Base de CVEs

CVE-2025-15453 Média · 6.3 CWE-20 05/01/2026

milvus HTTP Endpoint expr.go expr.Exec deserialization

A security vulnerability has been detected in milvus up to 2.6.7. This vulnerability affects the function expr.Exec of the file pkg/util/expr/expr.go of the component HTTP Endpoint. The manipulation of the argument code leads to deserialization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. A fix is planned for the next release 2.6.8.

CVE-2025-69288 Crítica · 9.1 CWE-20 31/12/2025

Titra has Remote Code Execution in Admin Functionality

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

CVE-2025-15246 Média · 6.3 CWE-20 30/12/2025

aizuda snail-job API FurySerializer.deserialize deserialization

A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the component API. This manipulation of the argument argsStr causes deserialization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVE-2025-15358 Alta · 7.5 CWE-20 30/12/2025

DVP-12SE11T - Denial of Service Vulnerability

CVE-2025-15222 Média · 5.0 CWE-20 30/12/2025

Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization

A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-15284 Baixa · 3.7 CWE-20 29/12/2025

arrayLimit bypass in bracket notation allows DoS via memory exhaustion

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly. Details The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2). Vulnerable code (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No arrayLimit check } Working code (lib/parse.js:175): else if (index <= options.arrayLimit) { // Limit checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays. PoC const qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 }); console.log(result.a.length); // Output: 6 (should be max 5) Note on parameterLimit interaction: The original advisory's "DoS demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000. Impact Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.

CVE-2025-69205 Média · 6.3 CWE-20 29/12/2025

In µURU, a Specially Crafted Federation Name Allows Dialplan Injection

Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the `Dial( )` application due to improper input validation. This allows an attacker to redirect calls on both of the federating instances. If the attack succeeds, the impact is very high. However, the requires that an admin accept the federation requests. As of time of publication, a known patched version of µURU is not available.

CVE-2025-66866 Alta · 7.5 CWE-20 29/12/2025

Improper Input Validation em Gnu Binutils

An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

CVE-2025-66864 Alta · 7.5 CWE-20 29/12/2025

Improper Input Validation em Gnu Binutils

An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

CVE-2025-15117 Baixa · 3.1 CWE-20 28/12/2025

Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization

A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-52600 Alta · 7.2 CWE-20 26/12/2025

Improper Input Validation

Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in camera video analytics that Improper input validation. This vulnerability could allow an attacker to execute specific commands on the user's host PC.The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.

CVE-2025-8769 Crítica · 9.8 CWE-20 24/12/2025

MegaSys Computer Technologies Telenium Online Web Application Improper Input Validation

Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page. Due to improper input validation, an attacker can inject arbitrary Perl code through a crafted HTTP request, leading to remote code execution on the server.

CVE-2025-68667 Crítica · 9.9 CWE-20 23/12/2025

Homeservers Matrix derivados do Conduit: Confused Deputy e validação imprópria de entrada (CVE-2025-68667)

Conduit é um servidor de chat baseado no Matrix. Uma vulnerabilidade que afeta vários homeservers derivados do Conduit permite que um atacante remoto e não autenticado force o servidor alvo a assinar criptograficamente eventos de associação arbitrários. Os produtos afetados incluem Conduit anterior à versão 0.10.10, continuwuity anterior à versão 0.5.0, Grapevine anterior ao commit 9a50c244 e tuwunel anterior à versão 1.4.8. A falha existe porque o servidor não valida a origem de uma solicitação de assinatura, desde que o state_key do evento seja um ID de usuário válido pertencente ao servidor alvo. Atacantes podem forjar eventos “leave” para qualquer usuário do servidor alvo. Isso remove à força usuários (incluindo administradores e bots) de salas. Isso permite negação de serviço e/ou a remoção de proteções técnicas de uma sala (incluindo servidores de políticas, se todos os usuários do servidor de políticas forem removidos). Atacantes podem forjar eventos “invite” de um usuário vítima para si mesmos, desde que possuam uma conta em um servidor onde exista uma conta com nível de permissão para enviar convites. Isso permite que o atacante entre em salas privadas ou somente por convite acessíveis pela vítima, expondo o histórico de conversas confidenciais e o estado da sala. Atacantes podem forjar eventos “ban” de um usuário vítima para qualquer usuário abaixo do nível de permissão da vítima, desde que a vítima tenha permissão para banir E o alvo do banimento resida no mesmo servidor da vítima. Isso permite banir qualquer pessoa em uma sala que esteja no mesmo servidor vulnerável, porém não permite explorar isso para banir usuários de outros servidores nem a própria vítima. O Conduit corrige o problema na versão 0.10.10. O continuwuity corrige o problema nos commits 7fa4fa98 e b2bead67, lançados na versão 0.5.0. O tuwunel corrige o problema no commit dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3, lançado na versão 1.4.8. O Grapevine corrige o problema no commit 9a50c2448abba6e2b7d79c64243bb438b351616c. Como solução alternativa, bloqueie o acesso ao endpoint PUT /_matrix/federation/v2/invite/{roomId}/{eventId} usando seu proxy reverso.

CVE-2025-59886 Alta · 8.8 CWE-20 23/12/2025

Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could...

Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upon retirement or end of support, there will be no new security updates, non-security updates, or paid assisted support options, or online technical content updates.

CVE-2025-59301 Alta · 7.5 CWE-20 22/12/2025

Modbus/TCP Dos Vulnerability in DVP15MC11T

Delta Electronics DVP15MC11T lacks proper validation of the modbus/tcp packets and can lead to denial of service.

CVE-2025-68398 Crítica · 9.1 CWE-20 18/12/2025

Weblate has git config file overwrite vulnerability that leads to remote code execution

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

CVE-2025-67163 Média · 6.1 CWE-20 18/12/2025

Improper Input Validation em Simplemachines Simple Machines Forum

A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter.

CVE-2025-65561 Alta · 7.5 CWE-20 18/12/2025

Improper Input Validation em Free5gc

An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.

CVE-2025-67493 Crítica · 9.0 CWE-20 17/12/2025

Homarr: missing input sanitization and possible privilege escalation through ldap search query injection

Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.

CVE-2025-43533 Média · 5.7 CWE-20 17/12/2025

Improper Input Validation em Apple Ipados

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash.

CVE-2025-67170 Média · 6.1 CWE-20 17/12/2025

Improper Input Validation em Ritecms

A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.

CVE-2025-66923 Alta · 7.2 CWE-20 17/12/2025

Improper Input Validation em Opensourcepos Open Source Point Of Sale

A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter.

CVE-2025-66921 Alta · 7.2 CWE-20 17/12/2025

Improper Input Validation em Opensourcepos Open Source Point Of Sale

A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.

CVE-2025-20393 Crítica · 10.0 KEV Alta · 69 Exploit público CWE-20 17/12/2025

Cisco Multiple Products Improper Input Validation Vulnerability

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

CVE-2025-14156 Crítica · 9.8 CWE-20 15/12/2025

Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'

The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.