CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-32376 |
Description: Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.
CVSS: MEDIUM (4.8) EPSS Score: 0.03%
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-46560 |
Description: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_|>, <|image_|>) with repeated tokens based on precomputed lengths. Due to inefficient list concatenation operations, the algorithm exhibits quadratic time complexity (O(n²)), allowing malicious actors to trigger resource exhaustion via specially crafted inputs. This issue has been patched in version 0.8.5.
CVSS: MEDIUM (6.5) EPSS Score: 0.05% SSVC Exploitation: poc
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-45011 |
Description: A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the searchdata POST request parameter.
CVSS: MEDIUM (5.3) EPSS Score: 0.07%
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-45010 |
Description: A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the fromdate and todate POST request parameters.
CVSS: MEDIUM (5.3) EPSS Score: 0.07%
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-45009 |
Description: A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the searchdata parameter.
CVSS: MEDIUM (5.3) EPSS Score: 0.07%
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-4121 |
Description: A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The manipulation of the argument host leads to command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. In Netgear JWNR2000v2 1.0.0.11 wurde eine kritische Schwachstelle ausgemacht. Das betrifft die Funktion cmd_wireless. Durch das Beeinflussen des Arguments host mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden.
CVSS: MEDIUM (5.3) EPSS Score: 0.33%
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-4119 |
Description: A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. In Weitong Mall 1.0.0 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Hierbei betrifft es unbekannten Programmcode der Datei /queryTotal der Komponente Product Statistics Handler. Dank Manipulation des Arguments isDelete mit der Eingabe 1 mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.
CVSS: MEDIUM (6.9) EPSS Score: 0.04% SSVC Exploitation: none
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-4118 |
Description: A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product History Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Es wurde eine Schwachstelle in Weitong Mall 1.0.0 entdeckt. Sie wurde als kritisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei /historyList der Komponente Product History Handler. Dank der Manipulation des Arguments isDelete mit der Eingabe 1 mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS: MEDIUM (6.9) EPSS Score: 0.04% SSVC Exploitation: none
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-4117 |
Description: A vulnerability, which was classified as critical, was found in Netgear JWNR2000v2 1.0.0.11. This affects the function sub_41A914. The manipulation of the argument host leads to buffer overflow. The vendor was contacted early about this disclosure but did not respond in any way. Es wurde eine kritische Schwachstelle in Netgear JWNR2000v2 1.0.0.11 gefunden. Es geht dabei um die Funktion sub_41A914. Mittels dem Manipulieren des Arguments host mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden.
CVSS: MEDIUM (5.1) EPSS Score: 0.05%
April 30th, 2025 (about 2 months ago)
|
|
CVE-2025-27532 |
Description: A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via multiple crafted HTTP requests.
CVSS: MEDIUM (6.5) EPSS Score: 0.06%
April 30th, 2025 (about 2 months ago)
|