CVE-2024-13618

Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF

The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Osteopathic

Products

Downloadable By American Osteopathic Association

CVE-2024-13617

Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download

The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Osteopathic

Products

Downloadable By American Osteopathic Association

CVE-2025-5886

Emlog article.php cross site scripting

A vulnerability was found in Emlog up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin/article.php. The manipulation of the argument active_post leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Emlog

Products

Emlog

CVE-2025-48013

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Quick Node Block Project

Products

Quick Node Block

CVE-2025-48444

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Quick Node Block Project

Products

Quick Node Block

CVE-2025-48447

Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Lightgallery Project

Products

Lightgallery

CVE-2025-6130

TOTOLINK EX1200T HTTP POST Request formStats buffer overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formStats of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

Ex1200t Ex1200t Firmware

CVE-2025-6138

TOTOLINK T10 HTTP POST Request cstecgi.cgi setWizardCfg buffer overflow

A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ssid5g leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

T10 T10 Firmware

CVE-2025-47015

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2025-46990

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2025-47007

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2025-47033

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Experience Manager Experience Manager

CVE-2025-5739

TOTOLINK X15 HTTP POST Request formSaveConfig buffer overflow

A vulnerability classified as critical has been found in TOTOLINK X15 1.0.0-B20230714.1105. This affects an unknown part of the file /boafrm/formSaveConfig of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 7.5% KEV · Not listed

Vendors

Totolink

Products

X15 X15 Firmware

CVE-2025-0313

ollama: Improper Validation of Array Index in ollama/ollama

** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-12055. Notes: All CVE users should reference CVE-2024-12055 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.0 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Ollama

Products

Ollama

CVE-2025-23088

nodejs: End-of-Life Node.js Versions Pose Security Risks 19.x

This Record was REJECTED after determining it is not in compliance with CVE Program requirements regarding assignment for vulnerabilities

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Nodejs

Products

Node.js

CVE-2025-6110

Tenda FH1201 SafeMacFilter stack-based overflow

A vulnerability classified as critical has been found in Tenda FH1201 1.2.0.14(408). This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 6.0% KEV · Not listed

Vendors

Tenda

Products

Fh1201 Fh1201 Firmware

CVE-2025-6115

D-Link DIR-619L form_macfilter stack-based overflow

A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function form_macfilter. The manipulation of the argument mac_hostname_%d/sched_name_%d leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS 1.7% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-619l Dir-619l Dir-619l Firmware

CVE-2025-6114

D-Link DIR-619L form_portforwarding stack-based overflow

A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this vulnerability is the function form_portforwarding of the file /goform/form_portforwarding. The manipulation of the argument ingress_name_%d/sched_name_%d/name_%d leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS 1.7% KEV · Not listed

Vendors

D-link Dlink

Products

Dir-619l Dir-619l Dir-619l Firmware

CVE-2025-6113

Tenda FH1203 AdvSetLanip fromadvsetlanip buffer overflow

A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. Affected is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.4% KEV · Not listed

Vendors

Tenda

Products

Fh1203 Fh1203 Firmware

CVE-2025-6111

Tenda FH1205 VirtualSer fromVirtualSer stack-based overflow

A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Tenda

Products

Fh1205 Fh1205 Firmware