been patched by replacing exec() with execFile(), which avoids using a shell and properly isolates arguments.
```
- [00xCanelo/CVE-2025-32778](https://github.com/00xCanelo/CVE-2025-32778)


Question: How to: CVE-2025-32873 (2025-05-08)

Answer:
```
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
```
- [Apollo-R3bot/django-vulnerability-CVE-2025-32873](https://github.com/Apollo-R3bot/django-vulnerability-CVE-2025-32873)


Question: How to: CVE-2025-32965 (2025-04-22)

Answer:
```
xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch. To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key.
```
- [yusufdalbudak/CVE-2025-32965-xrpl-js-poc](https://github.com/yusufdalbudak/CVE-2025-32965-xrpl-js-poc)


Question: How to: CVE-2025-33053 (2025-06-10)

Answer:
```
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
```
- [DevBuiHieu/CVE-2025-33053-Proof-Of-Concept](https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept)
- [TheTorjanCaptain/CVE-2025-33053-Checker-PoC](https://github.com/TheTorjanCaptain/CVE-2025-33053-Checker-PoC)
- [kra1t0/CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept](https://github.com/kra1t0/CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept)
- [4n4s4zi/CVE-2025-33053_PoC](https://github.com/4n4s4zi/CVE-2025-33053_PoC)
- [Cyberw1ng/CVE-2025-33053-POC](https://github.com/Cyberw1ng/CVE-2025-33053-POC)


Question: How to: CVE-2025-33073 (2025-06-10)

Answer:
```
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
```
- [sleepasleepzzz/CVE-2025-33073](https://github.com/sleepasleepzzz/CVE-2025-33073)
- [mverschu/CVE-2025-33073](https://github.com/mverschu/CVE-2025-33073)
- [obscura-cert/CVE-2025-33073](https://github.com/obscura-cert/CVE-2025-33073)
- [matejsmycka/CVE-2025-33073-checker](https://github.com/matejsmycka/CVE-2025-33073-checker)
- [cve-2025-33073/cve-2025-33073](https://github.com/cve-2025-33073/cve-2025-33073)
- [uziii2208/CVE-2025-33073](https://github.com/uziii2208/CVE-2025-33073)
- [Ashwesker/Ashwesker-CVE-2025-33073](https://github.com/Ashwesker/Ashwesker-CVE-2025-33073)
- [Iddygodwin/CVE-2025-33073](https://github.com/Iddygodwin/CVE-2025-33073)


Question: How to: CVE-2025-34028 (2025-04-22)

Answer:
```
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.\n\n\n\n\n\nThis issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.
```
- [watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028](https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028)
- [tinkerlev/commvault-cve2025-34028-check](https://github.com/tinkerlev/commvault-cve2025-34028-check)
- [becrevex/Commvault-CVE-2025-34028](https://github.com/becrevex/Commvault-CVE-2025-34028)
- [Mattb709/CVE-2025-34028-PoC-Commvault-RCE](https://github.com/Mattb709/CVE-2025-34028-PoC-Commvault-RCE)


Question: How to: CVE-2025-34030 (2025-06-20)

Answer:
```
An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to the plot parameter (e.g., ?plot=;id) in a crafted GET request. The output of the command is displayed in the application's interface after interacting with the host selection UI. Successful exploitation leads to arbitrary command execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC.
```
- [HackerTyperAbuser/CVE-2025-34030-PoC](https://github.com/HackerTyperAbuser/CVE-2025-34030-PoC)


Question: How to: CVE-2025-34036 (2025-06-24)

Answer:
```
An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When the server processes a request to /language/[lang]/index.html, it uses the [lang] input unsafely in a tar extraction command without proper escaping. This allows an unauthenticated remote attacker to inject shell commands and achieve arbitrary command execution as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
```
- [Prabhukiran161/cve-2025-34036](https://github.com/Prabhukiran161/cve-2025-34036)


Question: How to: CVE-2025-34040 (2025-06-24)

Answer:
```
An arbitrary file upload vulnerability exists in the Zhiyuan OA platform via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-01 UTC.
```
- [jisi-001/CVE-2025-34040Exp](https://github.com/jisi-001/CVE-2025-34040Exp)


Question: How to: CVE-2025-34077 (2025-07-09)

Answer:
```
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
```
- [MrjHaxcore/CVE-2025-34077](https://github.com/MrjHaxcore/CVE-2025-34077)
- [0xgh057r3c0n/CVE-2025-34077](https://github.com/0xgh057r3c0n/CVE-2025-34077)


Question: How to: CVE-2025-34085

Answer:
- [MrjHaxcore/CVE-2025-34085](https://github.com/MrjHaxcore/CVE-2025-34085)
- [ill-deed/CVE-2025-34085-Multi-target](https://github.com/ill-deed/CVE-2025-34085-Multi-target)
- [0xgh057r3c0n/CVE-2025-34085](https://github.com/0xgh057r3c0n/CVE-2025-34085)
- [yukinime/CVE-2025-34085](https://github.com/yukinime/CVE-2025-34085)
- [Ashwesker/Ashwesker-CVE-2025-34085](https://github.com/Ashwesker/Ashwesker-CVE-2025-34085)


Question: How to: CVE-2025-34100 (2025-07-10)

Answer:
```
An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload operations, allowing an attacker to upload a malicious .php file and subsequently execute arbitrary PHP code on the server under the context of the web server process. While the root vulnerability lies within the jQuery File Upload component, BuilderEngine’s improper integration and lack of access controls expose this functionality to unauthenticated users, resulting in full remote code execution.
```
- [RyanJohnJames/CVE-2025-34100-demo](https://github.com/RyanJohnJames/CVE-2025-34100-demo)
- [hyeonyeonglee/CVE-2025-34100](https://github.com/hyeonyeonglee/CVE-2025-34100)


Question: How to: CVE-2025-34152 (2025-08-07)

Answer:
```
An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.
```
- [Chocapikk/CVE-2025-34152](https://github.com/Chocapikk/CVE-2025-34152)
- [kh4sh3i/CVE-2025-34152](https://github.com/kh4sh3i/CVE-2025-34152)


Question: How to: CVE-2025-34157 (2025-08-27)

Answer:
```
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.
```
- [Eyodav/CVE-2025-34157](https://github.com/Eyodav/CVE-2025-34157)


Question: How to: CVE-2025-34159 (2025-08-27)

Answer:
```
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.
```
- [Eyodav/CVE-2025-34159](https://github.com/Eyodav/CVE-2025-34159)


Question: How to: CVE-2025-34161 (2025-08-27)

Answer:
```
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.
```
- [Eyodav/CVE-2025-34161](https://github.com/Eyodav/CVE-2025-34161)


Question: How to: CVE-2025-34171 (2026-01-03)

Answer:
```
CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path parameter to access files under /var/lib/casaos/1/, which reveals installed applications and configuration details. Additionally, /v1/sys/debug discloses host operating system, kernel, hardware, and storage information. The endpoints also return distinct error messages, enabling file existence enumeration of arbitrary paths on the underlying host filesystem. This information disclosure can be used for reconnaissance and to facilitate targeted follow-up attacks against services deployed on the host.
```
- [Eyodav/CVE-2025-34171](https://github.com/Eyodav/CVE-2025-34171)


Question: How to: CVE-2025-34226 (2025-10-03)

Answer:
```
OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate until a restart; on restart the runtime can fail to start because of corrupted database entries, resulting in persistent denial of service requiring complete rebase of the product to recover. This vulnerability was remediated by commit 095ee09.
```
- [Eyodav/CVE-2025-34226](https://github.com/Eyodav/CVE-2025-34226)


Question: How to: CVE-2025-34227 (2025-09-25)

Answer:
```
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
```
- [mcorybillington/CVE-2025-34227_Nagios-XI-Command-Injection-Configuration-Wizard](https://github.com/mcorybillington/CVE-2025-34227_Nagios-XI-Command-Injection-Configuration-Wizard)


Question: How to: CVE-2025-34299 (2025-11-07)

Answer:
```
Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. This flaw enables attackers to execute arbitrary code by uploading a specially crafted file from a malicious (S)FTP server.
```
- [Ashwesker/Ashwesker-CVE-2025-34299](https://github.com/Ashwesker/Ashwesker-CVE-2025-34299)
- [Chocapikk/CVE-2025-34299](https://github.com/Chocapikk/CVE-2025-34299)
- [KrE80r/CVE-2025-34299-lab](https://github.com/KrE80r/CVE-2025-34299-lab)


Question: How to: CVE-2025-34300 (2025-07-16)

Answer:
```
A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the  ciwweb.pl http://ciwweb.pl/  Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.
```
- [jisi-001/CVE-2025-34300POC](https://github.com/jisi-001/CVE-2025-34300POC)


Question: How to: CVE-2025-34322 (2025-11-17)

Answer:
```
Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the global configuration and concatenated into a shell command that is executed via shell_exec() without proper input handling or command-line argument sanitation. An authenticated user with access to the 'Global Settings' page can supply crafted values in these fields to inject additional shell commands, resulting in arbitrary command execution as the 'www-data' user and compromise of the Log Server host.
```
- [mcorybillington/CVE-2025-34322_CVE-2025-34323_Nagios_Log_Server](https://github.com/mcorybillington/CVE-2025-34322_CVE-2025-34323_Nagios_Log_Server)


Question: How to: CVE-2025-34462

Answer: - [NSM-Barii/CVE-2025-34462](https://github.com/NSM-Barii/CVE-2025-34462)


Question: How to: CVE-2025-36041 (2025-06-15)

Answer:
```
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose sensitive information or allow the attacker to perform unauthorized actions.
```
- [byteReaper77/CVE-2025-36041](https://github.com/byteReaper77/CVE-2025-36041)


Question: How to: CVE-2025-36250 (2025-11-13)

Answer:
```
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls.  This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346.
```
- [Ashwesker/Ashwesker-CVE-2025-36250](https://github.com/Ashwesker/Ashwesker-CVE-2025-36250)


Question: How to: CVE-2025-36604 (2025-08-04)

Answer:
```
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
```
- [watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604](https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604)


Question: How to: CVE-2025-36911 (2026-01-15)

Answer:
```
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
```
- [Cedric-Martz/CVE-2025-36911_scan](https://github.com/Cedric-Martz/CVE-2025-36911_scan)
- [zalexdev/whisper-pair-app](https://github.com/zalexdev/whisper-pair-app)


Question: How to: CVE-2025-37164 (2025-12-16)

Answer:
```
A remote code execution issue exists in HPE OneView.
```
- [rxerium/CVE-2025-37164](https://github.com/rxerium/CVE-2025-37164)
- [g0vguy/CVE-2025-37164-PoC](https://github.com/g0vguy/CVE-2025-37164-PoC)
- [LACHHAB-Anas/Exploit_CVE-2025-37164](https://github.com/LACHHAB-Anas/Exploit_CVE-2025-37164)


Question: How to: CVE-2025-37899 (2025-05-20)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in session logoff\n\nThe sess->user object can currently be in use by another thread, for\nexample if another connection has sent a session setup request to\nbind to the session being free'd. The handler for that connection could\nbe in the smb2_sess_setup function which makes use of sess->user.
```
- [SeanHeelan/o3_finds_cve-2025-37899](https://github.com/SeanHeelan/o3_finds_cve-2025-37899)
- [vett3x/SMB-LINUX-CVE-2025-37899](https://github.com/vett3x/SMB-LINUX-CVE-2025-37899)


Question: How to: CVE-2025-38001 (2025-06-06)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: hfsc: Address reentrant enqueue adding class to eltree twice\n\nSavino says:\n    "We are writing to report that this recent patch\n    (141d34391abbb315d68556b7c67ad97885407547) [1]\n    can be bypassed, and a UAF can still occur when HFSC is utilized with\n    NETEM.\n\n    The patch only checks the cl->cl_nactive field to determine whether\n    it is the first insertion or not [2], but this field is only\n    incremented by init_vf [3].\n\n    By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the\n    check and insert the class twice in the eltree.\n    Under normal conditions, this would lead to an infinite loop in\n    hfsc_dequeue for the reasons we already explained in this report [5].\n\n    However, if TBF is added as root qdisc and it is configured with a\n    very low rate,\n    it can be utilized to prevent packets from being dequeued.\n    This behavior can be exploited to perform subsequent insertions in the\n    HFSC eltree and cause a UAF."\n\nTo fix both the UAF and the infinite loop, with netem as an hfsc child,\ncheck explicitly in hfsc_enqueue whether the class is already in the eltree\nwhenever the HFSC_RSC flag is set.\n\n[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547\n[2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572\n[3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677\n[4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574\n[5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u
```
- [0xdevil/CVE-2025-38001](https://github.com/0xdevil/CVE-2025-38001)
- [khoatran107/cve-2025-38001](https://github.com/khoatran107/cve-2025-38001)
- [boeseejykbtanke348/CVE-2025-38001](https://github.com/boeseejykbtanke348/CVE-2025-38001)


Question: How to: CVE-2025-38089 (2025-06-30)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: handle SVC_GARBAGE during svc auth processing as auth error\n\ntianshuo han reported a remotely-triggerable crash if the client sends a\nkernel RPC server a specially crafted packet. If decoding the RPC reply\nfails in such a way that SVC_GARBAGE is returned without setting the\nrq_accept_statp pointer, then that pointer can be dereferenced and a\nvalue stored there.\n\nIf it's the first time the thread has processed an RPC, then that\npointer will be set to NULL and the kernel will crash. In other cases,\nit could create a memory scribble.\n\nThe server sunrpc code treats a SVC_GARBAGE return from svc_authenticate\nor pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531\nsays that if authentication fails that the RPC should be rejected\ninstead with a status of AUTH_ERR.\n\nHandle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of\nAUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This\nsidesteps the whole problem of touching the rpc_accept_statp pointer in\nthis situation and avoids the crash.
```
- [keymaker-arch/NFSundown](https://github.com/keymaker-arch/NFSundown)


Question: How to: CVE-2025-38352 (2025-07-22)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()\n\nIf an exiting non-autoreaping task has already passed exit_notify() and\ncalls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent\nor debugger right after unlock_task_sighand().\n\nIf a concurrent posix_cpu_timer_del() runs at that moment, it won't be\nable to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or\nlock_task_sighand() will fail.\n\nAdd the tsk->exit_state check into run_posix_cpu_timers() to fix this.\n\nThis fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because\nexit_task_work() is called before exit_notify(). But the check still\nmakes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail\nanyway in this case.
```
- [farazsth98/poc-CVE-2025-38352](https://github.com/farazsth98/poc-CVE-2025-38352)
- [farazsth98/chronomaly](https://github.com/farazsth98/chronomaly)
- [Crime2/poc-CVE-2025-38352](https://github.com/Crime2/poc-CVE-2025-38352)


Question: How to: CVE-2025-38501 (2025-08-16)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: limit repeated connections from clients with the same IP\n\nRepeated connections from clients with the same IP address may exhaust\nthe max connections and prevent other normal client connections.\nThis patch limit repeated connections from clients with the same IP.
```
- [keymaker-arch/KSMBDrain](https://github.com/keymaker-arch/KSMBDrain)


Question: How to: CVE-2025-38676 (2025-08-26)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Avoid stack buffer overflow from kernel cmdline\n\nWhile the kernel command line is considered trusted in most environments,\navoid writing 1 byte past the end of "acpiid" if the "str" argument is\nmaximum length.
```
- [14mb1v45h/CVE-2025-38676](https://github.com/14mb1v45h/CVE-2025-38676)


Question: How to: CVE-2025-38678 (2025-09-03)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject duplicate device on updates\n\nA chain/flowtable update with duplicated devices in the same batch is\npossible. Unfortunately, netdev event path only removes the first\ndevice that is found, leaving unregistered the hook of the duplicated\ndevice.\n\nCheck if a duplicated device exists in the transaction batch, bail out\nwith EEXIST in such case.\n\nWARNING is hit when unregistering the hook:\n\n [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150\n [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S                  6.16.0+ #170 PREEMPT(full)\n [...]\n [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150
```
- [guard-wait/CVE-2025-38678_POC](https://github.com/guard-wait/CVE-2025-38678_POC)


Question: How to: CVE-2025-39401 (2025-05-19)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through 44.0 (17-08-2023).
```
- [Nxploited/CVE-2025-39401](https://github.com/Nxploited/CVE-2025-39401)


Question: How to: CVE-2025-39436 (2025-04-17)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw allows Using Malicious Files. This issue affects I Draw: from n/a through 1.0.
```
- [Nxploited/CVE-2025-39436](https://github.com/Nxploited/CVE-2025-39436)


Question: How to: CVE-2025-39507 (2025-05-16)

Answer:
```
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core allows PHP Local File Inclusion. This issue affects Nasa Core: from n/a through 6.3.2.
```
- [TheCyberFairy/cve-lfi-lab](https://github.com/TheCyberFairy/cve-lfi-lab)


Question: How to: CVE-2025-39538 (2025-04-16)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search allows Upload a Web Shell to a Web Server. This issue affects WP-Advanced-Search: from n/a through 3.3.9.3.
```
- [Nxploited/CVE-2025-39538](https://github.com/Nxploited/CVE-2025-39538)


Question: How to: CVE-2025-39596 (2025-04-17)

Answer:
```
Weak Authentication vulnerability in Quentn.com GmbH Quentn WP allows Privilege Escalation. This issue affects Quentn WP: from n/a through 1.2.8.
```
- [Nxploited/CVE-2025-39596](https://github.com/Nxploited/CVE-2025-39596)


Question: How to: CVE-2025-39601 (2025-04-16)

Answer:
```
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP allows Remote Code Inclusion. This issue affects Custom CSS, JS & PHP: from n/a through 2.4.1.
```
- [Nxploited/CVE-2025-39601](https://github.com/Nxploited/CVE-2025-39601)


Question: How to: CVE-2025-39866 (2025-09-19)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\nfs: writeback: fix use-after-free in __mark_inode_dirty()\n\nAn use-after-free issue occurred when __mark_inode_dirty() get the\nbdi_writeback that was in the progress of switching.\n\nCPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1\n......\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : __mark_inode_dirty+0x124/0x418\nlr : __mark_inode_dirty+0x118/0x418\nsp : ffffffc08c9dbbc0\n........\nCall trace:\n __mark_inode_dirty+0x124/0x418\n generic_update_time+0x4c/0x60\n file_modified+0xcc/0xd0\n ext4_buffered_write_iter+0x58/0x124\n ext4_file_write_iter+0x54/0x704\n vfs_write+0x1c0/0x308\n ksys_write+0x74/0x10c\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x114\n el0_svc_common.constprop.0+0xc0/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x40/0xe4\n el0t_64_sync_handler+0x120/0x12c\n el0t_64_sync+0x194/0x198\n\nRoot cause is:\n\nsystemd-random-seed                         kworker\n----------------------------------------------------------------------\n___mark_inode_dirty                     inode_switch_wbs_work_fn\n\n  spin_lock(&inode->i_lock);\n  inode_attach_wb\n  locked_inode_to_wb_and_lock_list\n     get inode->i_wb\n     spin_unlock(&inode->i_lock);\n     spin_lock(&wb->list_lock)\n  spin_lock(&inode->i_lock)\n  inode_io_list_move_locked\n  spin_unlock(&wb->list_lock)\n  spin_unlock(&inode->i_lock)\n                                    spin_lock(&old_wb->list_lock)\n                                      inode_do_switch_wbs\n                                        spin_lock(&inode->i_lock)\n                                        inode->i_wb = new_wb\n                                        spin_unlock(&inode->i_lock)\n                                    spin_unlock(&old_wb->list_lock)\n                                    wb_put_many(old_wb, nr_switched)\n                                      cgwb_release\n                                      old wb released\n  wb_wakeup_delayed() accesses wb,\n  then trigger the use-after-free\n  issue\n\nFix this race condition by holding inode spinlock until\nwb_wakeup_delayed() finished.
```
- [byteReaper77/CVE-2025-39866](https://github.com/byteReaper77/CVE-2025-39866)


Question: How to: CVE-2025-39964 (2025-10-13)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.
```
- [n1k0oowang/CVE-2025-39964_EXP](https://github.com/n1k0oowang/CVE-2025-39964_EXP)


Question: How to: CVE-2025-40019 (2025-10-24)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: essiv - Check ssize for decryption and in-place encryption\n\nMove the ssize check to the start in essiv_aead_crypt so that\nit's also checked for decryption and in-place encryption.
```
- [guard-wait/CVE-2025-40019_POC](https://github.com/guard-wait/CVE-2025-40019_POC)
- [xooxo/CVE-2025-40019-Essiv](https://github.com/xooxo/CVE-2025-40019-Essiv)
- [0xAtharv/CVE-2025-40019-POC](https://github.com/0xAtharv/CVE-2025-40019-POC)


Question: How to: CVE-2025-40040 (2025-10-28)

Answer:
```
In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ksm: fix flag-dropping behavior in ksm_madvise\n\nsyzkaller discovered the following crash: (kernel BUG)\n\n[   44.607039] ------------[ cut here ]------------\n[   44.607422] kernel BUG at mm/userfaultfd.c:2067!\n[   44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)\n[   44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460\n\n<snip other registers, drop unreliable trace>\n\n[   44.617726] Call Trace:\n[   44.617926]  <TASK>\n[   44.619284]  userfaultfd_release+0xef/0x1b0\n[   44.620976]  __fput+0x3f9/0xb60\n[   44.621240]  fput_close_sync+0x110/0x210\n[   44.622222]  __x64_sys_close+0x8f/0x120\n[   44.622530]  do_syscall_64+0x5b/0x2f0\n[   44.622840]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   44.623244] RIP: 0033:0x7f365bb3f227\n\nKernel panics because it detects UFFD inconsistency during\nuserfaultfd_release_all().  Specifically, a VMA which has a valid pointer\nto vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.\n\nThe inconsistency is caused in ksm_madvise(): when user calls madvise()\nwith MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,\nit accidentally clears all flags stored in the upper 32 bits of\nvma->vm_flags.\n\nAssuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and\nint are 32-bit wide.  This setup causes the following mishap during the &=\n~VM_MERGEABLE assignment.\n\nVM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000. \nAfter ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then\npromoted to unsigned long before the & operation.  This promotion fills\nupper 32 bits with leading 0s, as we're doing unsigned conversion (and\neven for a signed conversion, this wouldn't help as the leading bit is 0).\n& operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff\ninstead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears\nthe upper 32-bits of its value.\n\nFix it by changing `VM_MERGEABLE` constant to unsigned long, using the\nBIT() macro.\n\nNote: other VM_* flags are not affected: This only happens to the\nVM_MERGEABLE flag, as the other VM_* flags are all constants of type int\nand after ~ operation, they end up with leading 1 and are thus converted\nto unsigned long with leading 1s.\n\nNote 2:\nAfter commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is\nno longer a kernel BUG, but a WARNING at the same place:\n\n[   45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067\n\nbut the root-cause (flag-drop) remains the same.\n\n[akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel]
```
- [SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882](https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882)


Question: How to: CVE-2025-40547 (2025-11-18)

Answer:
```
A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. \n\nThis issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
```
- [Ashwesker/Ashwesker-CVE-2025-40547](https://github.com/Ashwesker/Ashwesker-CVE-2025-40547)


Question: How to: CVE-2025-40602 (2025-12-18)

Answer:
```
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).
```
- [rxerium/CVE-2025-40602](https://github.com/rxerium/CVE-2025-40602)
- [cyberleelawat/CVE-2025-40602](https://github.com/cyberleelawat/CVE-2025-40602)


Question: How to: CVE-2025-40629 (2025-05-16)

Answer:
```
PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory.
```
- [omr00t/CVE-2025-40629](https://github.com/omr00t/CVE-2025-40629)


Question: How to: CVE-2025-40634 (2025-05-20)

Answer:
```
Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 router, in firmware versions prior to 1.0.15 build 241203 rel61480. This vulnerability allows an attacker to execute arbitrary code on the device over LAN and WAN networks.
```
- [hacefresko/CVE-2025-40634](https://github.com/hacefresko/CVE-2025-40634)


Question: How to: CVE-2025-40677 (2025-09-18)

Answer:
```
SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.
```
- [PeterGabaldon/CVE-2025-40677](https://github.com/PeterGabaldon/CVE-2025-40677)


Question: How to: CVE-2025-40766 (2025-08-12)

Answer:
```
A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers without adequate resource and security limitations. This could allow an attacker to perform a denial-of-service (DoS) attack.
```
- [FurkanKAYAPINAR/ecs_checker](https://github.com/FurkanKAYAPINAR/ecs_checker)


Question: How to: CVE-2025-40775 (2025-05-21)

Answer:
```
When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it.  If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.
```
- [AlexSvobo/nhi-zero-trust-bypass](https://github.com/AlexSvobo/nhi-zero-trust-bypass)


Question: How to: CVE-2025-41067 (2025-10-27)

Answer:
```
Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders the discovery service unavailable.
```
- [xvk1t1/Open5GS-CVE-2025-41067-CVE-2025-41068-PoC](https://github.com/xvk1t1/Open5GS-CVE-2025-41067-CVE-2025-41068-PoC)


Question: How to: CVE-2025-41088 (2025-10-10)

Answer:
```
Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. To exploit the vulnerability, the attacker must create a template in the 'Templates' section, then add a text element in the 'Global Elements' section, and finally modify the 'Text' field in the section with the malicious payload.
```
- [Marinafabregat/CVE-2025-41088](https://github.com/Marinafabregat/CVE-2025-41088)


Question: How to: CVE-2025-41090 (2025-10-28)

Answer:
```
microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability.\n\nThis flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a compromised endpoint or deduced manually.\n\nThis vulnerability allows access between tenants, enabling an attacker to list and manage remote assets, uninstall agents, and even delete vaccines configurations.
```
- [TheMalwareGuardian/brokeCLAUDIA](https://github.com/TheMalwareGuardian/brokeCLAUDIA)


Question: How to: CVE-2025-41115 (2025-11-21)

Answer:
```
SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management.\n\nIn Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override internal user IDs and lead to impersonation or privilege escalation.\n\nThis vulnerability applies only if all of the following conditions are met:\n- `enableSCIM` feature flag set to true\n- `user_sync_enabled` config option in the `[auth.scim]` block set to true
```
- [Ashwesker/Ashwesker-CVE-2025-41115](https://github.com/Ashwesker/Ashwesker-CVE-2025-41115)
- [I3r1h0n/GrafanaSCIMalform](https://github.com/I3r1h0n/GrafanaSCIMalform)


Question: How to: CVE-2025-41244 (2025-09-29)

Answer:
```
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
```
- [rxerium/CVE-2025-41244](https://github.com/rxerium/CVE-2025-41244)
- [NULL200OK/CVE-2025-41244](https://github.com/NULL200OK/CVE-2025-41244)


Question: How to: CVE-2025-41373 (2025-08-01)

Answer:
```
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.
```
- [byteReaper77/CVE-2025-41373](https://github.com/byteReaper77/CVE-2025-41373)


Question: How to: CVE-2025-41646 (2025-06-06)

Answer:
```
An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device
```
- [GreenForceNetworks/CVE-2025-41646---Critical-Authentication-Bypass-](https://github.com/GreenForceNetworks/CVE-2025-41646---Critical-Authentication-Bypass-)
- [r0otk3r/CVE-2025-41646](https://github.com/r0otk3r/CVE-2025-41646)


Question: How to: CVE-2025-41656 (2025-07-01)

Answer:
```
An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.
```
- [wallyschag/CVE-2025-41656](https://github.com/wallyschag/CVE-2025-41656)


Question: How to: CVE-2025-42944 (2025-09-09)

Answer:
```
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability.
```
- [rxerium/CVE-2025-42944](https://github.com/rxerium/CVE-2025-42944)


Question: How to: CVE-2025-42957 (2025-08-12)

Answer:
```
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
```
- [mrk336/CVE-2025-42957-SAP-S-4HANA-Under-Siege](https://github.com/mrk336/CVE-2025-42957-SAP-S-4HANA-Under-Siege)


Question: How to: CVE-2025-43300 (2025-08-21)

Answer:
```
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12. Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
```
- [XiaomingX/CVE-2025-43300-exp](https://github.com/XiaomingX/CVE-2025-43300-exp)
- [hunters-sec/CVE-2025-43300](https://github.com/hunters-sec/CVE-2025-43300)
- [PwnToday/CVE-2025-43300](https://github.com/PwnToday/CVE-2025-43300)
- [veniversum/cve-2025-43300](https://github.com/veniversum/cve-2025-43300)
- [ticofookfook/CVE-2025-43300](https://github.com/ticofookfook/CVE-2025-43300)
- [Dark-life944/CVE-2025](https://github.com/Dark-life944/CVE-2025)
- [7amzahard/CVE-2025-43300](https://github.com/7amzahard/CVE-2025-43300)


Question: How to: CVE-2025-43400 (2025-09-29)

Answer:
```
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in watchOS 26.1, tvOS 26.1. Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory.
```
- [csrXamfi/CVE-2025-43400](https://github.com/csrXamfi/CVE-2025-43400)


Question: How to: CVE-2025-43426 (2025-11-04)

Answer:
```
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1. An app may be able to access sensitive user data.
```
- [csrXamfi/CVE-2025-43426](https://github.com/csrXamfi/CVE-2025-43426)


Question: How to: CVE-2025-43504 (2025-11-04)

Answer:
```
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.
```
- [calysteon/CVE-2025-43504](https://github.com/calysteon/CVE-2025-43504)


Question: How to: CVE-2025-43529 (2025-12-17)

Answer:
```
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 26.2, Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, tvOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
```
- [zeroxjf/CVE-2025-43529-analysis](https://github.com/zeroxjf/CVE-2025-43529-analysis)
- [jir4vv1t/CVE-2025-43529](https://github.com/jir4vv1t/CVE-2025-43529)
- [zeroxjf/WebKit-UAF-ANGLE-OOB-Analysis](https://github.com/zeroxjf/WebKit-UAF-ANGLE-OOB-Analysis)


Question: How to: CVE-2025-43541 (2025-12-17)

Answer:
```
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
```
- [crypt0bit/CVE-2025-43541](https://github.com/crypt0bit/CVE-2025-43541)


Question: How to: CVE-2025-43864 (2025-04-25)

Answer:
```
React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by adding a header to the request. If the application uses SSR and is forced to switch to SPA, this causes an error that completely corrupts the page. If a cache system is in place, this allows the response containing the error to be cached, resulting in a cache poisoning that strongly impacts the availability of the application. This issue has been patched in version 7.5.2.
```
- [pouriam23/DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-](https://github.com/pouriam23/DoS-via-cache-poisoning-by-forcing-SPA-mode-CVE-2025-43864-)


Question: How to: CVE-2025-43865 (2025-04-25)

Answer:
```
React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the request. This allows to completely spoof its contents and modify all the values of the data object passed to the HTML. This issue has been patched in version 7.5.2.
```
- [pouriam23/Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865](https://github.com/pouriam23/Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865)


Question: How to: CVE-2025-43919 (2025-04-20)

Answer:
```
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
```
- [0NYX-MY7H/CVE-2025-43919](https://github.com/0NYX-MY7H/CVE-2025-43919)
- [cybersecplayground/CVE-2025-43919-POC](https://github.com/cybersecplayground/CVE-2025-43919-POC)


Question: How to: CVE-2025-43920 (2025-04-20)

Answer:
```
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
```
- [0NYX-MY7H/CVE-2025-43920](https://github.com/0NYX-MY7H/CVE-2025-43920)


Question: How to: CVE-2025-43921 (2025-04-20)

Answer:
```
GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.
```
- [0NYX-MY7H/CVE-2025-43921](https://github.com/0NYX-MY7H/CVE-2025-43921)


Question: How to: CVE-2025-43929 (2025-04-20)

Answer:
```
open_actions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document (e.g., a document opened in KDE ghostwriter).
```
- [0xBenCantCode/CVE-2025-43929](https://github.com/0xBenCantCode/CVE-2025-43929)


Question: How to: CVE-2025-43960 (2025-08-25)

Answer:
```
Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention.
```
- [far00t01/CVE-2025-43960](https://github.com/far00t01/CVE-2025-43960)


Question: How to: CVE-2025-44039 (2025-05-13)

Answer:
```
CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive information without any authentication.
```
- [Yashodhanvivek/CP-XR-DE21-S--4G-Router-Vulnerabilities](https://github.com/Yashodhanvivek/CP-XR-DE21-S--4G-Router-Vulnerabilities)


Question: How to: CVE-2025-44108 (2025-05-19)

Answer:
```
A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.
```
- [harish0x/CVE-2025-44108-SXSS](https://github.com/harish0x/CVE-2025-44108-SXSS)


Question: How to: CVE-2025-44136 (2025-07-29)

Answer:
```
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
```
- [mheranco/CVE-2025-44136](https://github.com/mheranco/CVE-2025-44136)


Question: How to: CVE-2025-44137 (2025-07-29)

Answer:
```
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format"
```
- [mheranco/CVE-2025-44137](https://github.com/mheranco/CVE-2025-44137)


Question: How to: CVE-2025-44148 (2025-06-03)

Answer:
```
Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component
```
- [barisbaydur/CVE-2025-44148](https://github.com/barisbaydur/CVE-2025-44148)


Question: How to: CVE-2025-44203 (2025-06-20)

Answer:
```
In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with the correct credentials.
```
- [IvanT7D3/CVE-2025-44203](https://github.com/IvanT7D3/CVE-2025-44203)


Question: How to: CVE-2025-44603

Answer: - [Moulish2004/CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers](https://github.com/Moulish2004/CVE-2025-44603-CSRF-Leads_to_Create_FakeUsers)


Question: How to: CVE-2025-44608 (2025-07-25)

Answer:
```
CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.
```
- [mr-xmen786/CVE-2025-44608](https://github.com/mr-xmen786/CVE-2025-44608)


Question: How to: CVE-2025-44823 (2025-10-07)

Answer:
```
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.
```
- [skraft9/CVE-2025-44823](https://github.com/skraft9/CVE-2025-44823)


Question: How to: CVE-2025-44998 (2025-05-23)

Answer:
```
A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via injecting a crafted payload into the js-theme-3 parameter.
```
- [l8BL/CVE-2025-44998](https://github.com/l8BL/CVE-2025-44998)


Question: How to: CVE-2025-45250 (2025-05-06)

Answer:
```
MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file.
```
- [xp3s/CVE-2025-45250](https://github.com/xp3s/CVE-2025-45250)
- [Anike-x/CVE-2025-45250](https://github.com/Anike-x/CVE-2025-45250)


Question: How to: CVE-2025-45346 (2025-07-29)

Answer:
```
SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.
```
- [0xsu3ks/CVE-2025-45346](https://github.com/0xsu3ks/CVE-2025-45346)


Question: How to: CVE-2025-45407

Answer: - [yallasec/CVE-2025-45407](https://github.com/yallasec/CVE-2025-45407)


Question: How to: CVE-2025-45466 (2025-07-25)

Answer:
```
Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.
```
- [zgsnj123/CVE-2025-45466](https://github.com/zgsnj123/CVE-2025-45466)


Question: How to: CVE-2025-45467 (2025-07-25)

Answer:
```
Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation.
```
- [zgsnj123/CVE-2025-45467](https://github.com/zgsnj123/CVE-2025-45467)


Question: How to: CVE-2025-45512 (2025-08-05)

Answer:
```
A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmware files, leading to arbitrary code execution.
```
- [AzhariRamadhan/CVE-2025-45512](https://github.com/AzhariRamadhan/CVE-2025-45512)


Question: How to: CVE-2025-45619 (2025-07-30)

Answer:
```
An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function
```
- [weedl/CVE-2025-45619](https://github.com/weedl/CVE-2025-45619)


Question: How to: CVE-2025-45620 (2025-07-30)

Answer:
```
An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request
```
- [weedl/CVE-2025-45620](https://github.com/weedl/CVE-2025-45620)


Question: How to: CVE-2025-45710

Answer: - [partywavesec/CVE-2025-45710](https://github.com/partywavesec/CVE-2025-45710)


Question: How to: CVE-2025-45778 (2025-08-01)

Answer:
```
A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field.
```
- [Smarttfoxx/CVE-2025-45778](https://github.com/Smarttfoxx/CVE-2025-45778)


Question: How to: CVE-2025-45805 (2025-09-03)

Answer:
```
In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload is subsequently rendered without proper sanitization, when a user visits the website and selects the doctor to book an appointment.
```
- [mhsinj/CVE-2025-45805](https://github.com/mhsinj/CVE-2025-45805)
- [mohammed-alsaqqaf/CVE-2025-45805](https://github.com/mohammed-alsaqqaf/CVE-2025-45805)


Question: How to: CVE-2025-45955

Answer: - [surendrapuppala7/CVE-2025-45955](https://github.com/surendrapuppala7/CVE-2025-45955)


Question: How to: CVE-2025-45960 (2025-07-25)

Answer:
```
Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding
```
- [pracharapol/CVE-2025-45960](https://github.com/pracharapol/CVE-2025-45960)


Question: How to: CVE-2025-46018 (2025-08-01)

Answer:
```
CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss.
```
- [niranjangaire1995/CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass](https://github.com/niranjangaire1995/CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass)


Question: How to: CVE-2025-46041 (2025-06-09)

Answer:
```
A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).
```
- [binneko/CVE-2025-46041](https://github.com/binneko/CVE-2025-46041)


Question: How to: CVE-2025-46047 (2025-09-02)

Answer:
```
A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.
```
- [J0ey17/CVE-2025-46047](https://github.com/J0ey17/CVE-2025-46047)


Question: How to: CVE-2025-46078 (2025-05-29)

Answer:
```
HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server
```
- [yggcwhat/CVE-2025-46078](https://github.com/yggcwhat/CVE-2025-46078)


Question: How to: CVE-2025-46080 (2025-05-29)

Answer:
```
HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server.
```
- [yggcwhat/CVE-2025-46080](https://github.com/yggcwhat/CVE-2025-46080)


Question: How to: CVE-2025-46099 (2025-07-23)

Answer:
```
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
```
- [0xC4J/CVE-Lists](https://github.com/0xC4J/CVE-Lists)


Question: How to: CVE-2025-46157 (2025-06-18)

Answer:
```
An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave request form
```
- [morphine009/CVE-2025-46157](https://github.com/morphine009/CVE-2025-46157)


Question: How to: CVE-2025-46171 (2025-07-23)

Answer:
```
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.
```
- [oiyl/CVE-2025-46171](https://github.com/oiyl/CVE-2025-46171)


Question: How to: CVE-2025-46173 (2025-05-27)

Answer:
```
code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form.
```
- [pruthuraut/CVE-2025-46173](https://github.com/pruthuraut/CVE-2025-46173)


Question: How to: CVE-2025-46178 (2025-06-09)

Answer:
```
Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or defacement.
```
- [SacX-7/CVE-2025-46178](https://github.com/SacX-7/CVE-2025-46178)


Question: How to: CVE-2025-46181

Answer: - [shemkumar/CVE-2025-46181-XSS](https://github.com/shemkumar/CVE-2025-46181-XSS)


Question: How to: CVE-2025-46203 (2025-06-04)

Answer:
```
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.
```
- [spbavarva/CVE-2025-46203](https://github.com/spbavarva/CVE-2025-46203)


Question: How to: CVE-2025-46204 (2025-06-04)

Answer:
```
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint.
```
- [spbavarva/CVE-2025-46204](https://github.com/spbavarva/CVE-2025-46204)


Question: How to: CVE-2025-46206 (2025-08-04)

Answer:
```
An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion
```
- [Landw-hub/CVE-2025-46206](https://github.com/Landw-hub/CVE-2025-46206)


Question: How to: CVE-2025-46271 (2025-04-24)

Answer:
```
UNI-NMS-Lite is vulnerable to a command injection attack that could \nallow an unauthenticated attacker to read or manipulate device data.
```
- [1Altruist/CVE-2025-46271-Reverse-Shell-PoC](https://github.com/1Altruist/CVE-2025-46271-Reverse-Shell-PoC)


Question: How to: CVE-2025-46295 (2025-12-16)

Answer:
```
Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could potentially achieve remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4.
```
- [soliantconsulting/CVE-2025-46295-fix-fms](https://github.com/soliantconsulting/CVE-2025-46295-fix-fms)


Question: How to: CVE-2025-46408 (2025-09-15)

Answer:
```
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOW_ALL_HOSTNAME_VERIFIER, bypassing domain validation.
```
- [shinyColumn/CVE-2025-46408](https://github.com/shinyColumn/CVE-2025-46408)


Question: How to: CVE-2025-46657 (2025-04-27)

Answer:
```
Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI.
```
- [nov-1337/CVE-2025-46657](https://github.com/nov-1337/CVE-2025-46657)


Question: How to: CVE-2025-46701 (2025-05-29)

Answer:
```
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.
```
- [gregk4sec/CVE-2025-46701](https://github.com/gregk4sec/CVE-2025-46701)


Question: How to: CVE-2025-46721 (2025-05-13)

Answer:
```
nosurf is cross-site request forgery (CSRF) protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site (either via XSS, or otherwise) to bypass CSRF checks and issue requests on user's behalf. Due to misuse of the Go `net/http` library, nosurf categorizes all incoming requests as plain-text HTTP requests, in which case the `Referer` header is not checked to have the same origin as the target webpage. If the attacker has control over HTML contents on either the target website (e.g. `example.com`), or on a website hosted on a subdomain of the target (e.g. `attacker.example.com`), they will also be able to manipulate cookies set for the target website. By acquiring the secret CSRF token from the cookie, or overriding the cookie with a new token known to the attacker, `attacker.example.com` is able to craft cross-site requests to `example.com`. A patch for the issue was released in nosurf 1.2.0. In lieu of upgrading to a patched version of nosurf, users may additionally use another HTTP middleware to ensure that a non-safe HTTP request is coming from the same origin (e.g. by requiring a `Sec-Fetch-Site: same-origin` header in the request).
```
- [justinas/nosurf-cve-2025-46721](https://github.com/justinas/nosurf-cve-2025-46721)


Question: How to: CVE-2025-46731 (2025-05-05)

Answer:
```
Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.
```
- [singetu0096/CVE-2025-46731](https://github.com/singetu0096/CVE-2025-46731)


Question: How to: CVE-2025-46811 (2025-07-30)

Answer:
```
A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.
```
- [b-L-x/CVE-2025-46811](https://github.com/b-L-x/CVE-2025-46811)


Question: How to: CVE-2025-46816 (2025-05-06)

Answer:
```
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.
```
- [Guilhem7/CVE-2025-46816](https://github.com/Guilhem7/CVE-2025-46816)


Question: How to: CVE-2025-46822 (2025-05-21)

Answer:
```
OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.
```
- [d3sca/CVE-2025-46822](https://github.com/d3sca/CVE-2025-46822)


Question: How to: CVE-2025-47175 (2025-06-10)

Answer:
```
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
```
- [mbanyamer/mbanyamer-Microsoft-PowerPoint-Use-After-Free-Remote-Code-Execution-RCE](https://github.com/mbanyamer/mbanyamer-Microsoft-PowerPoint-Use-After-Free-Remote-Code-Execution-RCE)


Question: How to: CVE-2025-47176 (2025-06-10)

Answer:
```
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
```
- [mahyarx/CVE-2025-47176](https://github.com/mahyarx/CVE-2025-47176)


Question: How to: CVE-2025-47178 (2025-07-08)

Answer:
```
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network.
```
- [synacktiv/CVE-2025-47178](https://github.com/synacktiv/CVE-2025-47178)


Question: How to: CVE-2025-47181 (2025-05-22)

Answer:
```
Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
```
- [encrypter15/CVE-2025-47181](https://github.com/encrypter15/CVE-2025-47181)


Question: How to: CVE-2025-47226 (2025-05-02)

Answer:
```
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
```
- [koyomihack00/CVE-2025-47226](https://github.com/koyomihack00/CVE-2025-47226)


Question: How to: CVE-2025-47227 (2025-07-05)

Answer:
```
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
```
- [synacktiv/CVE-2025-47227_CVE-2025-47228](https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228)
- [Ashwesker/Ashwesker-CVE-2025-47227](https://github.com/Ashwesker/Ashwesker-CVE-2025-47227)


Question: How to: CVE-2025-47256 (2025-05-06)

Answer:
```
Libxmp through 4.6.2 has a stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.
```
- [SexyShoelessGodofWar/CVE-2025-47256](https://github.com/SexyShoelessGodofWar/CVE-2025-47256)


Question: How to: CVE-2025-47423 (2025-05-07)

Answer:
```
Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.
```
- [Haluka92/CVE-2025-47423](https://github.com/Haluka92/CVE-2025-47423)


Question: How to: CVE-2025-47533 (2025-05-07)

Answer:
```
Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design Graphina allows PHP Local File Inclusion. This issue affects Graphina: from n/a through 3.0.4.
```
- [zs1n/CVE-2024-47533](https://github.com/zs1n/CVE-2024-47533)


Question: How to: CVE-2025-47539 (2025-05-23)

Answer:
```
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation. This issue affects Eventin: from n/a through 4.0.26.
```
- [Nxploited/CVE-2025-47539](https://github.com/Nxploited/CVE-2025-47539)


Question: How to: CVE-2025-47549 (2025-05-07)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF allows Upload a Web Shell to a Web Server.\n\nThis issue affects BEAF: from n/a through 4.6.10.
```
- [d0n601/CVE-2025-47549](https://github.com/d0n601/CVE-2025-47549)


Question: How to: CVE-2025-47550 (2025-05-07)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio allows Upload a Web Shell to a Web Server.\n\nThis issue affects Instantio: from n/a through 3.3.16.
```
- [d0n601/CVE-2025-47550](https://github.com/d0n601/CVE-2025-47550)


Question: How to: CVE-2025-47577 (2025-05-19)

Answer:
```
Unrestricted Upload of File with Dangerous Type vulnerability in TemplateInvaders TI WooCommerce Wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a before 2.10.0.
```
- [Yucaerin/CVE-2025-47577](https://github.com/Yucaerin/CVE-2025-47577)
- [sug4r-wr41th/CVE-2025-47577](https://github.com/sug4r-wr41th/CVE-2025-47577)


Question: How to: CVE-2025-47646 (2025-05-23)

Answer:
```
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration allows Password Recovery Exploitation. This issue affects PSW Front-end Login & Registration: from n/a through 1.13.
```
- [Nxploited/CVE-2025-47646](https://github.com/Nxploited/CVE-2025-47646)
- [RootHarpy/CVE-2025-47646](https://github.com/RootHarpy/CVE-2025-47646)


Question: How to: CVE-2025-47810

Answer: - [ptrstr/CVE-2025-47810](https://github.com/ptrstr/CVE-2025-47810)


Question: How to: CVE-2025-47812 (2025-07-10)

Answer:
```
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
```
- [4m3rr0r/CVE-2025-47812-poc](https://github.com/4m3rr0r/CVE-2025-47812-poc)
- [0xcan1337/CVE-2025-47812-poC](https://github.com/0xcan1337/CVE-2025-47812-poC)
- [0xgh057r3c0n/CVE-2025-47812](https://github.com/0xgh057r3c0n/CVE-2025-47812)
- [ill-deed/WingFTP-CVE-2025-47812-illdeed](https://github.com/ill-deed/WingFTP-CVE-2025-47812-illdeed)
- [pevinkumar10/CVE-2025-47812](https://github.com/pevinkumar10/CVE-2025-47812)
- [rxerium/CVE-2025-47812](https://github.com/rxerium/CVE-2025-47812)
- [blindma1den/CVE-2025-47812](https://github.com/blindma1den/CVE-2025-47812)
- [Ashwesker/Ashwesker-CVE-2025-47812](https://github.com/Ashwesker/Ashwesker-CVE-2025-47812)
- [r0otk3r/CVE-2025-47812](https://github.com/r0otk3r/CVE-2025-47812)
- [CTY-Research-1/CVE-2025-47812_Lab_environment](https://github.com/CTY-Research-1/CVE-2025-47812_Lab_environment)


Question: How to: CVE-2025-47827 (2025-06-05)

Answer:
```
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
```
- [Zedeldi/CVE-2025-47827](https://github.com/Zedeldi/CVE-2025-47827)


Question: How to: CVE-2025-47916 (2025-05-16)

Answer:
```
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
```
- [Web3-Serializer/CVE-2025-47916](https://github.com/Web3-Serializer/CVE-2025-47916)


Question: How to: CVE-2025-47917 (2025-07-20)

Answer:
```
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
```
- [byteReaper77/CVE-2025-47917](https://github.com/byteReaper77/CVE-2025-47917)


Question: How to: CVE-2025-47962 (2025-06-10)

Answer:
```
Improper access control in Windows SDK allows an authorized attacker to elevate privileges locally.
```
- [q1uf3ng/CVE-2025-47962-POC](https://github.com/q1uf3ng/CVE-2025-47962-POC)


Question: How to: CVE-2025-47987 (2025-07-08)

Answer:
```
Heap-based buffer overflow in Windows Cred SSProvider Protocol allows an authorized attacker to elevate privileges locally.
```
- [Kryptoenix/CVE-2025-47987_PoC](https://github.com/Kryptoenix/CVE-2025-47987_PoC)


Question: How to: CVE-2025-48060 (2025-05-21)

Answer:
```
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-fuzz. This crash happens on file jv.c, line 1456 `void* p = malloc(sz);`. As of time of publication, no patched versions are available.
```
- [leorivass/jq-els-backport-cve-2025-48060](https://github.com/leorivass/jq-els-backport-cve-2025-48060)


Question: How to: CVE-2025-48129 (2025-06-09)

Answer:
```
Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light allows Privilege Escalation. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through 2.4.37.
```
- [Nxploited/CVE-2025-48129](https://github.com/Nxploited/CVE-2025-48129)