Activity

Latest CVE events and analysis as they emerge

  1. CVE-2025-47812

    14 Jul 2025, 00:00

    Wing FTP Server

    Added to CISA KEV catalog

    Vulnerability name
    Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
    Product
    Wing FTP Server Wing FTP Server

    CVE-2025-47812 is a remote code execution vulnerability in Wing FTP Server. The vulnerability arises because the application doesn't properly handle NULL bytes in usernames. By appending a NULL byte to the username, an attacker can bypass authentication and inject Lua code into session files. Specifically, when a user authenticates with a NULL-byte injected username, the server creates a new session ID and stores the NULL byte in the session variable. This allows an attacker to inject arbitrary Lua code, leading to remote code execution with root privileges on Linux systems and SYSTEM rights on Windows systems because the wftpserver runs with elevated privileges by default.

  2. CVE-2025-25257

    13 Jul 2025, 10:17

    FortiWebFortinet

    Trended on social media

    Hype increased to 30

    CVE-2025-25257 is a critical SQL injection vulnerability found in Fortinet's FortiWeb web application firewall. This vulnerability, classified as CWE-89, stems from improper neutralization of special elements used in SQL commands. The vulnerability allows unauthenticated attackers to execute unauthorized SQL code or commands by sending crafted HTTP or HTTPS requests to the FortiWeb management interface. Successful exploitation could lead to attackers accessing sensitive data, altering database contents, or compromising backend systems.

  3. CVE-2025-6554

    12 Jul 2025, 02:17

    Google Chrome V8

    Trended on social media

    Hype increased to 32

    CVE-2025-6554 is a type confusion vulnerability found in the V8 JavaScript engine, which is used in Chrome and other Chromium-based browsers. This vulnerability can be exploited by remote, unauthenticated attackers by serving crafted HTML pages to targeted users. If successful, the attacker can trick V8 into misinterpreting memory types, potentially leading to arbitrary read/write operations. In some scenarios, this could allow for full remote code execution. Google is aware that the vulnerability is being actively exploited in the wild. A security update has been released for Chrome to address this zero-day vulnerability. The vulnerability was discovered by Clément Lecigne of Google's Threat Analysis Group (TAG) on June 25, 2025.

  4. CVE-2025-5777

    11 Jul 2025, 22:17

    NetScaler ADCNetScaler GatewayCitrix

    Trended on social media

    Hype increased to 30

    CVE-2025-5777 is a vulnerability affecting NetScaler ADC and NetScaler Gateway. It is caused by insufficient input validation, which leads to a memory overread. The vulnerability can be exploited on devices configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. An unauthorized attacker could potentially grab valid session tokens from the memory of internet-facing NetScaler devices by sending a malformed request. Successful exploitation could allow the attacker to gain access to the appliances.

  5. CVE-2025-25257

    11 Jul 2025, 20:17

    FortiWebFortinet

    Trended on social media

    Hype increased to 30

    CVE-2025-25257 is a critical SQL injection vulnerability found in Fortinet's FortiWeb web application firewall. This vulnerability, classified as CWE-89, stems from improper neutralization of special elements used in SQL commands. The vulnerability allows unauthenticated attackers to execute unauthorized SQL code or commands by sending crafted HTTP or HTTPS requests to the FortiWeb management interface. Successful exploitation could lead to attackers accessing sensitive data, altering database contents, or compromising backend systems.

  6. CVE-2025-47812

    11 Jul 2025, 18:17

    Wing FTP Server

    Trended on social media

    Hype increased to 31

    CVE-2025-47812 is a remote code execution vulnerability in Wing FTP Server. The vulnerability arises because the application doesn't properly handle NULL bytes in usernames. By appending a NULL byte to the username, an attacker can bypass authentication and inject Lua code into session files. Specifically, when a user authenticates with a NULL-byte injected username, the server creates a new session ID and stores the NULL byte in the session variable. This allows an attacker to inject arbitrary Lua code, leading to remote code execution with root privileges on Linux systems and SYSTEM rights on Windows systems because the wftpserver runs with elevated privileges by default.

  7. CVE-2024-30088

    11 Jul 2025, 06:17

    Trended on social media

    Hype increased to 30

    CVE-2024-30088 is an elevation of privilege vulnerability in the Windows Kernel. It is a Time-Of-Check Time-Of-Use (TOCTOU) race condition, meaning that the state of a resource can change between when it is checked and when it is used, which can lead to unexpected actions. An attacker can exploit this vulnerability to run code with elevated privileges on a vulnerable system. This vulnerability has been actively exploited in the wild, including by the OilRig APT group, which is known for cyber espionage. Successful exploitation could allow an attacker to gain complete control over the affected system. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which requires timely patching.

  8. CVE-2025-3648

    10 Jul 2025, 09:17

    Now Platform

    Trended on social media

    Hype increased to 34

    CVE-2025-3648 is a vulnerability in the Now Platform that could allow unauthorized data inference. It stems from conditional access control list (ACL) configurations. Unauthenticated and authenticated users could exploit this vulnerability using range query requests to infer instance data that they should not have access to. The vulnerability impacts the record count UI element on list pages. By exploiting this, malicious actors could gain unauthorized access to sensitive information, including personally identifiable information (PII) and credentials. ServiceNow has introduced additional access control frameworks and a security update in May 2025 to help customers enhance access controls.

  9. CVE-2025-47978

    10 Jul 2025, 09:17

    Windows Kerberos

    Trended on social media

    Hype increased to 33

    CVE-2025-47978 is an out-of-bounds read vulnerability affecting Windows Kerberos. An authorized attacker can exploit this vulnerability to trigger a denial-of-service (DoS) condition over a network. The vulnerability lies within the Windows Kerberos authentication system. Successful exploitation could disrupt network authentication services, potentially causing system unavailability for legitimate users. A security update addressing this vulnerability has been available since July 8, 2025, for Windows Server 2022, Windows Server 2025, and Windows Server 23H2.

  10. CVE-2025-5777

    10 Jul 2025, 00:00

    NetScaler ADCNetScaler GatewayCitrix

    Added to CISA KEV catalog

    Vulnerability name
    Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
    Product
    Citrix NetScaler ADC and Gateway

    CVE-2025-5777 is a vulnerability affecting NetScaler ADC and NetScaler Gateway. It is caused by insufficient input validation, which leads to a memory overread. The vulnerability can be exploited on devices configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. An unauthorized attacker could potentially grab valid session tokens from the memory of internet-facing NetScaler devices by sending a malformed request. Successful exploitation could allow the attacker to gain access to the appliances.

  11. CVE-2025-25257

    09 Jul 2025, 17:17

    FortiWebFortinet

    Trended on social media

    Hype increased to 32

    CVE-2025-25257 is a critical SQL injection vulnerability found in Fortinet's FortiWeb web application firewall. This vulnerability, classified as CWE-89, stems from improper neutralization of special elements used in SQL commands. The vulnerability allows unauthenticated attackers to execute unauthorized SQL code or commands by sending crafted HTTP or HTTPS requests to the FortiWeb management interface. Successful exploitation could lead to attackers accessing sensitive data, altering database contents, or compromising backend systems.

  12. CVE-2025-48799

    09 Jul 2025, 08:17

    Windows Update Service

    Trended on social media

    Hype increased to 31

    CVE-2025-48799 is an Elevation of Privilege vulnerability in the Windows Update Service. The vulnerability stems from improper link resolution, also known as a 'link following' flaw. If exploited, an attacker with local access could escalate their privileges on a local machine. The vulnerability is due to the Windows Update Service not adequately verifying symbolic links or junctions before accessing files. An attacker could create a symbolic link to a system file, causing the update service to perform actions on that file with elevated permissions.

  13. CVE-2025-4674

    09 Jul 2025, 00:17

    CampCodes

    Trended on social media

    Hype increased to 30

    CVE-2025-46746 refers to a vulnerability where an administrator could discover another account's credentials. CVE-2024-4674, a different vulnerability, was found in Campcodes Complete Web-Based School Management System 1.0. It affects the `/view/show_friend_request.php` file, where manipulation of the `my_index` argument leads to cross-site scripting. The exploit is public and can be initiated remotely.