2025-08-01 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2013-10034	Kaseya - KServer	An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and input sanitation, an attacker can upload a file with an .asp extension to a web-accessible directory, which can then be invoked to execute arbitrary code with the privileges of the IUSR account. The vulnerability enables remote code execution without prior authentication and was resolved in version 6.3.0.2 by removing the vulnerable uploadImage.asp endpoint.	CVSS4.0: 9.3 - CRITICAL	0 1 2 3	Exploitation: pocAutomatable: yesTechnical Impact: total	Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE	github
CVE-2012-10021	D-Link - DIR-605L	A stack-based buffer overflow vulnerability exists in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13 via the getAuthCode() function. The flaw arises from unsafe usage of sprintf() when processing user-supplied CAPTCHA data via the FILECODE parameter in /goform/formLogin. A remote unauthenticated attacker can exploit this to execute arbitrary code with root privileges on the device.	CVSS4.0: 9.3 - CRITICAL	0 1 2 3 4	Exploitation: pocAutomatable: yesTechnical Impact: total	D-Link DIR-605L Captcha Handling Buffer Overflow	github
CVE-2011-10008	MPlayer Project - MPlayer Lite	A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling M3U playlist files containing long http:// URL entries. An attacker can craft a malicious .m3u file with a specially formatted URL that triggers a stack overflow when processed by the player, particularly via drag-and-drop interaction. This flaw allows for control of the execution flow through SEH overwrite and a DEP bypass using a ROP chain that leverages known gadgets in loaded DLLs. Successful exploitation may result in arbitrary code execution with the privileges of the current user.	CVSS4.0: 8.6 - HIGH	0 1 2	Exploitation: pocAutomatable: noTechnical Impact: total	MPlayer Lite r33064 M3U Stack-Based Buffer Overflow	github
CVE-2013-10037	Eppler Software - WebTester	An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, resulting in arbitrary command execution on the underlying system with web server privileges.	CVSS4.0: 9.3 - CRITICAL	0 1 2 3 4	Exploitation: pocAutomatable: yesTechnical Impact: total	WebTester 5.x install2.php Unauthenticated Command Execution	github