NVD disclosure day
CVE-2025-13223
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A type confusion vulnerability in Google Chrome's V8 engine could allow remote attackers to corrupt system memory via a crafted webpage. This presents a risk of data compromise or unauthorized code execution for affected organizations. The vulnerability requires user interaction by visiting a malicious page.
CVE-2024-44659
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
PHPGurukul Online Shopping Portal is affected by a critical SQL injection vulnerability in its password reset function. If reachable, an attacker could potentially gain unauthorized access to and modify sensitive data within the e-commerce application. This issue is relevant to organizations using this portal for onlin
CVE-2025-55058
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in Rumpus file transfer software due to improper input validation, potentially allowing unauthenticated attackers to compromise servers. Rumpus is often deployed externally, increasing the risk of exploitation. Organizations should identify affected systems and assess their exposure to d
CVE-2025-55055
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical OS command injection vulnerability exists in Maxum Rumpus, allowing unauthenticated attackers to execute arbitrary commands on affected systems. This could lead to a complete compromise of the server, impacting confidentiality, integrity, and availability. It is important to identify if this technology is in
CVE-2025-63747
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability exists in QaTraq where default administrative credentials allow immediate, unauthenticated access to the web application's login page, granting an attacker full administrative control. This could enable unauthorized viewing, modification, or deletion of sensitive test management data and altera
CVE-2025-9501
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A critical command injection vulnerability exists in the W3 Total Cache WordPress plugin. Unauthenticated users can exploit this by submitting malicious comments, potentially allowing arbitrary PHP command execution on affected websites. This could lead to significant compromise of website data and systems.
CVE-2025-13284
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
ThinPLUS software contains an OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands on the server. This could lead to a compromise of server operations if the affected system is reachable over a network.
CVE-2025-10460
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A SQL injection vulnerability in BEIMS Contractor Web, a legacy, unmaintained product, allows unauthorized users to retrieve sensitive database contents by exploiting an internet-facing endpoint with unsanitized input. This could compromise the confidentiality, integrity, and availability of the database. Because the p