WordPress Backup Migration 1.3.7 - Remote Command Execution

mailcow 2025-01a - Host Header Password Reset Poisoning

Easy File Sharing Web Server v7.2 - Buffer Overflow

WeGIA 3.5.0 - SQL Injection

Boss Mini v1.4.0 - Local File Inclusion (LFI)

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Feb 22

SEC Consult Vulnerability Lab Security Advisory < 20260218-0 >
=======================================================================
title: Multiple Critical Vulnerabilities
product: NesterSoft WorkTime (on-prem/cloud)
vulnerable version: <= 11.8.8
fixed version: No patch available, vendor unresponsive.
CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-15561...

Posted by Egidio Romano on Feb 22

----------------------------------------------------------------------------
SmarterMail <= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability
----------------------------------------------------------------------------

[-] Software Link:

https://www.smartertools.com/smartermail/business-email-server

[-] Affected Versions:

Build 9518 and prior builds.

[-] Vulnerability Description:

User input passed through the...

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Feb 16

SEC Consult Vulnerability Lab Security Advisory < 20260212-0 >
=======================================================================
title: Multiple Vulnerabilities
            product: Various Solax Power Pocket WiFi models
 vulnerable version: See section below
      fixed version: See section below
         CVE number: CVE-2025-15573, CVE-2025-15574, CVE-2025-15575
             impact: High...

motionEye 0.43.1b4 - RCE

Windows 10.0.17763.7009 - spoofing vulnerability

glibc 2.38 - Buffer Overflow

windows 10/11 - NTLM Hash Disclosure Spoofing

Redis 8.0.2 - RCE

OctoPrint 1.11.2 - File Upload

Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE

aiohttp 3.9.1 - directory traversal PoC

FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution

Docker Desktop 4.44.3 - Unauthenticated API Exposure

Piranha CMS 12.0 - Stored XSS in Text Block

RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)