CVE-2025-13000 to CVE-2025-13999

263 CVEs with public proof-of-concept exploits.

• CVE-2025-130001 PoCDB Access <= 0.8.7 - Subscriber+ SQLi
• CVE-2025-130011 PoCDonation <= 1.0 - Admin+ SQLi
• CVE-2025-130291 PoCKnowband Mobile App Builder for wooCommerce < 3.0.0 – Unauthenticated Arbitrary User Deletion
• CVE-2025-130311 PoCWPeMatico RSS Feed Fetcher < 2.8.13 - Contributor+ Stored XSS
• CVE-2025-130571 PoCCampcodes School Fees Payment Management System ajax.php sql injection
• CVE-2025-130591 PoCSourceCodester Alumni Management System manage_career.php sql injection
• CVE-2025-130601 PoCSourceCodester Survey Application System view_survey.php sql injection
• CVE-2025-130611 PoCitsourcecode Online Voting System index.php unrestricted upload
• CVE-2025-130631 PoCDinukaNavaratna Dee Store authorization
• CVE-2025-130701 PoCCSV to SortTable <= 4.2 - Contributor+ LFI
• CVE-2025-130711 PoCCustom Admin Menu <= 1.0.0 - Reflected XSS
• CVE-2025-130721 PoCHandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source
• CVE-2025-130731 PoCHandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page
• CVE-2025-130751 PoCcode-projects Responsive Hotel Site usersettingdel.php sql injection
• CVE-2025-130761 PoCcode-projects Responsive Hotel Site usersetting.php sql injection
• CVE-2025-130781 PoCImproper Validation of Specified Quantity in Input in GitLab
• CVE-2025-131141 PoCmacrozheng mall-swarm attr updateAttr improper authorization
• CVE-2025-131151 PoCmacrozheng mall-swarm/mall Order Details detail improper authorization
• CVE-2025-131161 PoCmacrozheng mall-swarm/mall cancelUserOrder improper authorization
• CVE-2025-131171 PoCmacrozheng mall-swarm/mall cancelOrder improper authorization
• CVE-2025-131181 PoCmacrozheng mall-swarm paySuccess improper authorization
• CVE-2025-131201 PoCmruby array.c sort_cmp use after free
• CVE-2025-131211 PoCcameasy Liketea API Endpoint StoreController.php list sql injection
• CVE-2025-131231 PoCAMTT Hotel Broadband Operation System get_firstdate.php sql injection
• CVE-2025-131381 PoCWP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
• CVE-2025-131531 PoCLogo Slider < 4.9.0 - Contributor+ Stored XSS
• CVE-2025-131681 PoCury-erp ury pos_extend.py overrided_past_order_list sql injection
• CVE-2025-131691 PoCcode-projects Simple Online Hotel Reservation System add_query_reserve.php sql injection
• CVE-2025-131701 PoCcode-projects Simple Online Hotel Reservation System edit_account.php sql injection
• CVE-2025-131711 PoCZZCMS wangkan_list.php sql injection
• CVE-2025-131721 PoCCodeAstro Gym Management System view-member-report.php sql injection
• CVE-2025-131741 PoCrachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery
• CVE-2025-131771 PoCBdtask/CodeCanyon SalesERP cross-site request forgery
• CVE-2025-131781 PoCBdtask/CodeCanyon SalesERP User Profile edit_profile cross site scripting
• CVE-2025-131791 PoCBdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System cross-site request forgery
• CVE-2025-131801 PoCBdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scripting
• CVE-2025-131811 PoCpojoin h3blog add cross site scripting
• CVE-2025-131821 PoCpojoin h3blog addtitle cross site scripting
• CVE-2025-131851 PoCBdtask/CodeCanyon News365 profile unrestricted upload
• CVE-2025-131861 PoCBdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting
• CVE-2025-131871 PoCIntelbras ICIP acessodeusuario.xml credentials storage
• CVE-2025-131881 PoCD-Link DIR-816L authentication.cgi authenticationcgi_main stack-based overflow
• CVE-2025-131891 PoCD-Link DIR-816L gena.cgi genacgi_main stack-based overflow
• CVE-2025-131901 PoCD-Link DIR-816L __ajax_exporer.sgi scandir_main stack-based overflow
• CVE-2025-131911 PoCD-Link DIR-816L soap.cgi soapcgi_main stack-based overflow
• CVE-2025-131981 PoCDouPHP file.class.php unrestricted upload
• CVE-2025-131991 PoCcode-projects Email Logging Interface signup.cpp path traversal
• CVE-2025-132001 PoCSourceCodester Farm Management System exposure of information through directory listing
• CVE-2025-132011 PoCcode-projects Simple Cafe Ordering System login.php sql injection
• CVE-2025-132031 PoCcode-projects Simple Cafe Ordering System addmem.php sql injection
• CVE-2025-132042 PoCsCVE-2025-13204
• CVE-2025-132081 PoCFantasticLBP Hotels Server hotelList.php sql injection
• CVE-2025-132091 PoCbestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference
• CVE-2025-132101 PoCitsourcecode Inventory Management System index.php sql injection
• CVE-2025-132211 PoCIntelbras UnniTI usuarios.xml credentials storage
• CVE-2025-132331 PoCitsourcecode Inventory Management System index.php sql injection
• CVE-2025-132341 PoCitsourcecode Inventory Management System index.php sql injection
• CVE-2025-132351 PoCitsourcecode Inventory Management System login.php sql injection
• CVE-2025-132361 PoCitsourcecode Inventory Management System index.php sql injection
• CVE-2025-132371 PoCitsourcecode Inventory Management System LogSignModal.PHP sql injection
• CVE-2025-132381 PoCBdtask Flight Booking Software Edit Profile edit unrestricted upload
• CVE-2025-132391 PoCBdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit_checkout behavioral workflow
• CVE-2025-132401 PoCcode-projects Student Information System searchquery.php sql injection
• CVE-2025-132411 PoCcode-projects Student Information System index.php sql injection
• CVE-2025-132421 PoCcode-projects Student Information System register.php sql injection
• CVE-2025-132431 PoCcode-projects Student Information System editprofile.php sql injection
• CVE-2025-132441 PoCcode-projects Student Information System register.php cross site scripting
• CVE-2025-132451 PoCcode-projects Student Information System editprofile.php cross site scripting
• CVE-2025-132461 PoCshsuishang ShopSuite ModulithShop JwtAuthenticationFilter.java JwtAuthenticationFilter path traversal
• CVE-2025-132471 PoCPHPGurukul Tourism Management System user-bookings.php sql injection
• CVE-2025-132481 PoCSourceCodester Patients Waiting Area Queue Management System api_patient_schedule.php sql injection
• CVE-2025-132491 PoCJiusi OA OfficeServer unrestricted upload
• CVE-2025-132501 PoCWeiYe-Jing datax-web Job triggerJob access control
• CVE-2025-132511 PoCWeiYe-Jing datax-web sql injection
• CVE-2025-132521 PoCshsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentials
• CVE-2025-132531 PoCprojectworlds Advanced Library Management System add_librarian.php sql injection
• CVE-2025-132541 PoCprojectworlds Advanced Library Management System add_member.php sql injection
• CVE-2025-132551 PoCprojectworlds Advanced Library Management System book_search.php sql injection
• CVE-2025-132561 PoCprojectworlds Advanced Library Management System borrow.php sql injection
• CVE-2025-132571 PoCitsourcecode Inventory Management System index.php sql injection
• CVE-2025-132581 PoCTenda AC20 WifiExtraSet buffer overflow
• CVE-2025-132591 PoCCampcodes Supplier Management System edit_unit.php sql injection
• CVE-2025-132601 PoCCampcodes Supplier Management System edit_product.php sql injection
• CVE-2025-132611 PoClsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal
• CVE-2025-132621 PoClsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal
• CVE-2025-132631 PoCSourceCodester Online Magazine Management System categories.php sql injection
• CVE-2025-132641 PoCSourceCodester Online Magazine Management System view_magazine.php sql injection
• CVE-2025-132661 PoCwwwlike vlife VLifeApi SysFileApi.java create path traversal
• CVE-2025-132671 PoCSourceCodester Dental Clinic Appointment Reservation System success.php sql injection
• CVE-2025-132681 PoCDromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection
• CVE-2025-132691 PoCCampcodes School Fees Payment Management System ajax.php sql injection
• CVE-2025-132701 PoCCampcodes School Fees Payment Management System ajax.php sql injection
• CVE-2025-132711 PoCCampcodes School Fees Payment Management System ajax.php sql injection
• CVE-2025-132721 PoCCampcodes School Fees Payment Management System manage_course.php sql injection
• CVE-2025-132731 PoCCampcodes School Fees Payment Management System ajax.php sql injection
• CVE-2025-132741 PoCCampcodes School Fees Payment Management System ajax.php sql injection
• CVE-2025-132751 PoCIqbolshoh php-business-website about.php unrestricted upload
• CVE-2025-132761 PoCg33kyrash Online-Banking-System index.php sql injection
• CVE-2025-132771 PoCcode-projects Nero Social Networking Site friendsphoto.php sql injection
• CVE-2025-132781 PoCprojectworlds Advanced Library Management System borrowed_book_search.php sql injection
• CVE-2025-132791 PoCcode-projects Nero Social Networking Site profilefriends.php sql injection
• CVE-2025-132801 PoCCodeAstro Simple Inventory System Login index.php sql injection
• CVE-2025-132851 PoCitsourcecode Online Voting System login.php sql injection
• CVE-2025-132861 PoCitsourcecode Online Voting System ajax.php sql injection
• CVE-2025-132871 PoCitsourcecode Online Voting System index.php sql injection
• CVE-2025-132881 PoCTenda CH22 PPTPUserSetting fromPptpUserSetting buffer overflow
• CVE-2025-132891 PoC1000projects Design & Development of Student Database Management System SubjectDetails.php sql injection
• CVE-2025-132901 PoCcode-projects Simple Food Ordering System saveorder.php sql injection
• CVE-2025-132911 PoCCampcodes Supplier Management System confirm_order.php sql injection
• CVE-2025-132971 PoCitsourcecode Web-Based Internet Laboratory Management System controller.php sql injection
• CVE-2025-132981 PoCitsourcecode Web-Based Internet Laboratory Management System controller.php sql injection
• CVE-2025-132991 PoCitsourcecode Web-Based Internet Laboratory Management System controller.php sql injection
• CVE-2025-133001 PoCitsourcecode Web-Based Internet Laboratory Management System controller.php sql injection
• CVE-2025-133011 PoCitsourcecode Web-Based Internet Laboratory Management System controller.php sql injection
• CVE-2025-133021 PoCcode-projects Courier Management System add-new-officer.php sql injection
• CVE-2025-133031 PoCcode-projects Courier Management System search-edit.php sql injection
• CVE-2025-133041 PoCD-Link DWR-M920/DWR-M921/DWR-M960/DWR-M961/DIR-825M formPingDiagnosticRun buffer overflow
• CVE-2025-133051 PoCD-Link DWR-M920/DWR-M921/DWR-M960/DIR-822K/DIR-825M formTracerouteDiagnosticRun buffer overflow
• CVE-2025-133061 PoCD-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injection
• CVE-2025-133071 PoCOcean Modal Window < 2.3.3 - Editor+ Remote Code Execution via Modal Conditions
• CVE-2025-133152 PoCsUnauthenticated log access in Twonky Server
• CVE-2025-133231 PoCcode-projects Simple Pizza Ordering System listorder.php sql injection
• CVE-2025-133251 PoCitsourcecode Student Information System enrollment_edit1.php sql injection
• CVE-2025-133351 PoCLoop with Unreachable Exit Condition ('Infinite Loop') in GitLab
• CVE-2025-133391 PoCHippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
• CVE-2025-133423 PoCsFrontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
• CVE-2025-133431 PoCSourceCodester Interview Management System editQuestion.php cross site scripting
• CVE-2025-133441 PoCSourceCodester Train Station Ticketing System ajax.php sql injection
• CVE-2025-133451 PoCSourceCodester Train Station Ticketing System ajax.php sql injection
• CVE-2025-133461 PoCSourceCodester Train Station Ticketing System ajax.php sql injection
• CVE-2025-133471 PoCSourceCodester Train Station Ticketing System ajax.php sql injection
• CVE-2025-133491 PoCSourceCodester Student Grades Management System Add New Grade grades.php cross site scripting
• CVE-2025-133551 PoCURL Shortify < 1.11.4 - Reflected XSS
• CVE-2025-133741 PoCKalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action
• CVE-2025-133801 PoCAI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read
• CVE-2025-133903 PoCsWP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
• CVE-2025-133951 PoCcodehub666 94list function.php login sql injection
• CVE-2025-133961 PoCcode-projects Courier Management System add-office.php sql injection
• CVE-2025-134001 PoCTenda CH22 WrlExtraGet formWrlExtraGet buffer overflow
• CVE-2025-134072 PoCsGravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload
• CVE-2025-134101 PoCCampcodes Retro Basketball Shoes Online Store receipt.php sql injection
• CVE-2025-134111 PoCCampcodes Retro Basketball Shoes Online Store admin_football.php unrestricted upload
• CVE-2025-134121 PoCCampcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting
• CVE-2025-134171 PoCPlugin Organizer < 10.2.4 - Subscriber+ SQLi
• CVE-2025-134181 PoCResponsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting
• CVE-2025-134201 PoCitsourcecode Human Resource Management System EventStore.php sql injection
• CVE-2025-134211 PoCitsourcecode Human Resource Management System NoticeStore.php sql injection
• CVE-2025-134221 PoCfreeprojectscodes Sports Club Management System change_s_pwd.php sql injection
• CVE-2025-134231 PoCCampcodes Retro Basketball Shoes Online Store admin_product.php unrestricted upload
• CVE-2025-134241 PoCCampcodes Supplier Management System add_product.php sql injection
• CVE-2025-134251 PoCDenial of Service in OSV-SCALIBR
• CVE-2025-134341 PoCjameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntax
• CVE-2025-134351 PoCDreampie Resty HttpClient HttpClient.java request path traversal
• CVE-2025-134361 PoCAllocation of Resources Without Limits or Throttling in GitLab
• CVE-2025-134421 PoCUTT 进取 750W formPdbUpConfig system command injection
• CVE-2025-134431 PoCmacrozheng mall delete access control
• CVE-2025-134451 PoCTenda AC21 SetIpMacBind stack-based overflow
• CVE-2025-134461 PoCTenda AC21 SetSysTimeCfg stack-based overflow
• CVE-2025-134491 PoCcode-projects Online Shop Project login.php sql injection
• CVE-2025-134501 PoCSourceCodester Online Shop Project register.php cross site scripting
• CVE-2025-134511 PoCSourceCodester Online Shop Project action.php sql injection
• CVE-2025-134561 PoCShopbuilder < 3.2.2 - Reflected XSS
• CVE-2025-134651 PoCPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions
• CVE-2025-134681 PoCSourceCodester Alumni Management System Delete admin_class.php delete_event authorization
• CVE-2025-134711 PoCUser Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update
• CVE-2025-134841 PoCCampcodes Complete Online Beauty Parlor Management System customer-list.php cross site scripting
• CVE-2025-134851 PoCitsourcecode Online File Management System ajax.php sql injection
• CVE-2025-134867 PoCsAdvanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
• CVE-2025-135281 PoCFeedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data'…
• CVE-2025-135441 PoCashraf-kabir travel-agency customer_register.php unrestricted upload
• CVE-2025-135451 PoCashraf-kabir travel-agency index.php sql injection
• CVE-2025-135461 PoCashraf-kabir travel-agency Search results.php sql injection
• CVE-2025-135471 PoCD-Link DIR-822K/DWR-M920 formDdns memory corruption
• CVE-2025-135481 PoCD-Link DIR-822K/DWR-M920 formFirewallAdv buffer overflow
• CVE-2025-135491 PoCD-Link DIR-822K formNtp sub_455524 buffer overflow
• CVE-2025-135501 PoCD-Link DIR-822K/DWR-M920 formVpnConfigSetup buffer overflow
• CVE-2025-135511 PoCD-Link DIR-822K/DWR-M920 formWanConfigSetup buffer overflow
• CVE-2025-135521 PoCD-Link DIR-822K/DWR-M920 formWlEncrypt buffer overflow
• CVE-2025-135531 PoCD-Link DWR-M920 formPinManageSetup sub_41C7FC buffer overflow
• CVE-2025-135541 PoCCampcodes Supplier Management System Login index.php sql injection
• CVE-2025-135551 PoCCampcodes School File Management System Login index.php sql injection
• CVE-2025-135561 PoCCampcodes Online Polling System checklogin.php sql injection
• CVE-2025-135571 PoCCampcodes Online Polling System registeracc.php sql injection
• CVE-2025-135601 PoCSourceCodester Company Website CMS reset-password.php sql injection
• CVE-2025-135611 PoCSourceCodester Company Website CMS index.php sql injection
• CVE-2025-135621 PoCD-Link DIR-852 gena.cgi command injection
• CVE-2025-135641 PoCSourceCodester Pre-School Management System FilehelperController.php removefile denial of service
• CVE-2025-135651 PoCSourceCodester Inventory Management System resetPassword.php password recovery
• CVE-2025-135671 PoCitsourcecode COVID Tracking System page sql injection
• CVE-2025-135681 PoCitsourcecode COVID Tracking System page sql injection
• CVE-2025-135691 PoCitsourcecode COVID Tracking System page sql injection
• CVE-2025-135701 PoCitsourcecode COVID Tracking System page sql injection
• CVE-2025-135711 PoCcode-projects Simple Food Ordering System listorder.php sql injection
• CVE-2025-135721 PoCprojectworlds Advanced Library Management System delete_admin.php sql injection
• CVE-2025-135731 PoCprojectworlds can pass malicious payloads add_book.php unrestricted upload
• CVE-2025-135741 PoCcode-projects Online Bidding System addcategory.php categoryadd unrestricted upload
• CVE-2025-135751 PoCcode-projects Blog Site Category blog.php category_exists sql injection
• CVE-2025-135761 PoCcode-projects Blog Site admin.php improper authorization
• CVE-2025-135781 PoCcode-projects Library System Login index.php sql injection
• CVE-2025-135791 PoCcode-projects Library System return.php sql injection
• CVE-2025-135801 PoCcode-projects Library System mail.php sql injection
• CVE-2025-135811 PoCitsourcecode Student Information System schedule_edit1.php sql injection
• CVE-2025-135821 PoCcode-projects Jonnys Liquor GET Parameter detail.php sql injection
• CVE-2025-135831 PoCcode-projects Question Paper Generator POST Parameter signupscript.php sql injection
• CVE-2025-135841 PoCEigenfocus Description cross site scripting
• CVE-2025-135851 PoCitsourcecode COVID Tracking System login.php sql injection
• CVE-2025-135861 PoCSourceCodester Online Student Clearance System changepassword.php sql injection
• CVE-2025-135881 PoClKinderBueno Streamity Xtream IPTV Player proxy.php server-side request forgery
• CVE-2025-135951 PoCCIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload
• CVE-2025-135971 PoCAI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload
• CVE-2025-136061 PoCExport All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
• CVE-2025-136151 PoCStreamTube Core <= 4.78 - Unauthenticated Arbitrary User Password Change
• CVE-2025-136521 PoCCBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter
• CVE-2025-136731 PoCTutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
• CVE-2025-136901 PoCAllocation of Resources Without Limits or Throttling in GitLab
• CVE-2025-137611 PoCImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
• CVE-2025-137731 PoCPrint Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
• CVE-2025-137802 PoCsRemote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
• CVE-2025-137811 PoCMissing Authorization in GitLab
• CVE-2025-137821 PoCtaosir WTCMS SlideController SlideController.class.php delete sql injection
• CVE-2025-137831 PoCtaosir WTCMS CommentadminController CommentadminController.class.php delete sql injection
• CVE-2025-137841 PoCyungifez Skuul School Management System SVG File edit cross site scripting
• CVE-2025-137851 PoCyungifez Skuul School Management System Image profile information disclosure
• CVE-2025-137861 PoCtaosir WTCMS index.php fetch code injection
• CVE-2025-137881 PoCChanjet CRM upgradeattribute.php sql injection
• CVE-2025-137891 PoCZenTao model.php makeRequest server-side request forgery
• CVE-2025-137901 PoCScada-LTS cross-site request forgery
• CVE-2025-137911 PoCScada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal
• CVE-2025-137921 PoCQualitor getResumo.php eval code injection
• CVE-2025-137931 PoCwinston-dsouza Ecommerce-Website GET Parameter header_menu.php cross site scripting
• CVE-2025-137951 PoCcodingWithElias School Management System Edit Student Info student-view.php cross site scripting
• CVE-2025-137961 PoCdeco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery
• CVE-2025-137971 PoCADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injection
• CVE-2025-137981 PoCADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_add command injection
• CVE-2025-137991 PoCADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_del command injection
• CVE-2025-138001 PoCADSLR NBR1005GPEV2 send_order.cgi set_mesh_disconnect command injection
• CVE-2025-138011 PoCYoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
• CVE-2025-138021 PoCjairiidriss RestaurantWebsite Make a Reservation cross site scripting
• CVE-2025-138041 PoCnutzam NutzBoot Ethereum Wallet EthModule.java information disclosure
• CVE-2025-138051 PoCnutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserialization
• CVE-2025-138061 PoCnutzam NutzBoot Transaction API EthModule.java improper authorization
• CVE-2025-138071 PoCorionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization
• CVE-2025-138081 PoCorionsec orion-ops User Profile UserController.java update improper authorization
• CVE-2025-138091 PoCorionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery
• CVE-2025-138101 PoCjsnjfz WebStack-Guns KaptchaController.java renderPicture path traversal
• CVE-2025-138111 PoCjsnjfz WebStack-Guns PageFactory.java sql injection
• CVE-2025-138131 PoCmoxi159753 Mogu Blog v2 Storage Management Endpoint storage authorization
• CVE-2025-138141 PoCmoxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery
• CVE-2025-138151 PoCmoxi159753 Mogu Blog v2 pictures unrestricted upload
• CVE-2025-138161 PoCmoxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversal
• CVE-2025-138201 PoCComments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover
• CVE-2025-138741 PoCAuthorization Bypass Through User-Controlled Key in GitLab
• CVE-2025-138751 PoCYohann0617 oci-helper OCI Configuration Upload OciServiceImpl.java addCfg path traversal
• CVE-2025-138761 PoCRareprob HD Video Player All Formats App com.rocks.music.videoplayer path traversal
• CVE-2025-138771 PoCnocobase JWT Service jwt-service.ts hard-coded key
• CVE-2025-139201 PoCWP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
• CVE-2025-139271 PoCAllocation of Resources Without Limits or Throttling in GitLab
• CVE-2025-139281 PoCIncorrect Authorization in GitLab
• CVE-2025-139291 PoCAllocation of Resources Without Limits or Throttling in GitLab
• CVE-2025-139481 PoCopsre go-ldap-admin JWT docker-compose.yaml hard-coded key
• CVE-2025-139491 PoCProudMuBai GoFilm FileController.go SingleUpload unrestricted upload
• CVE-2025-139561 PoCLearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
• CVE-2025-139581 PoCYaMaps < 0.6.40 - Contributor+ Stored XSS