Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-08 04:37Z
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25377 — Flash: Slideshow Maker Professional 5.20 contains a buffer overflow vulnerability in the registration dialog

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25377

Flash Slideshow Maker Professional 5.20 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload and paste it into the Name and Code fields of the Help > Register dialog to trigger a reverse shell with system privileges. CVSSv3.1 8.4 (HIGH)

CWECWE 120VNDFlashTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25376 — Socusoft: 3GP Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25376

Socusoft 3GP Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft malicious input in the Registration Name and Registration Key fields to overwrite the SEH chain and execute shellcode for reverse shell access. CVSSv3.1 8.4 (HIGH)

CWECWE 120VNDSocusoftTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25375 — SocuSoft: iPod Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25375

SocuSoft iPod Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary code by overwriting the structured exception handler. Attackers can craft malicious input in the Registration Name and Registration Key fields to trigger a stack-based buffer overflow and execute a reverse shell payload. CVSSv3.1 8.4 (HIGH)

CWECWE 121VNDSocusoftTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25373 — SocuSoft: DVD Photo Slideshow Professional 8.07 contains a stack-based buffer overflow vulnerability in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25373

SocuSoft DVD Photo Slideshow Professional 8.07 contains a stack-based buffer overflow vulnerability in the registration name field that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious text file with carefully constructed payload containing junk bytes, SEH chain overwrite, and shellcode, then paste the contents into the Registration Name field via Help > Register to trigger code execution. CVSSv3.1 8.4 (HIGH)

CWECWE 121VNDSocusoftTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25372 — MedDream: PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25372

MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the email parameter. Attackers can submit crafted POST requests to the userSignup.php endpoint with SQL payloads in the email field to extract sensitive database information from the backend MySQL database. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDMeddreamTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25371 — Store: mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25371

mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the product parameter in URL rewrite functionality. Attackers can inject SQL code using boolean-based blind, time-based blind, or stacked query techniques in the product URI parameter to extract sensitive database information. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDStoreTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25366 — CuteFTP: 5.0 XP contains a buffer overflow vulnerability that allows local attackers to execute

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25366

CuteFTP 5.0 XP contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by injecting malicious payload into the Site Manager label field. Attackers can craft a payload exceeding 520 bytes that overwrites the return address and executes shellcode when a shortcut is created and launched. CVSSv3.1 8.4 (HIGH)

CWECWE 120VNDCuteftpTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25364 — Twitter: Twitter-Clone 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25364

Twitter-Clone 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the name parameter. Attackers can submit crafted payloads to the search.php endpoint to extract database information including usernames, credentials, and system data using error-based and union-based SQL injection techniques. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDTwitterTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25362 — Twitter: Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25362

Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL code through the userid parameter. Attackers can submit union-based or time-based blind SQL injection payloads to extract sensitive database information including usernames, passwords, and database credentials. CVSSv3.1 8.2 (HIGH)

CWECWE 89VNDTwitterTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25360 — AgataSoft: Auto PingMaster 1.5 contains a stack-based buffer overflow vulnerability in the Trace Route

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25360

AgataSoft Auto PingMaster 1.5 contains a stack-based buffer overflow vulnerability in the Trace Route host name field that allows local attackers to execute arbitrary code by triggering structured exception handling. Attackers can craft a malicious ping.txt file with shellcode and jump instructions that overwrite the SEH handler pointer to achieve code execution when the file contents are pasted into the application. CVSSv3.1 8.4 (HIGH)

CWECWE 121VNDAgatasoftTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-25
2026-05-25 15:16Z
HIGH

CVE-2018-25359 — Splinterware: System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2018-25359

Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by modifying service executable files. Attackers can rename the WService.exe file in the installation directory and replace it with a malicious executable that executes with LocalSystem privileges when the service is triggered. CVSSv3.1 8.4 (HIGH)

CWECWE 276VNDSplinterwareTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-05-25
2026-05-25 14:16Z
HIGH

CVE-2026-9461 — The manipulation of the argument submit-url leads to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9461

A security vulnerability has been detected in Edimax EW-7438RPn 1.31. Affected is the function formRadius of the file /goform/formRadius. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-25
2026-05-25 14:16Z
HIGH

CVE-2026-9460 — Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9460

A weakness has been identified in Edimax EW-7438RPn 1.31. This impacts the function formAccept of the file /goform/formAccept. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-25
2026-05-25 14:16Z
HIGH

CVE-2026-9459 — Performing a manipulation of the argument max_Conn/timeOut results in stack-based buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9459

A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConnectionSetting. Performing a manipulation of the argument max_Conn/timeOut results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 121CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-25
2026-05-25 14:16Z
CRIT

CVE-2026-9458 — Totolink: Such manipulation of the argument enabled leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9458

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument enabled leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-25
2026-05-25 14:16Z
CRIT

CVE-2026-9457 — Totolink: This manipulation of the argument FileName causes os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9457

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-25
2026-05-25 13:16Z
CRIT

CVE-2026-9456 — Totolink: The manipulation of the argument enabled results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9456

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enabled results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-25
2026-05-25 13:16Z
CRIT

CVE-2026-9455 — The manipulation of the argument FileName leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9455

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument FileName leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-25
2026-05-25 13:16Z
CRIT

CVE-2026-9454 — Executing a manipulation of the argument servername can lead to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9454

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument servername can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-25
2026-05-25 10:16Z
HIGH

CVE-2026-9443 — The manipulation of the argument L2TPUserName leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9443

A security vulnerability has been detected in Edimax BR-6478AC 1.23. This vulnerability affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. The manipulation of the argument L2TPUserName leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-25
2026-05-25 10:16Z
HIGH

CVE-2026-9442 — Executing a manipulation of the argument selSSID can lead to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9442

A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the component POST Request Handler. Executing a manipulation of the argument selSSID can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.8 (HIGH)

CWECWE 120CWECWE 119TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-05-25
2026-05-25 10:16Z
HIGH

CVE-2026-45361 — Apache: Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45361

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later. CVSSv3.1 8.1 (HIGH)

CWECWE 322VNDApacheTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-05-25
2026-05-25 08:16Z
CRIT

CVE-2026-9436 — Executing a manipulation of the argument enable can lead to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9436

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-25
2026-05-25 08:16Z
CRIT

CVE-2026-9435 — Totolink: Performing a manipulation of the argument enable results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9435

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setQosCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument enable results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78VNDTotolinkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-05-25
2026-05-25 07:16Z
CRIT

CVE-2026-9434 — Such manipulation of the argument wscDisabled leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9434

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setWiFiWpsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument wscDisabled leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. CVSSv3.1 9.8 (CRITICAL)

CWECWE 77CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score