Aggregator

Submit #566104 / VDB-308084

A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to buffer overflow. The identification of this vulnerability is CVE-2025-4462. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. This vulnerability was named CVE-2025-4461. The attack can be initiated remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-4460. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Submit #565990 / VDB-308083

Submit #565984 / VDB-308082

Submit #565978 / VDB-248885

A vulnerability was found in code-projects Patient Record Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file fecalysis_form.php. The manipulation of the argument itr_no leads to sql injection. This vulnerability is handled as CVE-2025-4459. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edit_upatient.php. The manipulation of the argument ID leads to sql injection. This vulnerability is known as CVE-2025-4458. The attack can be launched remotely. Furthermore, there is an exploit available.

Submit #565958 / VDB-308081

Submit #565957 / VDB-308080

Submit #565956 / VDB-308079

A vulnerability was found in Arista CloudVision up to 2024.3.0. It has been classified as critical. Affected is an unknown function of the component Time-bound Device Onboarding Token. The manipulation leads to improper privilege management. This vulnerability is traded as CVE-2024-8100. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in imithemes Listing Plugin up to 3.3 on WordPress and classified as problematic. This issue affects the function imic_reset_password_init. The manipulation leads to weak password recovery. The identification of this vulnerability is CVE-2025-2253. The attack may be initiated remotely. There is no exploit available.

A vulnerability has been found in Frontend Login and Registration Blocks Plugin up to 1.0.7 on WordPress and classified as critical. This vulnerability affects the function flr_blocks_user_settings_handle_ajax_callback of the component Setting Handler. The manipulation leads to Remote Code Execution. This vulnerability was named CVE-2025-3605. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in Click Migration Plugin up to 2.2 on WordPress. This affects the function start_restore. The manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2025-3455. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Arista CloudVision Portal up to 2024.2.1/2024.3.0. Affected by this issue is some unknown functionality of the component Zero Touch Provisioning. The manipulation leads to improper privilege management. This vulnerability is handled as CVE-2025-0505. The attack may be launched remotely. There is no exploit available.

Cyber-insurance carrier Coalition said business email compromise and funds transfer fraud accounted for 60% of claims in 2024.

An npm package named 'rand-user-agent' has been compromised in a supply chain attack to inject obfuscated code that activates a remote access trojan (RAT) on the user's system. [...]

Submit #565464 / VDB-308078