CVE-2024-13918, -13919: XSS in Laravel Framework, 8.0 rating❗️
The vulnerabilities allow an attacker to execute code in the victim's browser via Reflected XSS if the victim clicks on a decoy link.
More then 770k instances at Netlas.io:
👉 Link: https://nt.ls/95OAY
👉 Dork: http.headers.set_cookie:"laravel_session="
Read more: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
The vulnerabilities allow an attacker to execute code in the victim's browser via Reflected XSS if the victim clicks on a decoy link.
More then 770k instances at Netlas.io:
👉 Link: https://nt.ls/95OAY
👉 Dork: http.headers.set_cookie:"laravel_session="
Read more: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20241209-01_Laravel_Reflected_XSS_via_Request_Parameter_in_Debug-Mode_Error_Page
❤5🔥3👾3
🚧 Planned Maintenance 🚧
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on March 23, 2025, at 08:00 UTC ⏰. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
The application will be unavailable for a period of time❗️
The maintenance is scheduled to start on March 23, 2025, at 08:00 UTC ⏰. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
💊3👨💻1
CVE-2024-10441: RCE in Synology products, 9.8 rating 🔥
Synology DSM and BSM are vulnerable to Improper Encoding or Escaping of Output, which could potentially lead to remote execution of arbitrary code.
Search at Netlas.io:
👉 Link: https://nt.ls/KOa1N
👉 Dork: http.favicon.hash_sha256:b8f4bb2e2ba81cb86875fb89db4571278d6e23fd888313d0f4152b1adbc8bd08
Vendor's advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
Synology DSM and BSM are vulnerable to Improper Encoding or Escaping of Output, which could potentially lead to remote execution of arbitrary code.
Search at Netlas.io:
👉 Link: https://nt.ls/KOa1N
👉 Dork: http.favicon.hash_sha256:b8f4bb2e2ba81cb86875fb89db4571278d6e23fd888313d0f4152b1adbc8bd08
Vendor's advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
🔥4👾3
CVE-2025-2505: Path Traversal in Age Gate WordPress plugin, 9.8 rating 🔥
A vulnerability in a popular plugin allows attackers to include and execute arbitrary PHP files, potentially executing the code contained within.
Search at Netlas.io:
👉 Link: https://nt.ls/3gfAq
👉 Dork: http.body:"plugins/age-gate"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/age-gate/age-gate-353-unauthenticated-local-php-file-inclusion-via-lang
A vulnerability in a popular plugin allows attackers to include and execute arbitrary PHP files, potentially executing the code contained within.
Search at Netlas.io:
👉 Link: https://nt.ls/3gfAq
👉 Dork: http.body:"plugins/age-gate"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/age-gate/age-gate-353-unauthenticated-local-php-file-inclusion-via-lang
🔥5👾2👍1
Netlas vs ZoomEye: A Comprehensive Analysis 🧮
The final article in our series of comparisons with competitors.
This time we looked at ZoomEye, honestly comparing it with Netlas on more than 10 key metrics.
👉 Read now: https://netlas.io/blog/netlas_vs_zoomeye/
The final article in our series of comparisons with competitors.
This time we looked at ZoomEye, honestly comparing it with Netlas on more than 10 key metrics.
👉 Read now: https://netlas.io/blog/netlas_vs_zoomeye/
netlas.io
Netlas vs ZoomEye - Netlas Blog
Compare IoT search engines Netlas and Zoomeye, highlighting their features, strengths, and ideal use cases for security research.
👾6👍5
🚧 Planned Maintenance 🚧
The application will be unavailable for a period of time❗️
We remind you that in an hour, at 08:00 UTC ⏰, planned server maintenance will begin. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
The application will be unavailable for a period of time❗️
We remind you that in an hour, at 08:00 UTC ⏰, planned server maintenance will begin. It is expected to take a couple of hours, and we will do our best to complete it as quickly as possible.
Please remember to save your work before this time.
🕊3🤝2👨💻1
CVE-2025-29927: Improper Authorization in Next.js, 9.1 rating 🔥
The vulnerability allows an attacker to bypass authorization in a Next.js application if it is performed through middleware.
Search at Netlas.io:
👉 Link: https://nt.ls/MFbwd
👉 Dork: http.headers.x_powered_by:"Next.js"
Vendor's advisory: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
The vulnerability allows an attacker to bypass authorization in a Next.js application if it is performed through middleware.
Search at Netlas.io:
👉 Link: https://nt.ls/MFbwd
👉 Dork: http.headers.x_powered_by:"Next.js"
Vendor's advisory: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
🔥4👍2👾2
Unknown vulnerability in CrushFTP, no rating❗️
The vulnerability allows attackers to gain unauthenticated access if any HTTP(S) port is exposed in the configuration.
Search at Netlas.io:
👉 Link: https://nt.ls/tI4nF
👉 Dork: http.headers.server:"CrushFTP"
Read more: https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/
The vulnerability allows attackers to gain unauthenticated access if any HTTP(S) port is exposed in the configuration.
Search at Netlas.io:
👉 Link: https://nt.ls/tI4nF
👉 Dork: http.headers.server:"CrushFTP"
Read more: https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/
🔥5👾3
CVE-2025-1974: Improper Isolation or Compartmentalization in Kubernetes Ingress Controller, 9.8 rating 🔥
In some cases, an unauthenticated attacker may be able to execute remote code in the context of the ingress-nginx controller.
Search at Netlas.io:
👉 Link: https://nt.ls/G6SC7
👉 Dork: certificate.issuer_dn:"Kubernetes Ingress Controller"
Vendor's advisory: https://github.com/kubernetes/kubernetes/issues/131009
In some cases, an unauthenticated attacker may be able to execute remote code in the context of the ingress-nginx controller.
Search at Netlas.io:
👉 Link: https://nt.ls/G6SC7
👉 Dork: certificate.issuer_dn:"Kubernetes Ingress Controller"
Vendor's advisory: https://github.com/kubernetes/kubernetes/issues/131009
🔥4👾3
CVE-2025-30232: Use-after-free in Exim, "medium" rating❗️
A vulnerability in some versions of Exim potentially allows an attacker to perform Privilege Escalation, if he has command line access.
Search at Netlas.io:
👉 Link: https://nt.ls/mtDNc
👉 Dork: smtp.banner:"Exim 4.96" OR smtp.banner:"Exim 4.97" OR smtp.banner:"Exim 4.98" OR smtp.banner:"Exim 4.98.1"
Vendor's advisory: https://exim.org/static/doc/security/CVE-2025-30232.txt
A vulnerability in some versions of Exim potentially allows an attacker to perform Privilege Escalation, if he has command line access.
Search at Netlas.io:
👉 Link: https://nt.ls/mtDNc
👉 Dork: smtp.banner:"Exim 4.96" OR smtp.banner:"Exim 4.97" OR smtp.banner:"Exim 4.98" OR smtp.banner:"Exim 4.98.1"
Vendor's advisory: https://exim.org/static/doc/security/CVE-2025-30232.txt
👾4🔥2
CVE-2025-2294: Path Traversal in Kubio WordPress plugin, 9.8 rating 🔥
A vulnerability found in a popular plugin allows unauthenticated attackers to execute any code in PHP files on the server.
Search at Netlas.io:
👉 Link: https://nt.ls/iOqr6
👉 Dork: http.body:"plugins/kubio"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kubio/kubio-ai-page-builder-251-unauthenticated-local-file-inclusion
A vulnerability found in a popular plugin allows unauthenticated attackers to execute any code in PHP files on the server.
Search at Netlas.io:
👉 Link: https://nt.ls/iOqr6
👉 Dork: http.body:"plugins/kubio"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kubio/kubio-ai-page-builder-251-unauthenticated-local-file-inclusion
👾4👍2🔥1
CVE-2025-3083, -3084, -3085: Vulnerabilities in MongoDB, 6.5 - 8.1 rating❗️
Vulnerabilities in some versions of MongoDB allow attackers to perform DoS and gain unauthorized access using revoked certificates.
Search at Netlas.io:
👉 Link: https://nt.ls/aqCrV
👉 Dork: mongodb.build_info.version:[6.0.0 TO 6.0.20] OR mongodb.build_info.version:[5.0.0 TO 5.0.31] OR mongodb.build_info.version:[7.0.0 TO 7.0.16]
Vendor's advisory: https://jira.mongodb.org/browse/SERVER-95445
Vulnerabilities in some versions of MongoDB allow attackers to perform DoS and gain unauthorized access using revoked certificates.
Search at Netlas.io:
👉 Link: https://nt.ls/aqCrV
👉 Dork: mongodb.build_info.version:[6.0.0 TO 6.0.20] OR mongodb.build_info.version:[5.0.0 TO 5.0.31] OR mongodb.build_info.version:[7.0.0 TO 7.0.16]
Vendor's advisory: https://jira.mongodb.org/browse/SERVER-95445
🔥5👾2
CVE-2025-31720, -31721, -31722, ... , -31728: Multiple vulnerabilities in Jenkins, 4.3 - 8.8 rating❗️
The latest Jenkins release fixes nine vulnerabilities, including Sandbox Bypass, CSRF, Missing permission check, etc.
Search at Netlas.io:
👉 Link: https://nt.ls/b2I7a
👉 Dork: http.headers.x_jenkins:*
Vendor's advisory: https://www.jenkins.io/security/advisory/2025-04-02/
The latest Jenkins release fixes nine vulnerabilities, including Sandbox Bypass, CSRF, Missing permission check, etc.
Search at Netlas.io:
👉 Link: https://nt.ls/b2I7a
👉 Dork: http.headers.x_jenkins:*
Vendor's advisory: https://www.jenkins.io/security/advisory/2025-04-02/
🔥3👾3
CVE-2025-22457: RCE in Ivanti Connect Secure, 9.0 rating 🔥
A buffer overflow in Ivanti Connect Secure allows an unauthenticated attacker to perform remote code execution.
Search at Netlas.io:
👉 Link: https://nt.ls/zsWig
👉 Dork: http.body:"welcome.cgi?p=logo"
Vendor's advisory: https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US
A buffer overflow in Ivanti Connect Secure allows an unauthenticated attacker to perform remote code execution.
Search at Netlas.io:
👉 Link: https://nt.ls/zsWig
👉 Dork: http.body:"welcome.cgi?p=logo"
Vendor's advisory: https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US
👾3🔥2
CVE-2025-31489: Improper Verification of Cryptographic Signature in MinIO, 8.7 rating❗️
The vulnerability is in incomplete signature verification for unregistered downloads, which could allow an attacker to download objects using any arbitrary secret.
Search at Netlas.io:
👉 Link: https://nt.ls/TEvNJ
👉 Dork: http.favicon.hash_sha256:7a2d79d4a5801b848bf2d577c6c3d16598d69fd78bc9d2399dcc4ac2497b0759 OR http.headers.server:"MinIO" OR http.meta:"MinIO" OR http.favicon.hash_sha256:052d1670e36345713bd69e405403034f69b3a0adab8fa7d6f178faac4406199a
Vendor's advisory: https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh
The vulnerability is in incomplete signature verification for unregistered downloads, which could allow an attacker to download objects using any arbitrary secret.
Search at Netlas.io:
👉 Link: https://nt.ls/TEvNJ
👉 Dork: http.favicon.hash_sha256:7a2d79d4a5801b848bf2d577c6c3d16598d69fd78bc9d2399dcc4ac2497b0759 OR http.headers.server:"MinIO" OR http.meta:"MinIO" OR http.favicon.hash_sha256:052d1670e36345713bd69e405403034f69b3a0adab8fa7d6f178faac4406199a
Vendor's advisory: https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh
👾3
CVE-2025-24446 and other: Multiple vulnerabilitites in Adobe ColdFusion, 7.5 - 9.1 rating 🔥
In a recent advisory, Adobe disclosed 11 vulnerabilities that could lead to arbitrary file system read, code execution, and a security feature bypass.
Search at Netlas.io:
👉 Link: https://nt.ls/tDhgz
👉 Dork: http.headers.set_cookie:"CFID="
Vendor's advisory: https://helpx.adobe.com/security.html
In a recent advisory, Adobe disclosed 11 vulnerabilities that could lead to arbitrary file system read, code execution, and a security feature bypass.
Search at Netlas.io:
👉 Link: https://nt.ls/tDhgz
👉 Dork: http.headers.set_cookie:"CFID="
Vendor's advisory: https://helpx.adobe.com/security.html
🔥5👾4
CVE-2025-3102: Incorrect Comparison in SureTriggers WordPress plugin, 8.1 rating❗️
Failure to check for an empty key value in the "autheticate_user" function could allow an attacker to bypass the authentication process.
Search at Netlas.io:
👉 Link: https://nt.ls/JK81c
👉 Dork: http.body:"plugins/suretriggers"
Read more: https://plugins.trac.wordpress.org/browser/suretriggers?order=name
Failure to check for an empty key value in the "autheticate_user" function could allow an attacker to bypass the authentication process.
Search at Netlas.io:
👉 Link: https://nt.ls/JK81c
👉 Dork: http.body:"plugins/suretriggers"
Read more: https://plugins.trac.wordpress.org/browser/suretriggers?order=name
👾3👏2👍1
CVE-2025-25226, -25227: SQL Injection and Improper Authentication in Joomla, 7.5 - 9.8 rating 🔥
Vulnerabilities in Joomla CMS and Joomla's Database package allow an attacker to bypass the 2FA or perform SQLi.
Search at Netlas.io:
👉 Link: https://nt.ls/nxRtD
👉 Dork: http.meta:"Joomla!"
Vendor's advisory: https://developer.joomla.org/security-centre/963-20250401-framework-sql-injection-vulnerability-in-quotenamestr-method-of-database-package.html
Vulnerabilities in Joomla CMS and Joomla's Database package allow an attacker to bypass the 2FA or perform SQLi.
Search at Netlas.io:
👉 Link: https://nt.ls/nxRtD
👉 Dork: http.meta:"Joomla!"
Vendor's advisory: https://developer.joomla.org/security-centre/963-20250401-framework-sql-injection-vulnerability-in-quotenamestr-method-of-database-package.html
👍2🔥2👾1
CVE-2025-3439: Deserialization of Untrusted Data in Everest Forms WordPress plugin, 9.8 rating 🔥
A vulnerability in the 'field_value' parameter allows a remote unauthenticated attacker to perform PHP object injection. This in turn allows the attacker to achieve RCE, retrieve sensitive data and the ability to delete arbitrary files.
Search at Netlas.io:
👉 Link: https://nt.ls/CoAb6
👉 Dork: http.body:"plugins/everest-forms"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/everest-forms/everest-forms-contact-form-quiz-survey-newsletter-payment-form-builder-for-wordpress-311-unauthenticated-php-object-injection
A vulnerability in the 'field_value' parameter allows a remote unauthenticated attacker to perform PHP object injection. This in turn allows the attacker to achieve RCE, retrieve sensitive data and the ability to delete arbitrary files.
Search at Netlas.io:
👉 Link: https://nt.ls/CoAb6
👉 Dork: http.body:"plugins/everest-forms"
Read more: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/everest-forms/everest-forms-contact-form-quiz-survey-newsletter-payment-form-builder-for-wordpress-311-unauthenticated-php-object-injection
🔥3👾3
CVE-2025-32102, -32103: Multiple vulnerabilitites in CrushFTP❗️
The vulnerabilities disclosed for the popular file transfer web service include Directory Traversal and SSRF. A PoC has also been published for these vulns.
Search at Netlas.io:
👉 Link: https://nt.ls/NStLF
👉 Dork: http.headers.server:"CrushFTP"
Read more: https://seclists.org/fulldisclosure/2025/Apr/17
The vulnerabilities disclosed for the popular file transfer web service include Directory Traversal and SSRF. A PoC has also been published for these vulns.
Search at Netlas.io:
👉 Link: https://nt.ls/NStLF
👉 Dork: http.headers.server:"CrushFTP"
Read more: https://seclists.org/fulldisclosure/2025/Apr/17
🔥3👾2
CVE-2025-24970: Improper Input Validation in Confluence Data Center & Server, 7.5 rating❗️
A vulnerability in the Netty framework could cause a server to crash if an attacker sends a special crafted packet.
Search at Netlas.io:
👉 Link: https://nt.ls/jcVrv
👉 Dork: http.meta:"confluence-base-url"
Vendor's advisory: https://jira.atlassian.com/browse/CONFSERVER-99540
A vulnerability in the Netty framework could cause a server to crash if an attacker sends a special crafted packet.
Search at Netlas.io:
👉 Link: https://nt.ls/jcVrv
👉 Dork: http.meta:"confluence-base-url"
Vendor's advisory: https://jira.atlassian.com/browse/CONFSERVER-99540
❤2🔥2👍1👾1