Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

laravel-file-manager

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths.

CVE-2025-65346 is a directory traversal vulnerability affecting alexusmai laravel-file-manager versions 3.3.1 and earlier. The vulnerability stems from the unzip or archive extraction functionality, which fails to properly validate the paths of files being extracted from uploaded archives. This allows an attacker to craft malicious archive files containing file paths that traverse directories (e.g., using ../ sequences) and write files outside the intended extraction directory. Because the vulnerability requires no authentication or user interaction, it can be exploited remotely by simply uploading a malicious archive. Successful exploitation can lead to arbitrary file write on the server filesystem, potentially allowing attackers to overwrite critical files, upload web shells, or modify application code, resulting in full compromise of confidentiality and integrity. The CVSS v3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. While no public exploits are currently known, the severity and ease of exploitation make this a significant threat. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No official patches or fixes are listed yet, so mitigation may require manual validation or disabling archive extraction features temporarily.

Detailed information about CVE-2025-65346: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-65346: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-65346: n/a

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.

CVE-2025-65345 identifies a directory traversal vulnerability in the zip and archiving functionality of alexusmai laravel-file-manager versions 3.3.1 and below. The flaw arises from improper validation of file paths when creating or extracting archives, which allows an attacker to include files and directories outside the intended extraction scope. This can be exploited remotely without authentication or user interaction, making it accessible to unauthenticated attackers over the network. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Successful exploitation can lead to unauthorized reading and modification of arbitrary files on the server, potentially exposing sensitive data or altering application behavior. However, it does not directly affect system availability. The CVSS v3.1 base score of 6.5 reflects a medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits are currently reported in the wild, and no official patches have been linked yet. Organizations using this Laravel package in their web applications should be aware of the risk and prepare to apply fixes or mitigations promptly once available.

Detailed information about CVE-2025-65345: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-65345: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-65345: n/a

alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.

CVE-2025-63307 identifies a Cross Site Scripting (XSS) vulnerability in alexusmai laravel-file-manager version 3.3.1. This file manager component, used in Laravel PHP frameworks, permits users to upload, create, and rename files with HTML and SVG extensions. The core issue is that these files are served inline by the application without adequate content-type validation or output sanitization. As a result, malicious actors can upload crafted HTML or SVG files containing executable JavaScript code. When these files are accessed by other users or administrators, the embedded scripts execute within their browsers, potentially compromising session tokens, cookies, or enabling further attacks such as phishing or privilege escalation. The vulnerability does not require authentication to exploit if the application allows unauthenticated file uploads, but this depends on the specific deployment. No CVSS score has been assigned yet, and no public exploits are known at this time. However, the vulnerability is significant because it affects the confidentiality and integrity of user sessions and data. The scope includes any web application integrating this file manager version without additional security controls. The lack of content-type enforcement and output sanitization are critical oversights that facilitate this attack vector.

Detailed information about CVE-2025-63307: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2025-65346: n/aCVE-2025-65346 0 alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths. CriticalVulnerabilityGermanyFranceUnited Kingdom+4#cve #cve-2025-65346 Join the discussion	CVE Database V5	12/04/2025, 00:00:00 UTC Added: 12/04/2025, 15:15:17 UTC
CVE-2025-65345: n/aCVE-2025-65345 0 alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation. MediumVulnerabilityGermanyFranceUnited Kingdom+2#cve #cve-2025-65345 Join the discussion	CVE Database V5	12/03/2025, 00:00:00 UTC Added: 12/03/2025, 20:14:46 UTC
CVE-2025-63307: n/aCVE-2025-63307 0 alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization. HighVulnerabilityGermanyFranceUnited Kingdom+3#cve #cve-2025-63307 Join the discussion	CVE Database V5	11/06/2025, 00:00:00 UTC Added: 11/06/2025, 16:16:23 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional