cvetitrevendorproductversionlessThanOrEqualproblemdescriptionpublishedlastModifiedexploitabnilityScoreimpactScoreattackVectorattackComplexityprivilegesRequireduserInteractionscopeconfidentialityImpactintegrityImpactavailabilityImpactbaseScorebaseSeveritycriteriareferences
CVE-2025-54236Adobe Commerce | Improper Input Validation (CWE-20)AdobeAdobe Commerce02.4.4-p15Improper Input Validation (CWE-20)Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.2025-09-09T14:15:46.5632025-12-10T02:00:02.5573.95.2NETWORKLOWNONENONEUNCHANGEDHIGHHIGHNONE9.1CRITICALhttps://helpx.adobe.com/security/products/magento/apsb25-88.html__https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397__https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento__https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236__
CVE-2025-66581Frappe LMS is Missing Server-Side Authorization in Business Logicfrappelms< 2.41.0CWE-863: Incorrect AuthorizationFrappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because the affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the API's. This vulnerability is fixed in 2.41.0.2025-12-05T19:15:52.7132025-12-11T00:08:39.7872.83.6NETWORKLOWLOWNONEUNCHANGEDNONEHIGHNONE6.5MEDIUMhttps://github.com/frappe/lms/security/advisories/GHSA-2ch7-c74m-432m__
CVE-2025-14225D-Link DCS-930L alphapd setSystemAdmin command injectionD-LinkDCS-930L1.15.04Command InjectionA vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.2025-12-08T10:15:59.5002025-12-11T00:07:47.7132.83.4NETWORKLOWLOWNONEUNCHANGEDLOWLOWLOW6.3MEDIUMhttps://github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-1/D-Link%20Vulnerability.md__https://vuldb.com/?ctiid.334667__https://vuldb.com/?id.334667__https://vuldb.com/?submit.701774__https://www.dlink.com/__
CVE-2025-14245IdeaCMS Coupon.php whereRaw sql injectionn/aIdeaCMS1.0SQL InjectionA vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such manipulation of the argument params leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.2025-12-08T13:15:46.8932025-12-11T00:07:10.5573.93.4NETWORKLOWNONENONEUNCHANGEDLOWLOWLOW7.3HIGHhttps://github.com/rassec2/dbcve/issues/17__https://vuldb.com/?ctiid.334755__https://vuldb.com/?id.334755__https://vuldb.com/?submit.702437__
CVE-2025-63721n/an/an/an/aHummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.2025-12-08T17:16:20.2302025-12-11T00:05:53.3172.85.9NETWORKLOWLOWNONEUNCHANGEDHIGHHIGHHIGH8.8HIGHhttps://gist.github.com/k1ng0fic3/e8c8c9353fff8fa95e2c2952587e9266__https://github.com/k1ng0fic3/secrisk/blob/main/README.md__
CVE-2025-65797n/an/an/an/aIncorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).2025-12-08T17:16:21.2072025-12-11T00:04:16.9732.83.6NETWORKLOWLOWNONEUNCHANGEDNONENONEHIGH6.5MEDIUMhttp://memos.com__http://usememos.com__https://github.com/usememos/memos/pull/5217__https://herolab.usd.de/security-advisories/usd-2025-0057/__
CVE-2025-65804n/an/an/an/aTenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).2025-12-08T18:15:53.9802025-12-11T00:03:09.9702.83.6ADJACENT_NETWORKLOWNONENONEUNCHANGEDNONENONEHIGH6.5MEDIUMhttps://river-brow-763.notion.site/Tenda-AX3-Buffer-Overflow-in-formSetIptv-2aaa595a7aef8072968edc528a2d95b1__
CVE-2025-12635IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site ScriptingIBMWebSphere Application Server9.02.0.18CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.2025-12-08T22:15:49.3902025-12-11T00:01:21.8972.32.7NETWORKLOWLOWREQUIREDCHANGEDLOWLOWNONE5.4MEDIUMhttps://www.ibm.com/support/pages/node/7254078__
CVE-2025-67511Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent toolaliasroboticscai<= 0.5.9CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulnerable to Command Injection through the run_ssh_command_with_credentials() function, which is available to AI agents. Only password and command inputs are escaped in run_ssh_command_with_credentials to prevent shell injection; while username, host and port values are injectable. This issue does not have a fix at the time of publication.2025-12-11T00:16:22.9072025-12-11T00:16:22.9072.86NETWORKLOWNONEREQUIREDCHANGEDHIGHHIGHHIGH9.6CRITICALhttps://github.com/aliasrobotics/cai/commit/09ccb6e0baccf56c40e6cb429c698750843a999c__https://github.com/aliasrobotics/cai/security/advisories/GHSA-4c65-9gqf-4w8h__
CVE-2025-675122025-12-11T00:16:23.0902025-12-11T00:16:23.090