CVE-2025-69000 to CVE-2025-69999
36 CVEs with public proof-of-concept exploits.
- CVE-2025-690801 PoCWordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability
- CVE-2025-691941 PoCWget2: arbitrary file write via metalink path traversal in gnu wget2
- CVE-2025-691961 PoCFastMCP OAuth Proxy token reuse across MCP servers
- CVE-2025-692002 PoCsphpMyFAQ has unauthenticated config backup download via /api/setup/backup
- CVE-2025-692031 PoCSignal K Server Vulnerable to Access Request Spoofing
- CVE-2025-692061 PoCHemmelig has SSRF Filter bypass in Secret Request functionality
- CVE-2025-692071 PoCKhoj has an IDOR in Notion OAuth Flow Enables Index Poisoning
- CVE-2025-692101 PoCFacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
- CVE-2025-6921211 PoCsOpenSTAManager has an OS Command Injection in P7M File Processing
- CVE-2025-692131 PoCOpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
- CVE-2025-692141 PoCOpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
- CVE-2025-692151 PoCOpenSTAManager has an SQL Injection in the Stampe Module
- CVE-2025-692161 PoCOpenSTAManager has an SQL Injection in Scadenzario Print Template
- CVE-2025-692192 PoCsApache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator
- CVE-2025-692551 PoCRustFS gRPC GetMetrics deserialization panic enables remote DoS
- CVE-2025-692561 PoCserverless MCP Server vulnerable to command injection in list-projects tool
- CVE-2025-692621 PoCpnpm vulnerable to Command Injection via environment variable substitution
- CVE-2025-692631 PoCpnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies
- CVE-2025-692641 PoCpnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
- CVE-2025-692871 PoCBSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability
- CVE-2025-694111 PoCWordPress ionCube tester plus plugin <= 1.3 - Arbitrary File Download vulnerability
- CVE-2025-694191 PoCOut of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
- CVE-2025-694201 PoCMissing ASN1_TYPE validation in TS_RESP_verify_response() function
- CVE-2025-694211 PoCNULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
- CVE-2025-695151 PoCAn issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting…
- CVE-2025-695162 PoCsA Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting…
- CVE-2025-696001 PoCCommand injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via…
- CVE-2025-696011 PoCA directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode. Uploaded ZIP…
- CVE-2025-696041 PoCAn issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary…
- CVE-2025-696121 PoCA path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software. The "Download…
- CVE-2025-696911 PoCNetgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API…
- CVE-2025-697251 PoCAn Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to…
- CVE-2025-699291 PoCAn issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the…
- CVE-2025-699711 PoCFUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to…
- CVE-2025-699853 PoCsFUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in…
- CVE-2025-699931 PoCLeaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders…