Current Conditions
São Paulo
nuvens quebradas

23 ℃
85%
Temperatura
Umidade
Fonte: OpenWeatherMap. - 18:00:01
  1. [USD] USD 67,357.03
  1. [BRL] BRL 348,730.94 [USD] USD 67,357.03 [GBP] GBP 49,935.00 [EUR] EUR 57,128.19
    Price index provided by blockchain.info.
  2. Bitcoin Core version 29.3 is now available for download. See the release notes for more information about the bug fixes in this release.
    If you have any questions, please stop by the #bitcoin IRC chatroom (IRC, web) and we’ll do our best to help you.

[CVE-2025-12275] [Modified: 07-11-2025] [Analyzed] [V3.1 S9.8:CRITICAL] Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

[CVE-2025-12278] [Modified: 10-11-2025] [Analyzed] [V3.1 S6.5:MEDIUM] Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

[CVE-2025-12284] [Modified: 10-11-2025] [Analyzed] [V3.1 S6.1:MEDIUM] Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

[CVE-2025-12285] [Modified: 10-11-2025] [Analyzed] [V3.1 S9.8:CRITICAL] Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

[CVE-2025-10497] [Modified: 27-10-2025] [Analyzed] [V3.1 S7.5:HIGH] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted payloads.

[CVE-2025-11447] [Modified: 27-10-2025] [Analyzed] [V3.1 S7.5:HIGH] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.

[CVE-2025-11971] [Modified: 28-10-2025] [Analyzed] [V3.1 S6.5:MEDIUM] GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.

[CVE-2025-11974] [Modified: 28-10-2025] [Analyzed] [V3.1 S6.5:MEDIUM] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.

[CVE-2025-11989] [Modified: 28-10-2025] [Analyzed] [V3.1 S3.7:LOW] GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions.

[CVE-2025-6601] [Modified: 28-10-2025] [Analyzed] [V3.1 S2.7:LOW] GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.

[CVE-2025-12201] [Modified: 15-01-2026] [Analyzed] [V3.1 S4.7:MEDIUM] A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-12202] [Modified: 15-01-2026] [Analyzed] [V3.1 S4.3:MEDIUM] A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

[CVE-2025-62969] [Modified: 22-01-2026] [Analyzed] [V3.1 S6.5:MEDIUM] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Stored XSS.This issue affects NextMove Lite: from n/a through <= 2.21.0.

[CVE-2025-62972] [Modified: 03-02-2026] [Analyzed] [V3.1 S4.3:MEDIUM] Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.

[CVE-2025-12203] [Modified: 07-11-2025] [Analyzed] [V3.1 S6.3:MEDIUM] A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b0fa7ff74a3539c6d37000db152caad572e4c39b. Applying a patch is advised to resolve this issue.

[CVE-2025-12208] [Modified: 28-10-2025] [Analyzed] [V3.1 S7.3:HIGH] A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

[CVE-2025-12209] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

[CVE-2025-12212] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

[CVE-2025-12213] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument lan leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

[CVE-2025-12214] [Modified: 28-10-2025] [Analyzed] [V3.1 S8.8:HIGH] A vulnerability was detected in Tenda O3 1.0.0.10(2478). This issue affects the function SetValue/GetValue of the file /goform/sysAutoReboot. Performing manipulation of the argument enable results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.