2025-06-07 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2023-38674	PaddlePaddle - PaddlePaddle	FPE in paddle.nanmedian in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.	CVSS3.1: 4.7 - MEDIUM	0	Exploitation: pocAutomatable: noTechnical Impact: partial	FPE in paddle.nanmedian	github
CVE-2024-13087	QNAP Systems Inc. - QuRouter	A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.6.028 and later	CVSS4.0: 2.4 - LOW	0	Exploitation: noneAutomatable: noTechnical Impact: partial	QHora	github
CVE-2023-25995	choicehomemortgage - AI Mortgage Calculator	Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) vulnerability in choicehomemortgage AI Mortgage Calculator allows PHP Local File Inclusion. This issue affects AI Mortgage Calculator: from n/a through 1.0.1.	CVSS3.1: 7.5 - HIGH	0	Exploitation: noneAutomatable: noTechnical Impact: total	WordPress AI Mortgage Calculator <= 1.0.1 - Local File Inclusion Vulnerability	github