CVE-2025-22224, -22225, -22226: Multiple vulnerabilities in VMware ESXi, 7.1 - 9.3 rating 🔥
Three vulnerabilities affecting several VMware products, including ESXi. Includes Code Exection, Sandbox Escape and Memory Leak.
Search at Netlas.io:
👉 Link: https://nt.ls/9Iw92
👉 Dork: http.noscript:"+ ID_EESX_Welcome +"
Vendor's advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
Three vulnerabilities affecting several VMware products, including ESXi. Includes Code Exection, Sandbox Escape and Memory Leak.
Search at Netlas.io:
👉 Link: https://nt.ls/9Iw92
👉 Dork: http.noscript:"+ ID_EESX_Welcome +"
Vendor's advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390
👾4🔥3👍1
CVE-2025-26776: Unrestricted Upload of File with Dangerous Type in Chaty Pro WordPress Plugin, 10.0 rating 🔥🔥🔥
The vulnerability allows an attacker to upload malicious files that can be used to take control of a website.
Search at Netlas.io:
👉 Link: https://nt.ls/DCwYC
👉 Dork: http.body:"plugins/chaty-pro"
Read more: https://patchstack.com/database/wordpress/plugin/chaty-pro/vulnerability/wordpress-chaty-pro-plugin-3-3-3-arbitrary-file-upload-vulnerability?_s_id=cve
The vulnerability allows an attacker to upload malicious files that can be used to take control of a website.
Search at Netlas.io:
👉 Link: https://nt.ls/DCwYC
👉 Dork: http.body:"plugins/chaty-pro"
Read more: https://patchstack.com/database/wordpress/plugin/chaty-pro/vulnerability/wordpress-chaty-pro-plugin-3-3-3-arbitrary-file-upload-vulnerability?_s_id=cve
🔥4👾2
🚧 Planned Maintenance 🚧
Short-term interruptions in service provision are possible❗️
On the weekend of March 8-9, 2025, we will carry out work aimed at improving server stability and quality of service. All this time, the replicas will be disabled, which is why interruptions are possible in case of problems with the main server. We will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
Short-term interruptions in service provision are possible❗️
On the weekend of March 8-9, 2025, we will carry out work aimed at improving server stability and quality of service. All this time, the replicas will be disabled, which is why interruptions are possible in case of problems with the main server. We will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
👨💻3
CVE-2025-27622, -27623, -27624, -27625: Multiple vulnerabilitites in Jenkins, medium rating❗️
The vulnerabilities allow attackers to view encrypted secret values and potentially store attacker-controlled content in other users' profiles.
Search at Netlas.io:
👉 Link: https://nt.ls/SyXh2
👉 Dork: http.headers.x_jenkins:*
Vendor's advisory: https://www.jenkins.io/security/advisory/2025-03-05/
The vulnerabilities allow attackers to view encrypted secret values and potentially store attacker-controlled content in other users' profiles.
Search at Netlas.io:
👉 Link: https://nt.ls/SyXh2
👉 Dork: http.headers.x_jenkins:*
Vendor's advisory: https://www.jenkins.io/security/advisory/2025-03-05/
🔥3👾3👍1
❗️Temporary Issues with Private Scanner ❗️
While expanding disk space, we encountered unexpected issues that temporarily affected one of our servers. As a result, Private Scanner is currently unavailable. All other functions work properly.
Our team is actively working on a fix, and the service will be restored by the end of the week — possibly sooner.
We appreciate your patience and apologize for the inconvenience!
While expanding disk space, we encountered unexpected issues that temporarily affected one of our servers. As a result, Private Scanner is currently unavailable. All other functions work properly.
Our team is actively working on a fix, and the service will be restored by the end of the week — possibly sooner.
We appreciate your patience and apologize for the inconvenience!
💊4🕊2
CVE-2025-24813: Potential RCE in Apache Tomcat❗️
Deserialization of Untrusted Data and Path Equivalence vulnerabilities potentially allow an attacker to perform RCE or information disclosure.
Search at Netlas.io:
👉 Link: https://nt.ls/bzlj4
👉 Dork: http.favicon.hash_sha256:64a3170a912786e9eece7e347b58f36471cb9d0bc790697b216c61050e6b1f08 OR http.headers.server:"Apache-Coyote"
Vendor's advisory: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
Deserialization of Untrusted Data and Path Equivalence vulnerabilities potentially allow an attacker to perform RCE or information disclosure.
Search at Netlas.io:
👉 Link: https://nt.ls/bzlj4
👉 Dork: http.favicon.hash_sha256:64a3170a912786e9eece7e347b58f36471cb9d0bc790697b216c61050e6b1f08 OR http.headers.server:"Apache-Coyote"
Vendor's advisory: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
🔥4👾2👍1
CVE-2025-1661: Path Traversal in The HUSKY WordPress Plugin, 9.8 rating 🔥
The vulnerability allows an attacker to execute arbitrary files on the server, including PHP code.
Search at Netlas.io:
👉 Link: https://nt.ls/OEg7k
👉 Dork: http.body:"plugins/woocommerce-products-filter"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-products-filter/husky-products-filter-professional-for-woocommerce-1365-unauthenticated-local-file-inclusion
The vulnerability allows an attacker to execute arbitrary files on the server, including PHP code.
Search at Netlas.io:
👉 Link: https://nt.ls/OEg7k
👉 Dork: http.body:"plugins/woocommerce-products-filter"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-products-filter/husky-products-filter-professional-for-woocommerce-1365-unauthenticated-local-file-inclusion
🔥3👾3👍1
Netlas 1.1.0 is Here! 🚀
We've just rolled out a fresh update, fine-tuning Netlas for a smoother, more reliable experience.
📱 Mobile-Friendly: The Netlas app now plays nice with mobile devices
⚡️ Better Loading Experience: The IP/Domain Info Tool now shows a sleek skeleton page while loading
🐛 Bug Squash & Polish: We've tackled various issues under the hood.
Check out the full details here 👉 https://docs.netlas.io/changelog/
We've just rolled out a fresh update, fine-tuning Netlas for a smoother, more reliable experience.
📱 Mobile-Friendly: The Netlas app now plays nice with mobile devices
⚡️ Better Loading Experience: The IP/Domain Info Tool now shows a sleek skeleton page while loading
🐛 Bug Squash & Polish: We've tackled various issues under the hood.
Check out the full details here 👉 https://docs.netlas.io/changelog/
docs.netlas.io
Changelog - Netlas Docs
Explore the latest updates, enhancements, and fixes on the Netlas platform. Stay informed with our Changelog for all product and feature developments.
❤2🔥2👾2
CVE-2025-25291, -25292 and other: Multiple vulnerabilitites in GitLab, 8.8 rating❗️
Traditionally, GitLab publishes information about several vulnerabilities at once. These include Interpretation Conflict, DoS, Credentials Disclose, etc.
Search at Netlas.io:
👉 Link: https://nt.ls/PDxYA
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"
Vendor's advisory: https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/
Traditionally, GitLab publishes information about several vulnerabilities at once. These include Interpretation Conflict, DoS, Credentials Disclose, etc.
Search at Netlas.io:
👉 Link: https://nt.ls/PDxYA
👉 Dork: http.favicon.hash_sha256:72a2cad5025aa931d6ea56c3201d1f18e68a8cd39788c7c80d5b2b82aa5143ef OR http.headers.set_cookie:"gitlab" OR http.headers.location:"gitlab"
Vendor's advisory: https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released/
🔥3👾3
Netlas Plugins Update ⚡️
We've updated our Google Chrome and Mozilla Firefox plugins, fixing some bugs and improving stability. If you use them, we recommend updating to the latest version!
👉 Netlas for Chrome: https://chromewebstore.google.com/detail/netlasio/pncoieihjcmpooceknjajojehmhdedii
👉 Netlas for Firefox: https://addons.mozilla.org/en-US/firefox/addon/netlas-io/
We've updated our Google Chrome and Mozilla Firefox plugins, fixing some bugs and improving stability. If you use them, we recommend updating to the latest version!
👉 Netlas for Chrome: https://chromewebstore.google.com/detail/netlasio/pncoieihjcmpooceknjajojehmhdedii
👉 Netlas for Firefox: https://addons.mozilla.org/en-US/firefox/addon/netlas-io/
Google
Netlas.io - Chrome Web Store
The Netlas plugin gives information about where the website is hosted, who owns the IP and what other services and ports are open.
🔥2👾2
CVE-2024-13918, -13919: XSS in Laravel Framework, 8.0 rating❗️
The vulnerabilities allow an attacker to execute code in the victim's browser via Reflected XSS if the victim clicks on a decoy link.
More then 770k instances at Netlas.io:
👉 Link: https://nt.ls/95OAY
👉 Dork: http.headers.set_cookie:"laravel_session="
Read more: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
The vulnerabilities allow an attacker to execute code in the victim's browser via Reflected XSS if the victim clicks on a decoy link.
More then 770k instances at Netlas.io:
👉 Link: https://nt.ls/95OAY
👉 Dork: http.headers.set_cookie:"laravel_session="
Read more: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
❤5🔥3👾3
🚧 Planned Maintenance 🚧
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on March 23, 2025, at 08:00 UTC ⏰. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on March 23, 2025, at 08:00 UTC ⏰. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
💊3👨💻1
CVE-2024-10441: RCE in Synology products, 9.8 rating 🔥
Synology DSM and BSM are vulnerable to Improper Encoding or Escaping of Output, which could potentially lead to remote execution of arbitrary code.
Search at Netlas.io:
👉 Link: https://nt.ls/KOa1N
👉 Dork: http.favicon.hash_sha256:b8f4bb2e2ba81cb86875fb89db4571278d6e23fd888313d0f4152b1adbc8bd08
Vendor's advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
Synology DSM and BSM are vulnerable to Improper Encoding or Escaping of Output, which could potentially lead to remote execution of arbitrary code.
Search at Netlas.io:
👉 Link: https://nt.ls/KOa1N
👉 Dork: http.favicon.hash_sha256:b8f4bb2e2ba81cb86875fb89db4571278d6e23fd888313d0f4152b1adbc8bd08
Vendor's advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
🔥4👾3
CVE-2025-2505: Path Traversal in Age Gate WordPress plugin, 9.8 rating 🔥
A vulnerability in a popular plugin allows attackers to include and execute arbitrary PHP files, potentially executing the code contained within.
Search at Netlas.io:
👉 Link: https://nt.ls/3gfAq
👉 Dork: http.body:"plugins/age-gate"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/age-gate/age-gate-353-unauthenticated-local-php-file-inclusion-via-lang
A vulnerability in a popular plugin allows attackers to include and execute arbitrary PHP files, potentially executing the code contained within.
Search at Netlas.io:
👉 Link: https://nt.ls/3gfAq
👉 Dork: http.body:"plugins/age-gate"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/age-gate/age-gate-353-unauthenticated-local-php-file-inclusion-via-lang
🔥5👾2👍1
Netlas vs ZoomEye: A Comprehensive Analysis 🧮
The final article in our series of comparisons with competitors.
This time we looked at ZoomEye, honestly comparing it with Netlas on more than 10 key metrics.
👉 Read now: https://netlas.io/blog/netlas_vs_zoomeye/
The final article in our series of comparisons with competitors.
This time we looked at ZoomEye, honestly comparing it with Netlas on more than 10 key metrics.
👉 Read now: https://netlas.io/blog/netlas_vs_zoomeye/
netlas.io
Netlas vs ZoomEye - Netlas Blog
Compare IoT search engines Netlas and Zoomeye, highlighting their features, strengths, and ideal use cases for security research.
👾6👍5
🚧 Planned Maintenance 🚧
The application will be unavailable for a period of time❗️
We remind you that in an hour, at 08:00 UTC ⏰, planned server maintenance will begin. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
The application will be unavailable for a period of time❗️
We remind you that in an hour, at 08:00 UTC ⏰, planned server maintenance will begin. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
🕊3🤝2👨💻1
CVE-2025-29927: Improper Authorization in Next.js, 9.1 rating 🔥
The vulnerability allows an attacker to bypass authorization in a Next.js application if it is performed through middleware.
Search at Netlas.io:
👉 Link: https://nt.ls/MFbwd
👉 Dork: http.headers.x_powered_by:"Next.js"
Vendor's advisory: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
The vulnerability allows an attacker to bypass authorization in a Next.js application if it is performed through middleware.
Search at Netlas.io:
👉 Link: https://nt.ls/MFbwd
👉 Dork: http.headers.x_powered_by:"Next.js"
Vendor's advisory: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
🔥4👍2👾2
Unknown vulnerability in CrushFTP, no rating❗️
The vulnerability allows attackers to gain unauthenticated access if any HTTP(S) port is exposed in the configuration.
Search at Netlas.io:
👉 Link: https://nt.ls/tI4nF
👉 Dork: http.headers.server:"CrushFTP"
Read more: https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/
The vulnerability allows attackers to gain unauthenticated access if any HTTP(S) port is exposed in the configuration.
Search at Netlas.io:
👉 Link: https://nt.ls/tI4nF
👉 Dork: http.headers.server:"CrushFTP"
Read more: https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/
🔥5👾3
CVE-2025-1974: Improper Isolation or Compartmentalization in Kubernetes Ingress Controller, 9.8 rating 🔥
In some cases, an unauthenticated attacker may be able to execute remote code in the context of the ingress-nginx controller.
Search at Netlas.io:
👉 Link: https://nt.ls/G6SC7
👉 Dork: certificate.issuer_dn:"Kubernetes Ingress Controller"
Vendor's advisory: https://github.com/kubernetes/kubernetes/issues/131009
In some cases, an unauthenticated attacker may be able to execute remote code in the context of the ingress-nginx controller.
Search at Netlas.io:
👉 Link: https://nt.ls/G6SC7
👉 Dork: certificate.issuer_dn:"Kubernetes Ingress Controller"
Vendor's advisory: https://github.com/kubernetes/kubernetes/issues/131009
🔥4👾3
CVE-2025-30232: Use-after-free in Exim, "medium" rating❗️
A vulnerability in some versions of Exim potentially allows an attacker to perform Privilege Escalation, if he has command line access.
Search at Netlas.io:
👉 Link: https://nt.ls/mtDNc
👉 Dork: smtp.banner:"Exim 4.96" OR smtp.banner:"Exim 4.97" OR smtp.banner:"Exim 4.98" OR smtp.banner:"Exim 4.98.1"
Vendor's advisory: https://exim.org/static/doc/security/CVE-2025-30232.txt
A vulnerability in some versions of Exim potentially allows an attacker to perform Privilege Escalation, if he has command line access.
Search at Netlas.io:
👉 Link: https://nt.ls/mtDNc
👉 Dork: smtp.banner:"Exim 4.96" OR smtp.banner:"Exim 4.97" OR smtp.banner:"Exim 4.98" OR smtp.banner:"Exim 4.98.1"
Vendor's advisory: https://exim.org/static/doc/security/CVE-2025-30232.txt
👾4🔥2
CVE-2025-2294: Path Traversal in Kubio WordPress plugin, 9.8 rating 🔥
A vulnerability found in a popular plugin allows unauthenticated attackers to execute any code in PHP files on the server.
Search at Netlas.io:
👉 Link: https://nt.ls/iOqr6
👉 Dork: http.body:"plugins/kubio"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kubio/kubio-ai-page-builder-251-unauthenticated-local-file-inclusion
A vulnerability found in a popular plugin allows unauthenticated attackers to execute any code in PHP files on the server.
Search at Netlas.io:
👉 Link: https://nt.ls/iOqr6
👉 Dork: http.body:"plugins/kubio"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kubio/kubio-ai-page-builder-251-unauthenticated-local-file-inclusion
👾4👍2🔥1