Android contains a missing authentication vulnerability (CVE-2025-48572, CVSS 7.8) in multiple locations that allows background activity launches through a permissions bypass, enabling local privilege escalation without user interaction. KEV-listed, this vulnerability enables malicious apps to perform privileged operations silently in the background, bypassing Android's activity launch restrictions.
CVE-2025-48633 is a security vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed). Vendor patch is available.
SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
A security vulnerability in NUT-14 (CVSS 9.1) that allows cashu tokens. Risk factors: public PoC available.
HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.
Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page.
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.
Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path as well and then prevent any potential use-after-free bugs.
Use-after-free in the Linux kernel's CIFS/SMB client (cifs module) affects the smb2_query_info_compound() function, where a cached fid (cfid) freed during a first attempt is not reset to NULL before a replay, so subsequent cleanup dereferences a stale pointer. Reachable through ordinary filesystem operations such as statfs() against an SMB mount, it manifests as a refcount underflow and use-after-free that most plausibly causes kernel memory corruption and denial of service on hosts with CIFS mounts. This is no public exploit identified at time of analysis; EPSS is very low (0.03%, 7th percentile) and it is not in CISA KEV, though a vendor patch and Ubuntu USN are available.
A remote code execution vulnerability in A vulnerability (CVSS 6.5). Risk factors: public PoC available.
Remote SQL injection in Student Management System 1.0 via the sub parameter in /newsubject.php allows unauthenticated attackers to manipulate database queries. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. Exploitation probability is low (EPSS 0.04%), though the vulnerability is easily triggered over the network without authentication.
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /newrecord.php, potentially reading or modifying database contents. Exploit code is publicly available, though the EPSS exploitation probability is low (0.04%). No active exploitation has been reported by CISA KEV.
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the 'ID' parameter in /newcurriculm.php, potentially leading to unauthorized database access. Public exploit code exists, but EPSS exploitation probability is negligible (0.04%), and no active exploitation has been reported. The affected product is a niche academic application, limiting real-world impact.
SQL injection in the admin login of Online Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the Username parameter to execute unauthorized SQL commands, potentially leading to data extraction, modification, or authentication bypass. Exploit code is publicly available, but the low EPSS score (0.04%) and lack of CISA KEV listing indicate no active widespread exploitation at this time.
SQL injection in Online Ordering System 1.0 allows remote attackers to extract or modify database contents via the Name parameter in /user_contact.php. Public exploit code is available, but no evidence of active exploitation exists. EPSS is very low (0.04%), indicating minimal real-world impact.
SQL injection in Online Ordering System 1.0 allows remote attackers to inject arbitrary SQL via the product_id parameter of /user_school.php, enabling data extraction or manipulation. Exploit code is publicly available, though no active exploitation has been confirmed by CISA or threat intelligence feeds.
Unauthenticated SQL injection in Simple Shopping Cart 1.0 via the admin_username parameter on /adminlogin.php allows remote attackers to extract sensitive data or bypass authentication. A proof-of-concept exploit is publicly available, though no active exploitation has been reported in CISA KEV. The vulnerability affects code-projects/fabian's PHP-based shopping cart software.
SQL injection in IdeaCMS up to version 1.8 permits unauthenticated remote attackers to execute arbitrary SQL commands via the params argument in Coupon.php's whereRaw function. A public exploit is available, but the EPSS exploitation probability is low (0.04%), and no active exploitation is confirmed.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to extract or modify database data by manipulating the 'fname' parameter in /edit_user.php. The exploit is publicly available, but no active exploitation has been confirmed, and the EPSS score is very low (0.04%), indicating minimal real-world likelihood.
SQL injection in Simple Leave Manager 1.0 allows remote attackers to manipulate the staff_id parameter in /request.php to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. A public exploit is available but no active exploitation has been confirmed by CISA KEV.
Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.
SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
We need to analyze the CVE and synthesize all data into a comprehensive JSON response. The instructions are very detailed. First, extract key facts: - CVE ID: CVE-2025-14216 - Description: Vulnerability in code-projects Currency Exchange System 1.0. Unknown processing of file /viewserial.php, argument ID causes SQL injection. Remote attack possible. Exploit publicly disclosed. - CVSS Score: 5.5 (low? medium? CVSS 4.0 base 5.5, but no 3.1 provided; only 4.0 vector) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (vendor: VulDB also has CVSS 3.0 5.3? Not provided, only 4.0). For our own assessed CVSS 3.1 and 4.0 vectors, we'll derive from description. Vulnerability is SQL injection, remote, unauthenticated? The CVSS vector says PR:N, UI:N, so unauthenticated, no user interaction. Attack complexity low. Impact: Low on Confidentiality, Integrity, Availability. So it's an SQLi with limited impact. But description says "ID causes sql injection". We'll produce our own vector consistent with that. For 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L? That would be 7.3. But wait, CVSS 4.0 base score 5.5 given, but they set VC:L/VI:L/VA:L (low impact for all). In CVSS 3.1, Low for all is 5.3? Let's check: CVSS 3.1 base score with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (High) actually. Wait, no: CVSS 3.1, network vector, low complexity, no privileges, no interaction, unchanged scope, low confidentiality, low integrity, low availability -> 7.3 (High). But they gave CVSS 4.0 5.5 which is lower than 7.0. That's because CVSS 4.0 reweights impacts. So we need to decide our own assessment. Given the product is a simple currency exchange system, impact might be low: maybe reading some data, altering some data, causing some downtime. We'll adopt that impact, so CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Rationale: SQL injection, remote unauthenticated, low complexity, low impact across all. CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That matches the given vector but we set E:P (exploit maturity public) in our vector? In base vector we don't include temporal metrics; base only. So our assessed CVSS 4.0 base vector would be CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the same as provided base (they had E:P in temporal, but base is fine). We'll output that. Rationale: "Unvalidated user input in SQL query, low impact due to limited data exposure." CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), which includes SQL injection. Product name: "Currency Exchange System" (from code-projects). So product_name: "Currency Exchange System". But the description says "code-projects Currency Exchange System 1.0". So primary: "Currency Exchange System". Could also be "code-projects Currency Exchange System" but the instructions say 1-3 words, so "Currency Exchange System" is enough. We'll use "Currency Exchange System". Summary: Original synthesis, not copying description. Mention it's a SQL injection in /viewserial.php parameter ID, remote unauthenticated, exploit disclosed. Not in KEV, EPSS low. So: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to extract or modify database contents via the ID parameter in /viewserial.php." Something like that. Technical context: Mention the web application, PHP, MySQL? CPE indicates 'fabian' vendor, product currency_exchange_system:1.0. The vulnerability is SQL injection (CWE-74) due to improper input sanitization in the PHP script. Use CPE data. Risk assessment: CVSS 4.0 score 5.5 (medium). EPSS 0.04% (lowest percentile). No KEV. POC public. So threat is low despite medium CVSS. The product appears to be a small code-projects project, likely not widely deployed. So risk is low. Mention that CVSS vector indicates network attack, low complexity, no privileges, low impact, making it easy to exploit but limited damage. EPSS low indicates low likelihood of widespread exploitation. Not in KEV, so not actively targeted in the wild. So it's not a high priority for most organizations. SSVC: Exploitation (POC public) but not automatable? SQL injection can be automated. Technical impact partially controlled (low). But given real-world usage, low risk. So overall: "While CVSS score suggests a medium-severity vulnerability with easy remote exploitation, EPSS probability is very low (0.04%) indicating negligible likelihood of widespread exploitation. The software is a simple academic-style project with limited deployment, further reducing real-world risk. Not in CISA KEV, so no targeted exploitation observed." Affected products: "Currency Exchange System 1.0 by code-projects (vendor: fabian). CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*" Reference advisory: EUVD, VulDB, but no official vendor advisory from code-projects. We'll list references provided. "Affected product: code-projects Currency Exchange System version 1.0 (CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*). See VulDB advisory (https://vuldb.com/?id.334658) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." Remediation: No patch available from the original source (code-projects). The references don't indicate a fix. We'll state: "No vendor patch has been released as the software appears to be unmaintained; consider disabling the application or restricting network access. As a workaround, sanitize the ID parameter in /viewserial.php by using parameterized queries or input validation. Alternatively, block access to /viewserial.php via web server rules. Trade-off: blocking may disrupt legitimate functionality if required." Then mention advisory URLs. Exploit scenario: Attacker sends a crafted request to /viewserial.php with a malicious ID parameter containing SQL injection payload, extracting data or modifying the database. POC exists. Attack vector is network, low complexity. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default installation of Currency Exchange System 1.0. The vulnerable parameter ID is exposed in /viewserial.php with no input validation. The attack does not require authentication or user interaction." Limiting factors: none, just the product's low deployment. Attack chain: "Send HTTP GET request to /viewserial.php with crafted ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Extract or modify sensitive data." Confidence notes: "Vulnerability confirmed by VulDB and included in NVD with public exploit. No vendor advisory or patch version exists. Affected version is confirmed as 1.0 by CPE; no other versions known." Prevalence: "rare" - because it's a simple academic project, not widely deployed. Prevalence_basis: "small code-projects demo, unlikely deployed in enterprise." Now, build JSON. All fields must be strings. I'll construct each paragraph as plain text without bullet points. product_name: "Currency Exchange System" summary: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate the database via the ID parameter in /viewserial.php. Exploit code is publicly available but active exploitation has not been observed, and EPSS probability is very low. This low-impact flaw can lead to data exposure or modification." technical_context: "The application is a PHP-based web system using a MySQL database, where the script /viewserial.php fails to properly sanitize the ID parameter before constructing SQL queries, leading to CWE-74 (Injection). The CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:* identifies the product as a lightweight web application from code-projects, likely intended for educational or demonstration purposes." risk_assessment: "The CVSS 4.0 base score of 5.5 (Medium) reflects a network-exploitable, unauthenticated SQL injection with low impact on confidentiality, integrity, and availability. However, EPSS score of 0.04% (11th percentile) indicates a very low probability of widespread exploitation. The product is not listed in CISA KEV, confirming no observed active targeting. Given the software’s limited real-world deployment, the actual risk is low for most organizations. There is no scope change or privilege escalation indicated, but the vulnerability is trivially exploitable via a single HTTP request." affected_products: "The only affected product is code-projects Currency Exchange System version 1.0, represented by CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*. No later versions or patches are documented. Advisory information is available at VulDB (https://vuldb.com/?id.334658) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." remediation: "No official patch exists, as the code-projects software appears unmaintained. In the absence of a vendor fix, restrict network access to the application or disable it entirely. If the application must stay active, implement input validation on the ID parameter in /viewserial.php to block SQL metacharacters, or better, rewrite the database access using parameterized queries. An additional compensating control is to block access to /viewserial.php via web server rules. However, these workarounds may disrupt legitimate functionality if the endpoint is required." exploit_scenario: "An attacker remotely accesses /viewserial.php and supplies a crafted ID parameter containing an SQL injection payload. The unsanitized input is embedded directly into a database query, allowing the attacker to execute arbitrary SQL commands—extracting user credentials, modifying exchange rates, or deleting records. A working proof-of-concept exploit is publicly available." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default installations of Currency Exchange System 1.0. The vulnerable endpoint /viewserial.php is publicly accessible, and the ID parameter is processed without authentication or input sanitization, requiring no user interaction." attack_chain: "Craft HTTP GET request with malicious ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Exfiltrate or manipulate sensitive data." confidence_notes: "Confirmed by VulDB and NVD; public exploit available via GitHub and VulDB. No vendor patch or official advisory from the original developer (code-projects) exists. The affected version is exactly 1.0 as per CPE. EPSS score is low, and no active exploitation has been reported." prevalence: "rare" prevalence_basis: "small demo project from code-projects, minimal enterprise footprint." assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" assessed_cvss_rationale: "SQL injection via web parameter, no auth required; impact limited to database read/write." assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now I'll double-check each field complies with rules. Confidence notes: we stated "public exploit available" but not "confirmed actively exploited", as no KEV. Good. Exploit scenario
SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject SQL via the roll_number parameter in /member_search.php. Exploit code is publicly available, but EPSS score is low (0.04%) and no active exploitation has been confirmed by CISA. Attackers may read, modify, or delete database entries depending on database user privileges.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the book_id parameter in /delete_book.php, potentially resulting in unauthorized data access or modification. No authentication is required, and public exploit code is available, as documented by VulDB and NVD.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate the user_id parameter in /delete_member.php, potentially leading to unauthorized database access or data modification. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%), and no active exploitation has been confirmed through CISA KEV.
SQL injection in Campcodes School File Management System 1.0 allows unauthenticated remote attackers to inject SQL via the stud_id parameter in /update_query.php. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%) and the CISA KEV catalog does not list it. The vulnerability has a CVSS 4.0 score of 5.5 (Medium), reflecting limited impact on confidentiality, integrity, and availability.
Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configuration Streaming Destination input.
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.
In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them.
A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is "to discourage automated scraping / bots, not guarantee resistance to determined attackers." The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”
Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7.
A use-after-free condition in the Linux kernel's Bluetooth HCI command-synchronization layer (hci_sync) lets a race between hci_cmd_sync_dequeue_once() and hci_cmd_sync_work() delete the same list entry twice, corrupting kernel memory. It affects the mainline Linux kernel Bluetooth stack up to the fixed stable releases (6.1.159, 6.6.117, 6.12.58, 6.17.8) and is fixed upstream. There is no public exploit identified and EPSS is very low (0.04%), but the NVD-scored CVSS of 8.8 reflects the high-impact memory-corruption potential (denial of service and possible privilege escalation) if the race is won.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Handle lock during peer_id find ath12k_peer_find_by_id() requires that the caller hold the ab->base_lock. Currently the WBM error path does not hold the lock and calling that function, leads to the following lockdep_assert()in QCN9274: [105162.160893] ------------[ cut here ]------------ [105162.160916] WARNING: CPU: 3 PID: 0 at drivers/net/wireless/ath/ath12k/peer.c:71 ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160933] Modules linked in: ath12k(O) qrtr_mhi qrtr mac80211 cfg80211 mhi qmi_helpers libarc4 nvme nvme_core [last unloaded: ath12k(O)] [105162.160967] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G W O 6.1.0-rc2+ #3 [105162.160972] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0056.2019.0506.1527 05/06/2019 [105162.160977] RIP: 0010:ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160990] Code: 07 eb 0f 39 68 24 74 0a 48 8b 00 48 39 f8 75 f3 31 c0 5b 5d c3 48 8d bf b0 f2 00 00 be ff ff ff ff e8 22 20 c4 e2 85 c0 75 bf <0f> 0b eb bb 66 2e 0f 1f 84 00 00 00 00 00 41 54 4c 8d a7 98 f2 00 [105162.160996] RSP: 0018:ffffa223001acc60 EFLAGS: 00010246 [105162.161003] RAX: 0000000000000000 RBX: ffff9f0573940000 RCX: 0000000000000000 [105162.161008] RDX: 0000000000000001 RSI: ffffffffa3951c8e RDI: ffffffffa39a96d7 [105162.161013] RBP: 000000000000000a R08: 0000000000000000 R09: 0000000000000000 [105162.161017] R10: ffffa223001acb40 R11: ffffffffa3d57c60 R12: ffff9f057394f2e0 [105162.161022] R13: ffff9f0573940000 R14: ffff9f04ecd659c0 R15: ffff9f04d5a9b040 [105162.161026] FS: 0000000000000000(0000) GS:ffff9f0575600000(0000) knlGS:0000000000000000 [105162.161031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105162.161036] CR2: 00001d5c8277a008 CR3: 00000001e6224006 CR4: 00000000003706e0 [105162.161041] Call Trace: [105162.161046] <IRQ> [105162.161051] ath12k_dp_rx_process_wbm_err+0x6da/0xaf0 [ath12k] [105162.161072] ? ath12k_dp_rx_process_err+0x80e/0x15a0 [ath12k] [105162.161084] ? __lock_acquire+0x4ca/0x1a60 [105162.161104] ath12k_dp_service_srng+0x263/0x310 [ath12k] [105162.161120] ath12k_pci_ext_grp_napi_poll+0x1c/0x70 [ath12k] [105162.161133] __napi_poll+0x22/0x260 [105162.161141] net_rx_action+0x2f8/0x380 [105162.161153] __do_softirq+0xd0/0x4c9 [105162.161162] irq_exit_rcu+0x88/0xe0 [105162.161169] common_interrupt+0xa5/0xc0 [105162.161174] </IRQ> [105162.161179] <TASK> [105162.161184] asm_common_interrupt+0x22/0x40 Handle spin lock/unlock in WBM error path to hold the necessary lock expected by ath12k_peer_find_by_id(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-03171-QCAHKSWPL_SILICONZ-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code now tries to iterate over the list backwards to ensure the links are cleanup before its parents, also it no longer relies on a cursor, instead it always uses the last element since hci_abort_conn_sync is guaranteed to call hci_conn_del. UAF crash log: ================================================================== BUG: KASAN: slab-use-after-free in hci_set_powered_sync (net/bluetooth/hci_sync.c:5424) [bluetooth] Read of size 8 at addr ffff888009d9c000 by task kworker/u9:0/124 CPU: 0 PID: 124 Comm: kworker/u9:0 Tainted: G W 6.5.0-rc1+ #10 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xdd/0x160 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] kasan_report+0xa6/0xe0 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] ? __pfx_set_powered_sync+0x10/0x10 [bluetooth] hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] ? __pfx_hci_set_powered_sync+0x10/0x10 [bluetooth] ? __pfx_lock_release+0x10/0x10 ? __pfx_set_powered_sync+0x10/0x10 [bluetooth] hci_cmd_sync_work+0x137/0x220 [bluetooth] process_one_work+0x526/0x9d0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? mark_held_locks+0x1a/0x90 worker_thread+0x92/0x630 ? __pfx_worker_thread+0x10/0x10 kthread+0x196/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> Allocated by task 1782: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x8f/0xa0 hci_conn_add+0xa5/0xa80 [bluetooth] hci_bind_cis+0x881/0x9b0 [bluetooth] iso_connect_cis+0x121/0x520 [bluetooth] iso_sock_connect+0x3f6/0x790 [bluetooth] __sys_connect+0x109/0x130 __x64_sys_connect+0x40/0x50 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 695: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 __kasan_slab_free+0x10a/0x180 __kmem_cache_free+0x14d/0x2e0 device_release+0x5d/0xf0 kobject_put+0xdf/0x270 hci_disconn_complete_evt+0x274/0x3a0 [bluetooth] hci_event_packet+0x579/0x7e0 [bluetooth] hci_rx_work+0x287/0xaa0 [bluetooth] process_one_work+0x526/0x9d0 worker_thread+0x92/0x630 kthread+0x196/0x1e0 ret_from_fork+0x2c/0x50 ==================================================================
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge.
Denial-of-service (and potential out-of-bounds read) in the Linux kernel's virtio-net driver lets a malicious or compromised virtualization host crash guest VMs by announcing a receive buffer length larger than the guest allocated for 'big packets' mode. The flaw stems from an incomplete length check introduced when commit 4959aebba8c0 changed big-packet buffer sizing from a fixed MAX_SKB_FRAGS * PAGE_SIZE to an MTU-dependent value, leaving the receive-path validation stale. No public exploit has been identified at time of analysis, and EPSS is very low (0.04%), consistent with a host-to-guest condition rather than internet-facing mass exploitation.
Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.
Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability.
In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting (XSS). On the backend, the related_vulnerabilities field of bundles accepted arbitrary strings without format validation or proper sanitization. On the frontend, comment and bundle descriptions were converted from Markdown to HTML and then injected directly into the DOM using string templates and innerHTML. This combination allowed an attacker who could create or edit comments or bundles to store crafted HTML/JavaScript payloads which would later be rendered and executed in the browser of any user visiting the affected profile page (user.html). This issue affects Vulnerability-Lookup: before 2.18.0.
A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.