An issue was discovered in Camera in Samsung Mobile Processor Exynos 1280 and 2200. Unnecessary registration of a hardware IP address in the Camera device driver can lead to a NULL pointer dereference, resulting in a denial of service.
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client
NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause an improper check for unusual or exceptional conditions issue by sending extra large payloads. A successful exploit of this vulnerability may lead to denial of service.
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Information disclosure in WebKitGTK allows remote websites to read arbitrary local files by exploiting a drag-and-drop mechanism that does not verify the drag operation originated from outside the browser. Attackers can leverage this by convincing a user to drag a file onto a malicious page, exposing data the user has permission to access. The flaw affects WebKitGTK before version 2.50.3; vendor patches are available and widely distributed, with no indication of active exploitation.
A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability could potentially allow a local attacker to escalate privileges via a race condition when installing packages.
Rejected reason: This CVE is a duplicate of CVE-2025-55182. Public exploit code available and no vendor patch available.
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting collections. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
The Tag, Category, and Taxonomy Manager - AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database granted they have metabox access for the taxonomy (enabled by default for contributors).
alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode attribute in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the "create_img_preload_tag" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A security vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass (CVSS 6.2). Remediation should follow standard vulnerability management procedures.
An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the number or size of requests
Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives
Denial of service via CPU exhaustion in Mozilla Rhino versions prior to 1.7.14.1, 1.7.15.1, and 1.8.1. A remote attacker can pass a specially crafted small floating-point number to the toFixed() function, triggering excessive exponentiation in the pow5mult routine and consuming CPU resources. Exploit code is publicly available, though no active exploitation has been reported at this time.
Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.
In Splunk MCP Server app versions below 0.2.4, a user with access to the "run_splunk_query" Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions beyond the intended MCP restrictions.
A security vulnerability in for WordPress is vulnerable to authorization bypass in all (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
A security vulnerability in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. The function used to decode the SOR transparent container lacks bounds checking, which can cause a fatal error.
A security vulnerability in Splunk Enterprise (CVSS 5.3) that allows them. Remediation should follow standard vulnerability management procedures.
CVE-2025-39665 is a security vulnerability (CVSS 5.3) that allows an unauthenticated attacker. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Unauthenticated sensitive information disclosure in MxChat for WordPress allows attackers to extract session values from upload filenames, enabling access to private AI chatbot conversation data. All versions up to 2.5.5 are affected. A public proof-of-concept exists, but no active exploitation has been reported; EPSS is very low (0.05%) suggesting limited current risk.
CVE-2025-12084 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
A remote code execution vulnerability in BlazeMeter Jenkins Plugin (CVSS 5.3) that allows users only with certain permissions. Remediation should follow standard vulnerability management procedures.
A security vulnerability in Step CA (CVSS 5.0). Remediation should follow standard vulnerability management procedures.
The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `label` column field after adding a new device in the Splunk Secure Gateway app. This could potentially lead to a client-side denial of service (DoS).
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership verification or checking if the collection is public/private before returning collection data. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
A security vulnerability in all (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
The Tag, Category, and Taxonomy Manager - AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "taxopress_merge_terms_batch" function. This makes it possible for authenticated attackers, with subscriber level access and above, to merge or delete arbitrary taxonomy terms.
A remote code execution vulnerability in for WordPress is vulnerable to Insecure Direct Object Reference in all (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. This is due to missing nonce validation on the "post_add_to_list" function as well as an incorrect permissions callback in the "Api/init" function. This makes it possible for unauthenticated attackers to add or remove products from a user's wishlist via a forged request granted they can trick a site's user into performing an action such as clicking on a link.
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a views dashboard with a custom background using the `data:image/png;base64` protocol that could potentially lead to an unvalidated redirect. This behavior circumvents the Splunk external URL warning mechanism by using a specially crafted URL, allowing for a redirection to an external malicious site. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
A security vulnerability in opsre go-ldap-admin (CVSS 5.6). Remediation should follow standard vulnerability management procedures.
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.
A security vulnerability in Timetable and Event Schedule by MotoPress WordPress (CVSS 2.7). Remediation should follow standard vulnerability management procedures.
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability `admin_all_objects` could craft a malicious payload through the href attribute of an anchor tag within a collection in the navigation bar, which could result in execution of unauthorized JavaScript code in the browser of a user.
We need to produce a JSON object with the specified fields, strictly as plain text strings, no nesting. We must synthesize all provided data, cross-reference, and produce an original analysis. First, gather all info: CVE: CVE-2025-13949 Product: ProudMuBai GoFilm 1.0.0/1.0.1 Description: A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1. Impacted is the function SingleUpload of the file /server/controller/FileController.go. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 2.1 (CVSS 4.0 score, but the vector is 4.0. We need to output both assessed CVSS 3.1 and 4.0 vectors, independent assessment. The provided CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. That's a low base score 2.1? Actually CVSS:4.0 base score with VC:L/VI:L/VA:L might be low. But we'll assess independently. Also, EPSS: 0.05% (15th percentile) – very low exploitation probability. KEV: not mentioned, so no active known exploitation. Tags: File Upload, Authentication Bypass. CWE: CWE-284 (Improper Access Control). Affected versions: GoFilm 1.0.1, 1.0.0. POC: exploit publicly available (description says "exploit is publicly available"). Vendor not responding. Now answer each field: product_name: "GoFilm" (specific product, 1-3 words). Possibly "GoFilm" alone, since vendor ProudMuBai, but product name is GoFilm. So: "GoFilm". summary: Start with impact verb and product. Unrestricted file upload. So: "Unrestricted file upload in GoFilm 1.0.0 and 1.0.1 allows remote attackers to upload arbitrary files via the SingleUpload function. The vulnerability has publicly available exploit code and has been reported to the vendor without response." Must note active exploitation? No KEV, so not actively exploited. Mention EPSS very low (0.05%) if notable. No specific mention of active exploitation. So: "Unrestricted file upload in GoFilm 1.0.0 and 1.0.1 allows remote attackers to upload arbitrary files via the SingleUpload function. Public exploit code is available; the EPSS exploitation probability is 0.05%, indicating low likelihood of widespread exploitation. The vendor has not responded to the disclosure." Avoid copying description. Original synthesis. technical_context: Underlying tech: GoFilm is an unspecified software (likely a media/film management system). CWE-284 Improper Access Control, file upload parameter "File" is not properly sanitized/restricted. CPE? Not provided, but product is GoFilm. No CPE strings. Use CWE to explain root cause: improper access control leading to unrestricted file upload. Be educational: "The vulnerability resides in the file upload handler of GoFilm's web interface, exposing the /server/controller/FileController.go endpoint. The root cause is classified as CWE-284 (Improper Access Control), indicating missing or insufficient restrictions on file type, size, or path. This allows an authenticated user (PR:L) to upload arbitrary files, which could lead to remote code execution or server compromise." Need to infer from CVSS vector: AV:N, PR:L (low privileges). So authenticated. So the upload function is accessible by low-privilege users. So technical_context: "GoFilm is a web application written in Go. The vulnerability is in the SingleUpload function in FileController.go, which handles file uploads. This function lacks proper validation of uploaded file types or extensions, enabling an attacker with low-privilege access (PR:L) to upload arbitrary files, such as web shells. The CWE-284 (Improper Access Control) classification indicates the missing access controls on file upload operations." risk_assessment: Use CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) with exploit available (E:P). EPSS 0.05% (very low). KEV not listed. Public exploit exists. SSVC: exploitation status: public POC (no confirmed active exploitation). Automatable? Probably yes (simple HTTP request). Technical impact: partial (VC:L/VI:L/VA:L) meaning low confidentiality, integrity, availability impact. But unrestricted file upload often leads to higher impact if combined with other vulnerabilities, but as given, low. So real risk: low, likely because attacker needs authentication (PR:L) and exploit yields low impacts. EPSS reinforces low. Compare: CVSS base score is low, but with E:P it might be mid. But overall, low priority, especially with no known active exploitation. State conflicting signals? "Although the attack vector is network-based and complexity low, the need for low-privilege authentication limits the attack surface, and the assessed impact is low. The EPSS score is very low, suggesting minimal real-world exploitation likelihood despite public exploit availability." Also note vendor hasn't responded, patch status unknown. So: "The vulnerability has a low CVSS 4.0 base score (2.1) due to low impact metrics and requires low-privilege authentication. EPSS probability is 0.05%, indicating negligible exploitation likelihood. However, the availability of public exploit code and the potential for file upload to be leveraged for further compromise should be considered. No active exploitation is reported. This is low risk unless the product is widely deployed in sensitive environments." affected_products: "GoFilm versions 1.0.0 and 1.0.1 are affected, per EUVD. No CPE details provided. Vendor advisory not available. References: issue tracker at github.com/yzlala1147/cve/issues/1 and VulDB entry at vuldb.com/?id.334164." Must link to advisory if possible, but no vendor advisory. So: "GoFilm 1.0.0 and 1.0.1 are confirmed affected. No vendor advisory is available; vulnerability disclosed on GitHub issue #1 and VulDB entry 334164." remediation: Primary fix: none mentioned. Vendor not responding. So "No patch is available; the vendor ProudMuBai has not responded to disclosure." Workarounds: "As a temporary mitigation, restrict access to the file upload endpoint by IP address, disable the SingleUpload functionality if not needed, or enforce strict file type validation via a web application firewall. The trade-off: functionality may be limited. No patch version is available, and any fix must come from the vendor. Monitor the GitHub issue for updates." Avoid generic "apply defense in depth" — specific: disable endpoint, restrict access. I'll state: "If the SingleUpload endpoint is not required, disable it or restrict network access to the endpoint to trusted IPs. Alternatively, deploy a web application firewall rule to block file uploads with dangerous extensions (e.g., .php, .jsp, .exe). This may impact legitimate uploads. No vendor patch exists at this time." exploit_scenario: "An authenticated low-privilege attacker sends a crafted HTTP POST request to the /server/controller/FileController.go SingleUpload endpoint with a malicious file (e.g., a web shell) as the 'File' argument. The server accepts and stores the file without validation, enabling remote code execution when the file is later accessed. Public exploit code exists for this vulnerability." exploitation_conditions: Need specific prerequisites: description says manipulation of argument File leads to unrestricted upload. Function SingleUpload. So condition: "The attacker must be authenticated with low privileges on the GoFilm web application. The SingleUpload endpoint must be accessible without additional restrictions. No special configuration is required beyond default deployment." However, CVSS vector has PR:L, so authenticated. So condition: "Low-privilege authentication to the GoFilm web interface is required. The file upload endpoint /server/controller/FileController.go via SingleUpload function must be exposed. No special configuration; the vulnerability is present by default." No user interaction needed. Good. attack_chain: Steps: Recon? Not necessary. Access -> Delivery -> Exploit -> Execution -> Impact. So: "Obtain low-privilege credentials for GoFilm → Send malicious file via HTTP POST to SingleUpload endpoint → File accepted due to lack of validation → Access uploaded file to trigger code execution → Achieve remote code execution or further compromise." Could be shorter: "Authenticate with low-privilege account → Upload malicious file via SingleUpload → Execute uploaded file to gain code execution." I'll use 4 steps: "Authenticate with low-privilege credentials → Send crafted POST with malicious file to /server/controller/FileController.go → Unrestricted file upload stores the file on server → Access and execute the file for remote code execution." confidence_notes: "The vulnerability and its public exploit are confirmed by VulDB and GitHub issue reporters, but the vendor has not acknowledged or provided a patch. EPSS score and no KEV listing indicate no known active exploitation. Affected version range is confirmed by EUVD. The CVSS 4.0 vector is provided but may not reflect the full impact of unrestricted upload (often higher)." So: "Exploit publicly confirmed by VulDB and GitHub issue; no vendor response. EPSS low, no KEV listing, so no active exploitation. Exact impact beyond low may be higher with chained attacks, but official vector shows low impact. No patch available." That's specific. prevalence: Need to estimate real-world deployment. GoFilm by ProudMuBai: seems like a niche or small project, likely low usage. Not widespread. So "low". Basis: "niche Go-based web application with limited known deployments". So prevalence: "low", prevalence_basis: "niche Go-based film management software". Could also be "rare" if very obscure, but description says versions 1.0.0/1.0.1 so it's not retired. I'll go with "low". assessed_cvss_vector: My own independent assessment. Unrestricted file upload, remote, low privileges. Could lead to code execution, but that's not explicit; impact may be limited to upload only (if server doesn't execute files). Usually unrestricted upload leads to high impact if combined, but the official CVSS 4.0 says VC:L/VI:L/VA:L meaning low impact. I need to assess realistically. If upload is truly unrestricted, attacker can upload a web shell and get high impact. So I'd assess higher impact. But I need grounding in description: only says unrestricted upload, no mention of code execution. The CVSS 4.0 vector from VulDB indicates low impact. Since we are synthesizing and must be independent but grounded, I'll use a balanced approach: the vulnerability allows arbitrary file upload, but the actual impact depends on server configuration (e.g., if uploaded files are executable). So I'll set impact as high for integrity (upload) but confidentiality and availability might be low unless the server processes the files. Typically, unrestricted file upload is often scored with high integrity, high maybe confidentiality and availability if it leads to code execution. Many such vulnerabilities are rated as high. I'll set CV:? But to be consistent with the official low impact? The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." So I should derive from my understanding. I'll assume that arbitrary file upload leads to ability to upload malicious script and potentially execute it, so I'd give high impact. So AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. But is it always code execution? It might be limited to uploading arbitrary content, causing integrity high, maybe confidentiality none unless you can read files, but you might upload a script to read files. Usually, unrestricted upload is considered critical if you can achieve RCE. I'll set C:H, I:H, A:N (no availability impact). More conservative: C:L, I:H, A:L. I'll choose: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. Because you can upload a malicious file and potentially read some data (confidentiality low), integrity high, availability low (if you upload large files, maybe crash). But the official vector says all low, but that might be because they assess it only as allowing arbitrary file upload without execution. I'll go