NVD disclosure day
CVE-2025-58750
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
An issue exists in rAthena MMORPG server software where a missing bounds check in `chclif_parse_moveCharSlot` can lead to out-of-bounds reads and writes. This vulnerability is reachable via user input and could allow unauthorized modification or reading of server data. It is important to determine if this software is i
CVE-2025-58448
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A SQL injection vulnerability in the rAthena game server's PartyBooking component could allow remote attackers to execute arbitrary SQL commands. This could potentially lead to unauthorized data access, modification, or deletion within the game's database. Further investigation is needed to determine if this component
CVE-2025-58447
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A heap-based buffer overflow vulnerability in the rAthena MMORPG server's login component allows remote attackers to cause denial of service or potentially execute code by sending a crafted login request. This could impact the availability and integrity of game services.
CVE-2025-58462
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A SQL injection vulnerability in OPEXUS FOIAXpress Public Access Link allows remote, unauthenticated attackers to access, modify, or delete any content in the underlying database. This issue affects the SearchPopularDocs.aspx component and is relevant if this public-facing data system is in use.
CVE-2025-55730
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in XWiki Remote Macros allows remote code execution if an attacker can edit any page. This occurs due to a failure to escape the title parameter in the confluence paste code macro, enabling XWiki syntax injection. If exploited, an attacker could potentially compromise the affected XWiki instance.
CVE-2025-55729
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The XWiki Remote Macros vulnerability allows remote code execution through a flaw in the ConfluenceLayoutSection macro, which is used for migrating content from Confluence. If this macro processes specially crafted input, an attacker could potentially run unauthorized commands on affected systems, impacting service int
CVE-2025-55728
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The XWiki Remote Macros vulnerability in the panel macro's classes parameter allows for remote code execution when users with page editing privileges inject XWiki syntax. This could compromise the affected system's integrity and availability.
CVE-2025-55727
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A remote code execution vulnerability exists in XWiki Remote Macros due to improper handling of the 'width' parameter in the column macro, allowing attackers to inject and execute code. This impacts users who can edit pages or use the CKEditor converter, potentially leading to unauthorized command execution or administ
CVE-2025-55051
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A critical vulnerability exists due to the use of default credentials. If systems utilizing default credentials are reachable, attackers could gain unauthorized access, potentially compromising data and system behavior. Readers should determine if their organization uses the affected technology to assess potential expo
CVE-2025-54261
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical path traversal vulnerability in Adobe ColdFusion could permit attackers to execute arbitrary code on affected systems if optional configurations are enabled. The vulnerability, which is network-exploitable without authentication, could lead to unauthorized system access and modification. Organizations should
CVE-2025-47569
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical SQL injection vulnerability exists in the WooCommerce Ultimate Gift Card plugin, potentially allowing unauthenticated attackers to access sensitive data or disrupt services by sending malicious commands through the web interface.
CVE-2025-9994
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Amp'ed RF BT-AP 111 Bluetooth access point has a critical vulnerability allowing unauthenticated network access to its HTTP administrative interface. This exposure could permit unauthorized users to modify device configurations, potentially impacting network services. The security implications require assessment of
CVE-2025-54236
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Adobe Commerce versions are affected by a critical vulnerability allowing attackers to take over customer accounts without any interaction, potentially exposing sensitive data. Act now to secure your e-commerce platform.
CVE-2025-40795
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A critical vulnerability in Siemens' SIMATIC PCS neo and User Management Component, stemming from a stack-based buffer overflow, could allow unauthenticated remote attackers to execute arbitrary code or cause a denial of service. This impacts industrial control and user management systems when accessible over a network
CVE-2025-10134
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in a WordPress theme allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution. The issue stems from insufficient file path validation within a theme function. This could enable attackers to delete critical server files, posing a significant r
CVE-2025-42944
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A deserialization vulnerability in SAP NetWeaver's RMI-P4 module enables unauthenticated attackers to execute arbitrary OS commands by submitting malicious payloads. This can compromise the confidentiality, integrity, and availability of affected systems when the module's ports are reachable.