Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-45651 |
Description: IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0
does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.
CVSS: MEDIUM (6.3) EPSS Score: 0.04% SSVC Exploitation: none
April 18th, 2025 (1 day ago)
|
|
Description: A new multi-stage attack has been observed delivering malware families like Agent Tesla variants, Remcos RAT, and XLoader.
"Attackers increasingly rely on such complex delivery mechanisms to evade detection, bypass traditional sandboxes, and ensure successful payload delivery and execution," Palo Alto Networks Unit 42 researcher Saqib Khanzada said in a technical write-up of the campaign.
The
April 18th, 2025 (1 day ago)
|
|
Description: Cisco has released security updates for a high-severity Webex vulnerability that allows unauthenticated attackers to gain client-side remote code execution using malicious meeting invite links. [...]
April 18th, 2025 (1 day ago)
|
|
Description: A critical vulnerability tracked as CVE-2025-2492 has been disclosed in ASUS routers running AiCloud, potentially allowing remote attackers to execute unauthorized functions without authentication. The flaw, rated 9.2 (Critical) under the CVSS 4.0 system, affects multiple firmware versions and underscores the continued risk posed by exposed cloud-enabled features in consumer networking devices. The vulnerability was …
The post Critical Authentication Flaw in ASUS AiCloud Exposes Routers to Remote Attacks appeared first on CyberInsider.
CVSS: CRITICAL (9.2) EPSS Score: 0.1%
April 18th, 2025 (1 day ago)
|
|
CVE-2025-3788 |
Description: A vulnerability was found in baseweb JSite 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /a/sys/user/save. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. In baseweb JSite 1.0 wurde eine problematische Schwachstelle ausgemacht. Das betrifft eine unbekannte Funktionalität der Datei /a/sys/user/save. Durch das Beeinflussen des Arguments Name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.
CVSS: MEDIUM (5.1) EPSS Score: 0.03%
April 18th, 2025 (1 day ago)
|
|
CVE-2025-3787 |
Description: A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Es wurde eine problematische Schwachstelle in PbootCMS 3.2.5 ausgemacht. Es betrifft eine unbekannte Funktion der Komponente Image Handler. Durch Manipulieren mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
CVSS: MEDIUM (5.1) EPSS Score: 0.03%
April 18th, 2025 (1 day ago)
|
|
CVE-2025-3786 |
Description: A vulnerability was found in Tenda AC15 up to 15.03.05.19 and classified as critical. This issue affects the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Eine kritische Schwachstelle wurde in Tenda AC15 bis 15.03.05.19 gefunden. Hierbei geht es um die Funktion fromSetWirelessRepeat der Datei /goform/WifiExtraSet. Durch das Manipulieren des Arguments mac mit unbekannten Daten kann eine buffer overflow-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.
CVSS: HIGH (8.7) EPSS Score: 0.05%
April 18th, 2025 (1 day ago)
|
|
CVE-2025-3106 |
Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS: MEDIUM (6.4) EPSS Score: 0.03%
April 18th, 2025 (1 day ago)
|
|
Description: Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation
April 18th, 2025 (1 day ago)
|
|
|
Description: Tatsu 3.3.11 - Unauthenticated RCE
April 18th, 2025 (1 day ago)
|