2025-06-24 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2025-49144	notepad-plus-plus - notepad-plus-plus	Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social engineering or clickjacking to trick users into downloading both the legitimate installer and a malicious executable to the same directory (typically Downloads folder - which is known as Vulnerable directory). Upon running the installer, the attack executes automatically with SYSTEM privileges. This issue has been fixed and will be released in version 8.8.2.	CVSS3.1: 7.3 - HIGH	0 1 2	Exploitation: pocAutomatable: noTechnical Impact: total	Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path	github
CVE-2024-45208	Versa - Director	The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.	CVSS3.1: 9.8 - CRITICAL	0 1 2 3 4 5 6	Exploitation: noneAutomatable: yesTechnical Impact: total	undefined	github
CVE-2025-1987	Psono - Psono-clientBitdefender - SecurePass	A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data.	CVSS4.0: 9.3 - CRITICAL	0	Exploitation: noneAutomatable: yesTechnical Impact: total	Stored XSS in Psono-Client via Malicious Vault Entry URLs	github
CVE-2024-45347	Xiaomi - Xiaomi Mi Connect Service	An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device.	CVSS3.1: 9.6 - CRITICAL	0	Exploitation: noneAutomatable: noTechnical Impact: total	Mi Connect Service APP protocol flaws lead to unauthorized access	github