Arteco DVR/NVR web client uses session IDs with insufficient complexity, allowing brute-force attacks to hijack active sessions and access live camera streams without authentication. PoC available.
H3C wireless controllers (M102G) and access points (BA1500L) have a vsftpd misconfiguration that grants root ownership to anonymously uploaded FTP files. Attackers can upload malicious files that execute with root privileges, gaining full device control.
iccDEV ICC color profile library (through 2.3.1) has a use-after-free in CIccXform::Create() when processing hint objects. Processing a malicious ICC profile can lead to code execution. PoC available, fixed in 2.3.1.1.
Sony BRAVIA Digital Signage 1.7.8 has an IDOR vulnerability that allows attackers to access hidden system resources like /#/content-creation by bypassing client-side access restrictions. PoC available.
NJHYST HY511 POE core (before 2.1) allows unauthenticated download of the configuration file containing usernames and self-decrypted MD5 passwords, due to insufficient cookie verification. PoC available.
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root. [CVSS 8.8 HIGH]
iccDEV color management library versions 2.3.1 and earlier contain undefined behavior in the CLUT initialization function that can be exploited remotely without authentication to achieve code execution, information disclosure, or denial of service. Public exploit code exists for this vulnerability which affects all users of the vulnerable library versions. A patch is available in version 2.3.1.1 and should be applied immediately.
iccDEV ICC color profile libraries versions 2.3.1.1 and earlier suffer from undefined behavior and out-of-memory errors that can be exploited remotely without authentication to achieve code execution or denial of service. Public exploit code exists for this vulnerability, affecting users who have not upgraded to version 2.3.1.2 or later. An attacker can trigger memory corruption through specially crafted ICC profile inputs with user interaction.
Buffer overflow in Tenda AC23 firmware version 16.03.07.52 allows remote attackers with low privileges to achieve complete system compromise through a malformed Time parameter in the /goform/PowerSaveSet function. Public exploit code exists for this vulnerability, creating immediate risk to affected devices. No patch is currently available.
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. [CVSS 8.8 HIGH]
Heap buffer overflow in iccDEV versions 2.3.1 and earlier allows remote attackers to execute arbitrary code or crash the application through malformed ICC color profile data processed by the CIccMBB::Validate function. Public exploit code exists for this vulnerability, which affects all users handling untrusted color profiles. Upgrade to version 2.3.1.1 or later to remediate.
TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files. [CVSS 8.8 HIGH]
Integer overflow in iccDEV's CIccXmlArrayType::ParseTextCountNum() function allows local attackers with user interaction to achieve arbitrary code execution through maliciously crafted ICC color profile files. The vulnerability affects iccDEV versions 2.3.1 and below, impacting users who process untrusted color profiles. Public exploit code exists for this vulnerability, and a patch is available in version 2.3.1.1.
Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption. [CVSS 7.5 HIGH]
Bravia Signage contains a vulnerability that allows attackers to access sensitive system details through API endpoints (CVSS 7.5).
undocumented proxy API is affected by inclusion of functionality from untrusted control sphere (CVSS 7.5).
iccDEV ICC color profile processing library versions 2.3.1 and below contain an infinite loop in the CalcProfileID function that allows unauthenticated remote attackers to cause denial of service. Public exploit code exists for this vulnerability, and affected systems should upgrade to version 2.3.1.1 or later to remediate the issue.
Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. [CVSS 7.5 HIGH]
Local attackers can exploit a type confusion vulnerability in iccDEV 2.3.1.1 and earlier during XML curve serialization to cause denial of service or achieve information disclosure. The flaw exists in the CIccSingleSampledeCurveXml class and affects systems using vulnerable versions of the ICC color management library. Public exploit code exists for this vulnerability, though a patch is available in version 2.3.1.2.
SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI script. [CVSS 6.5 MEDIUM]
The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. [CVSS 6.5 MEDIUM]
Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows attackers to inject arbitrary client-side scripts through the content material URL parameter. [CVSS 6.1 MEDIUM]
iccDEV versions 2.3.1.1 and below allow local attackers to cause a denial of service or leak sensitive memory through improper input validation in the CIccProfile::LoadTag function, which fails to properly validate ICC profile data before processing. Public exploit code exists for this vulnerability, and a patch is available in version 2.3.1.2.
A buffer overflow in iccDEV versions before 2.3.1.2 affects users processing ICC color profiles through the library's CIccTagTextDescription component, allowing local attackers with user interaction to cause denial of service or potentially read sensitive memory. Public exploit code exists for this vulnerability. The issue has been patched in version 2.3.1.2.
Heap buffer overflow in iccDEV versions before 2.3.1.2 allows local attackers with user interaction to cause denial of service or disclose sensitive information when processing malicious ICC color profiles through the CIccTagLut16::Validate() function. Public exploit code exists for this vulnerability. A patch is available in version 2.3.1.2 with no known workarounds.
Multiple Themify WordPress themes (Sidepane, Newsy, Folo, Edmin, Bloggie, Photobox, Wigi, Rezo, Slide) allow authenticated users to upload web shells. Low privileges sufficient, scope change to OS-level code execution. Affects 9 themes simultaneously.
AS Password Field plugin for WordPress (through 2.0.0) allows unauthenticated password resets for any user without identity verification. Like CVE-2025-14998 (Branda), this enables immediate administrator account takeover.
FS Registration Password plugin for WordPress (through 1.0.1) allows unauthenticated password resets for any user. Same vulnerability class as CVE-2025-14996 (AS Password Field) – missing identity verification before password change.
Blue Access Cobalt v02.000.195 has an authentication bypass through selective request proxying. Attackers can manipulate proxy behavior to access web application functions without legitimate credentials.
wolfSSH through 1.4.21 has a key exchange state machine vulnerability that can leak client passwords in cleartext, trick clients into sending bogus signatures, or skip user authentication entirely. A fundamental protocol implementation flaw.
Plexus Digital Signage Management 3.1.13 has an open redirect via the 'pagina' parameter in the PantallaLogin script. While typically a medium-severity issue, the CVSS 9.8 rating suggests broader exploitation potential through chaining with other vulnerabilities in the signage platform.
InWave Jobs WordPress plugin (through 3.5.8) has missing authorization allowing unauthenticated access to restricted functionality. The maximum CVSS score indicates complete compromise of confidentiality, integrity, and availability.
TECNO Mobile's Boomplayer app (v7.4.63) has insufficient data authenticity verification allowing authentication bypass. A pre-installed app vulnerability affecting TECNO phone users.
Crypt::Sodium::XS for Perl bundles a vulnerable version of libsodium (<= 1.0.20) that has a signature verification flaw. In atypical use cases with custom cryptography, this can compromise data authenticity guarantees. Patch available.
Online Music Site versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
Local denial of service in iccDEV versions prior to 2.3.1.2 allows an unauthenticated user with local access to crash applications processing ICC color profiles through a null pointer dereference. Public exploit code exists for this vulnerability. Users should upgrade to version 2.3.1.2 or later, as no workarounds are available.
Snapgear Sg560 Firmware versions up to 3.1.5 is affected by cross-site request forgery (csrf) (CVSS 5.3).
badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. [CVSS 5.3 MEDIUM]
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. [CVSS 7.2 HIGH]
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.25. [CVSS 8.8 HIGH]
Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Restriction for WordPress: from n/a through 3.0.2; Responsive Coming Soon Landing Page / Holding Page for WordPress: from n/a through 3.0. [CVSS 8.8 HIGH]
OpenBlocks firmware versions before 5.0.8 contain an authentication bypass vulnerability that allows unauthenticated attackers on adjacent networks to gain administrator access and reset passwords without valid credentials. This high-severity flaw affects all OpenBlocks series devices and requires no user interaction to exploit, though no patch is currently available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.4. [CVSS 6.5 MEDIUM]
Local privilege escalation in AirVPN Eddie 2.24.6 for macOS lets an unprivileged local user gain root by abusing an insecure XPC helper service. Because the privileged helper exposes its XPC interface without properly validating connecting clients, any local account can invoke privileged operations and elevate to root. No public exploit has been identified at time of analysis and EPSS risk is very low (0.02%), consistent with a local-only, non-remote flaw.
iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. [CVSS 4.3 MEDIUM]
P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. [CVSS 4.3 MEDIUM]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jwsthemes Issabella allows PHP Local File Inclusion.This issue affects Issabella: from n/a through 1.1.2. [CVSS 8.1 HIGH]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Frappé allows PHP Local File Inclusion.This issue affects Frappé: from n/a through 1.8. [CVSS 8.1 HIGH]
A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte. [CVSS 8.1 HIGH]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issue affects WPCHURCH: from n/a through 2.7.0. [CVSS 8.1 HIGH]