Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-23 07:00Z
2025-01-27
2025-01-27 14:15Z
CRIT

CVE-2025-24664 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-24664

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows SQL Injection.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-01-27
2025-01-27 14:15Z
CRIT

CVE-2025-24612 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-24612

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-01-27
2025-01-27 14:15Z
CRIT

CVE-2025-24601 — Deserialization: of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-24601

Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-01-27
2025-01-27 00:00Z
HIGH

Linux Detection Engineering - A Continuation on Persistence Mechanisms

Elastic Security Labs·elastic.co

Elastic Security Labs publishes part three of a Linux persistence detection engineering series, detailing T1574.006 (dynamic linker hijacking via LD_PRELOAD/LD_LIBRARY_PATH), T1547.006 (kernel module persistence), and T1014 (rootkits). The article provides theory, practical setup instructions using PANIX (a custom Linux persistence tool), detection rules, and threat-hunting queries via ES|QL and OSQuery.

SRFOsTACTA0005TACTA0003OSLinuxTYPResearchTYPToolSTGDefense EvasionSTGPersistence
72
Edit Score
2025-01-24
2025-01-24 20:15Z
MED

CVE-2024-57041 — Nodebb Nodebb: A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-57041

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile. CVSSv3.1 4.6 (MEDIUM) · EPSS 98th percentile

CWECWE 79VNDXssVNDNodebbTYPVulnerability
4.6
CVSS v3.1
81
Edit Score
2025-01-24
2025-01-24 18:15Z
HIGH

CVE-2025-24728 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-24728

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL Injection.This issue affects Bug Library: from n/a through <= 2.1.4. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-01-24
2025-01-24 18:15Z
HIGH

CVE-2025-24672 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-24672

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through <= 1.2.41. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-01-24
2025-01-24 18:15Z
HIGH

CVE-2025-24669 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-24669

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through <= 4.4. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-01-24
2025-01-24 18:15Z
CRIT

CVE-2025-24650 — Themefic Tourfic: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-24650

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434VNDThemeficTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-01-24
2025-01-24 00:00Z
INFO

WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables

Elastic Security Labs·elastic.co

Elastic Security Labs released WinVisor, a hypervisor-based emulator for Windows x64 user-mode executables that leverages the Windows Hypervisor Platform (WHP) API to execute binaries in a virtualized environment with syscall logging and memory introspection capabilities. The tool uses hardware-assisted virtualization (VT-x/AMD-V) to execute code at native speeds rather than through software emulation, and automatically clones the address space of a suspended target process to handle complex Windows initialization structures.

SRFOsOSWindowsSWWinvisorVNDMicrosoftTYPResearchTYPToolTECT1027TECT1202
72
Edit Score
2025-01-23
2025-01-23 14:15Z
CRIT

CVE-2024-57947 — Linux Linux_kernel: This makes pipapo find an incorrect matching results for sets where first field size

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-57947

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo: fix initial map fill The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size. After each round in the map search step, the result and the fill map are swapped, so if we have a set where f->bsize of the first element is smaller than m->bsize_max, those one-bits are leaked into future rounds result map. This CVSSv3.1 9.8 (CRITICAL)

CWECWE 401TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-01-23
2025-01-23 12:15Z
CRIT

CVE-2025-23006 — Sonicwall Sma8200v: Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23006in the wild

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile

CWECWE 502VNDSonicwallVNDPreTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2025-01-22
2025-01-22 16:15Z
CRIT

CVE-2025-23914 — Deserialization: of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23914

Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-01-22
2025-01-22 15:15Z
CRIT

CVE-2025-23953 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23953

Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows Upload a Web Shell to a Web Server.This issue affects user files: from n/a through <= 2.4.2. CVSSv3.1 10.0 (CRITICAL)

CWECWE 434TYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2025-01-22
2025-01-22 15:15Z
HIGH

CVE-2025-23949 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23949

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dzeriho Improved Sale Badges – Free Version improved-sale-badges-free-version allows PHP Local File Inclusion.This issue affects Improved Sale Badges – Free Version: from n/a through <= 1.0.1. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-01-22
2025-01-22 15:15Z
HIGH

CVE-2025-23948 — Control: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23948

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webarea Background animation blocks background-animation-blocks allows PHP Local File Inclusion.This issue affects Background animation blocks: from n/a through <= 2.1.5. CVSSv3.1 8.1 (HIGH)

CWECWE 98TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-01-22
2025-01-22 15:15Z
HIGH

CVE-2025-23944 — Deserialization: of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23944

Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0. CVSSv3.1 8.8 (HIGH)

CWECWE 502TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-01-22
2025-01-22 15:15Z
CRIT

CVE-2025-23942 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23942

Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This issue affects WP Load Gallery: from n/a through <= 2.1.6. CVSSv3.1 9.1 (CRITICAL)

CWECWE 434TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2025-01-22
2025-01-22 15:15Z
CRIT

CVE-2025-23932 — Deserialization: of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23932

Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-01-22
2025-01-22 15:15Z
CRIT

CVE-2025-23931 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23931

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through <= 2.3. CVSSv3.1 9.3 (CRITICAL)

CWECWE 89TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2025-01-22
2025-01-22 15:15Z
CRIT

CVE-2025-23921 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23921

Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through <= 1.1.3. CVSSv3.1 9.0 (CRITICAL)

CWECWE 434TYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2025-01-22
2025-01-22 15:15Z
CRIT

CVE-2025-23918 — Upload: Unrestricted Upload of File with Dangerous Type vulnerability in Enrico Sandoli Smallerik File Browser

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23918

Unrestricted Upload of File with Dangerous Type vulnerability in Enrico Sandoli Smallerik File Browser smallerik-file-browser allows Upload a Web Shell to a Web Server.This issue affects Smallerik File Browser: from n/a through <= 1.1. CVSSv3.1 9.9 (CRITICAL)

CWECWE 434TYPVulnerability
9.9
CVSS v3.1
100
Edit Score
2025-01-22
2025-01-22 15:15Z
HIGH

CVE-2025-23910 — Neutralization: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-23910

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in keighl Menus Plus+ menus-plus allows SQL Injection.This issue affects Menus Plus+: from n/a through <= 1.9.6. CVSSv3.1 8.5 (HIGH)

CWECWE 89TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-01-22
2025-01-22 15:15Z
HIGH

CVE-2023-36998 — NextEPC: The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-36998

The NextEPC MME <= 1.0.1 (fixed in commit a8492c9c5bc0a66c6999cb5a263545b32a4109df) contains a stack-based buffer overflow vulnerability in the Emergency Number List decoding method. An attacker may send a NAS message containing an oversized Emergency Number List value to the MME to overwrite the stack with arbitrary bytes. An attacker with a cellphone connection to any base station managed by the MME may exploit this vulnerability without having to authenticate with the LTE CVSSv3.1 8.9 (HIGH) · EPSS 32th percentile

CWECWE 121VNDNextepcTYPVulnerability
8.9
CVSS v3.1
95
Edit Score
2025-01-22
2025-01-22 05:15Z
HIGH

CVE-2024-11218 — A vulnerability was found in `podman build` and `buildah.` This issue occurs in a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-11218

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host. CVSSv3.1 8.6 (HIGH) · EPSS 28th percentile

CWECWE 269TYPVulnerability
8.6
CVSS v3.1
93
Edit Score