Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,387 results · page 113 of 348
Aug 12, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-55010 · Other software · kanboard · reported by GitHubCritical 9.1
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"] field in the project_activities table. A malicious actor can update this field to use a php gadget to write a web shell into the /plugins folder, which then gives remote code execution on the host system. This issue has been patched in version 1.2.47.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction aCVE-2025-42946 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.9
Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacker to potentially read or delete these files hence causing a high impact on confidentiality and low impact on integrity. There is no impact on availability of the system.
- Product
- SAP S/4HANA (Bank Communication Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025MASA CMS is an Enterprise Content Management platform based on open source technology.CVE-2024-32640 · Other software · MasaCMS · reported by GitHubCritical 9.8
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtainCVE-2025-8853 · Other software · 2100 Technology · reported by twcert@cert.org.twCritical 9.3
Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user.
- Product
- Official Document Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comchtsecurity.com
Aug 8, 2025The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix.CVE-2025-55009 · Other software · workos · reported by GitHubHigh 7.1
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and below, @workos-inc/authkit-remix exposed sensitive authentication artifacts — specifically sealedSession and accessToken — by returning them from the authkitLoader. This caused them to be rendered into the browser HTML.
- Product
- authkit-remix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router.CVE-2025-55008 · Other software · workos · reported by GitHubHigh 7.1
The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1 and below, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be rendered into the browser HTML. This issue is fixed in version 0.7.0.
- Product
- authkit-react-router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface.CVE-2012-10042 · Other software · Sflog! · reported by VulnCheckHigh 8.7
Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials (admin:secret) and allows authenticated users to upload files via manage.php. The upload mechanism fails to validate file types, enabling attackers to upload a PHP backdoor into a web-accessible directory (blogs/download/uploads/). Once uploaded, the file can be executed remotely, resulting in full remote code execution.
- Product
- Sflog! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comsourceforge.net
Aug 7, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54787 · Other software · SuiteCRM · reported by GitHubLow 3.7
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 which allows unauthenticated downloads of any file from the upload-directory, as long as it is named by an ID (e.g. attachments). An unauthenticated attacker could download internal files when he discovers a valid file-ID. Valid IDs could be brute-forced, but this is quite time-consuming as the file-IDs are usually UUIDs. This issue is fixed in version 7.14.7.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 7, 2025Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php.CVE-2023-41532 · Other software · Kishan0725 · reported by MITREHigh 8.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the username1 and password2 parameters.CVE-2023-41531 · Other software · Kishan0725 · reported by MITREHigh 8.8
Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3.php via the username1 and password2 parameters.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.CVE-2023-41530 · Other software · Kishan0725 · reported by MITRECritical 9.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lname parameters.CVE-2023-41529 · Other software · Kishan0725 · reported by MITREMedium 6.1
Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lname parameters.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and txtmail parameters.CVE-2023-41528 · Other software · Kishan0725 · reported by MITRECritical 9.8
Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and txtmail parameters.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.CVE-2023-41527 · Other software · Kishan0725 · reported by MITRECritical 9.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 parameters.CVE-2023-41526 · Other software · Kishan0725 · reported by MITRECritical 9.8
Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 parameters.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.CVE-2023-41525 · Other software · Kishan0725 · reported by MITRECritical 9.8
Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.CVE-2023-41524 · Other software · Student Attendance Management System Project · reported by MITREHigh 8.8
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php.CVE-2023-41523 · Other software · Student Attendance Management System Project · reported by MITREHigh 8.8
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, firstname, and admissCVE-2023-41522 · Other software · Student Attendance Management System Project · reported by MITREHigh 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, firstname, and admissionNumber parameters.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id, termId, and sessioCVE-2023-41521 · Other software · Student Attendance Management System Project · reported by MITREHigh 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id, termId, and sessionName parameters.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmNameCVE-2023-41520 · Other software · Student Attendance Management System Project · reported by MITREHigh 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmName parameters.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm.CVE-2023-41519 · Other software · Student Attendance Management System Project · reported by MITREMedium 6.1
Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm.php.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.CVE-2023-40992 · Other software · Kishan0725 · reported by MITREMedium 6.5
Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.
- Product
- Hospital Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54784 · Other software · SuiteCRM · reported by GitHubHigh 8.6
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared message to the inbox of the SuiteCRM-instance. By simply viewing emails as the logged-in user, the payload can be triggered. With that, an attacker is able to run arbitrary actions as the logged-in user - like extracting data, or if it is an admin executing the payload, takeover the instance. This is fixed in versions 7.14.7.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54783 · Other software · SuiteCRM · reported by GitHubMedium 5.1
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but allow the JavaScript code to execute. This is fixed in version 7.14.7.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54788 · Other software · SuiteCRM · reported by GitHubHigh 8.8
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54786 · Other software · SuiteCRM · reported by GitHubMedium 5.3
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any user's meeting (calendar event) data given their username, related functionality allows user enumeration. This is fixed in versions 7.14.7 and 8.8.1.
- Product
- SuiteCRM-Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 6, 2025SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.CVE-2025-54785 · Other software · SuiteCRM · reported by GitHubHigh 8.8
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive data exposure, Denial of Service, cryptomining and ransomware. This issue is fixed in version 7.14.7 and 8.8.1.
- Product
- SuiteCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comgithub.com
Aug 6, 2025A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affeCVE-2025-20332 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid read-only Administrator credentials.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 6, 2025A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS attacCVE-2025-20331 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on the affected device.
- Product
- Cisco Identity Services Engine Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 6, 2025Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW MediCVE-2025-51040 · Other software · Electrolink · reported by MITREHigh 7.5
Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2.
- Product
- Fm/dab/tv Transmitter Web Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logsCVE-2025-2028 · Other software · checkpoint · reported by cve@checkpoint.comMedium 6.5
Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs
- Product
- Check Point Management Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.checkpoint.com
Aug 6, 2025Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account.CVE-2025-21010 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6
Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Aug 5, 2025Race condition issue occurring in the physical page import process of the memory management module.CVE-2025-54629 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Race condition issue occurring in the physical page import process of the memory management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Iterator failure vulnerability in the card management module.CVE-2025-54613 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Iterator failure vulnerability in the card management module.CVE-2025-54612 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Vulnerability that allows setting screen rotation direction without permission verification in the screen management module.CVE-2025-54608 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: Successful exploitation of this vulnerability may cause device screen orientation to be arbitrarily set.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Authentication management vulnerability in the ArkWeb module.CVE-2025-54607 · Other software · Huawei · reported by psirt@huawei.comHigh 7.7
Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025The Janssen Project is an open-source identity and access management (IAM) platform.CVE-2025-54876 · Other software · JanssenProject · reported by GitHubMedium 6.9
The Janssen Project is an open-source identity and access management (IAM) platform. In versions 1.9.0 and below, Janssen stores passwords in plaintext in the local cli_cmd.log file. This is fixed in the nightly prerelease.
- Product
- jans
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025RatPanel is a server operation and maintenance management panel.CVE-2025-53534 · Other software · tnb-labs · reported by GitHubHigh 7.7
RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6.
- Product
- panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, aCVE-2014-125113 · Other software · Dell/Quest · reported by VulnCheckCritical 9.3
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547 in the download_agent.php endpoint. An attacker can upload arbitrary PHP files to a temporary web-accessible directory, which are later executed through inclusion in backend code that loads files under attacker-controlled paths.
- Product
- KACE K1000 Systems Management Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsole-cowboys.blogspot.comraw.githubusercontent.com
Aug 5, 2025A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute comCVE-2025-54987 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.4
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Aug 4, 2025An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management networkCVE-2025-27212 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.8
An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro (Version 2.14.21 and earlier) UniFi Access G2 Reader Pro (Version 1.10.32 and earlier) UniFi Access G3 Reader Pro (Version 1.10.30 and earlier) UniFi Access Intercom (Version 1.7.28 and earlier) UniFi Access G3 Intercom (Version 1.7.29 and earlier) UniFi Access Intercom Viewer (Version 1.3.20 and earlier) Mitigation: Update UniFi Access Reader Pro Version 2.15.9 or later Update UniFi Access G2 Reader Pro Version 1.11.23 or later Update UniFi Access G3 Reader Pro Version 1.11.22 or later Update UniFi Access Intercom Version 1.8.22 or later Update UniFi Access G3 Intercom Version 1.8.22 or later Update UniFi Access Intercom Viewer Version 1.4.39 or later
- Product
- UniFi Access Reader Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch aCVE-2025-27211 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network.
- Product
- EdgeMAX EdgeSwitch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025IDonate – Blood Donation, Request And Donor Management System: Unauthorized access of dataCVE-2025-4523 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.
- Product
- IDonate – Blood Donation, Request And Donor Management System
- Affected
- 2.0.0 to 2.1.9
- What to do
- Affects 2.0.0 to 2.1.9. Update IDonate – Blood Donation, Request And Donor Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2025A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4.CVE-2025-52203 · Other software · Devaslanphp · reported by MITREHigh 7.6
A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are subsequently stored in the database. When a legitimate user logs in and is redirected to the Dashboard panel "automatically upon authentication the malicious script executes in the user's browser context.
- Product
- Project Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A stored Cross Site Scripting (xss) vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code viaCVE-2025-50270 · Other software · reported by MITREMedium 6.1
A stored Cross Site Scripting (xss) vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code via a crafted script to the title, categoryTitle, and tmpTag parameters.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 30, 2025CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56.CVE-2025-54085 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 5.1
CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly read or change other settings. The attack complexity is low, there are no preexisting attack requirements; the privileges required are high, and there is no user interaction required. The impact to system confidentiality and integrity is low, there is no impact to system availability.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56.CVE-2025-49084 · Other software · Absolutee Security · reported by SecurityResponse@netmotionsoftware.comMedium 5.3
CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrite policy rules without the requisite permissions. The attack complexity is low, attack requirements are present, privileges required are high and no user interaction is required. There is no impact to confidentiality, the impact to integrity is low, and there is no impact to availability. The impact to confidentiality and availability of subsequent systems is high and the impact to the integrity of subsequent systems is low.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025CVE-2025-49083 is a vulnerability in the management console of Absolute Secure Access after version 12.00 and prior to version 13.56.CVE-2025-49083 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comHigh 7
CVE-2025-49083 is a vulnerability in the management console of Absolute Secure Access after version 12.00 and prior to version 13.56. Attackers with administrative access to the console can cause unsafe content to be deserialized and executed in the security context of the console. The attack complexity is low and there are no attack requirements. Privileges required are high and there is no user interaction required. The impact to confidentiality is low, impact to integrity is high and there is no impact to availability. The impact to the confidentiality and integrity of subsequent systems is low and there is no subsequent system impact to availability.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.