Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,669 results · page 158 of 354
Dec 2, 2025A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signCVE-2025-13658 · Other software · Industrial Video & Control · reported by ics-cert@hq.dhs.govCritical 9.3
A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.
- Product
- Longwatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to accCVE-2025-13510 · Other software · Iskra · reported by ics-cert@hq.dhs.govCritical 9.3
The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.
- Product
- iHUB and iHUB Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint.CVE-2025-65844 · Other software · Evershop · reported by MITREHigh 7.5
EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.
- Product
- Evershop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system.CVE-2025-41066 · Other software · Horde · reported by cve-coordination@incibe.esMedium 6.9
Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system. To exploit the vulnerability, an HTTP request must be sent to ‘/imp/attachment.php’ including the parameters ‘id’ and ‘u’. If the specified user exists, the server will return the download of an empty file; if it does not exist, no download will be initiated, which unequivocally reveals the validity of the user.
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Unauthorized access vulnerability in TCMAN GIM v11 version 20250304.CVE-2025-41012 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 8.7
Unauthorized access vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system by using the 'pda:userId' and 'pda:newPassword' parameters with 'soapaction UnlockUser’ in '/WS/PDAWebService.asmx'.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys.CVE-2025-41742 · Other software · Sprecher Automation · reported by info@cert.vde.comCritical 9.8
Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance.
- Product
- SPRECON-E-C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsprecher-automation.com
Dec 1, 2025A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request tCVE-2025-51683 · Other software · Mjobtime · reported by MITRECritical 9.8
A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint .
- Product
- Mjobtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS CVE-2024-39148 · Other software · Kerlink · reported by MITREHigh 8.1
The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.
- Product
- Keros
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeros.docs.kerlink.combdosecurity.de
Dec 1, 2025Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel DriveCVE-2025-2879 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comMedium 5.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to expose sensitive data.This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p4, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0.
- Product
- Valhall GPU Kernel Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux aCVE-2025-41739 · Other software · CODESYS · reported by info@cert.vde.comMedium 5.9
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.
- Product
- CODESYS PLCHandler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, pCVE-2025-41738 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading to a denial-of-service (DoS) condition.
- Product
- CODESYS Control RTE (SL)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS develCVE-2025-41700 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.8
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system. This arbitrary code is executed in the user context.
- Product
- CODESYS Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the victim's bCVE-2025-65892 · Other software · Krpano · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the victim's browser via a crafted URL to the passQueryParameters function with the xml parameter enabled.
- Product
- Krpano
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unauthorized modification of dataCVE-2025-12971 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders.
- Product
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 27, 2025WP Fastest Cache: Unauthorized modification of dataCVE-2025-10476 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_db_fix_callback() function in all versions up to, and including, 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate several database fix actions. This only affects sites with premium activated.
- Product
- WP Fastest Cache
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Nov 27, 2025AI ChatBot with ChatGPT and Content Generator by AYS: Unauthorized accessCVE-2025-13381 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ays_chatgpt_save_wp_media' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files.
- Product
- AI ChatBot with ChatGPT and Content Generator by AYS
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update AI ChatBot with ChatGPT and Content Generator by AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 26, 2025Reuters Direct: Unauthorized modification of dataCVE-2025-12579 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings.
- Product
- Reuters Direct
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Reuters Direct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 26, 2025ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint.CVE-2020-36874 · Other software · ACE SECURITY · reported by VulnCheckHigh 8.7
ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that could facilitate further compromise of the camera or connected network.
- Product
- WIP-90113 HD Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordacesecurity.jpcxsecurity.com
Nov 26, 2025Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backupCVE-2020-36873 · Other software · Astak · reported by VulnCheckHigh 8.7
Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that could facilitate further compromise of the camera or connected network.
- Product
- CM-818T3 2.4GHz Wireless Security Surveillance Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsvulncheck.com
Nov 26, 2025ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint.CVE-2020-36871 · Other software · ESCAM · reported by VulnCheckHigh 8.7
ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint allows remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup can include administrative credentials and other sensitive device settings, enabling an unauthenticated remote attacker to obtain information that may facilitate further compromise of the camera or connected network.
- Product
- QD-900 WIFI HD Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsexploit-db.com
Nov 26, 2025Tellion HN-2204AP routers contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/system_config_file management endpoint.CVE-2019-25227 · Other software · Tellion, Inc. · reported by VulnCheckHigh 8.7
Tellion HN-2204AP routers contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/system_config_file management endpoint. The endpoint allows remote retrieval of a compressed configuration archive without requiring authentication or authorization. The exposed configuration may include administrative credentials, wireless keys, and other sensitive settings, enabling an unauthenticated attacker to obtain information that can facilitate further compromise of the device or network.
- Product
- HN-2204AP Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsweb.archive.org
Nov 26, 2025Dongyoung Media DM-AP240T/W wireless access points contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/sys_system_config managemenCVE-2019-25226 · Other software · Dongyoung Media Tech Co., Ltd. · reported by VulnCheckHigh 8.7
Dongyoung Media DM-AP240T/W wireless access points contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/sys_system_config management endpoint. The endpoint allows remote retrieval of a compressed configuration archive without requiring authentication or authorization. The exposed configuration may include administrative credentials and other sensitive settings, enabling an unauthenticated attacker to obtain information that can facilitate further compromise of the device or network.
- Product
- DM-AP240T/W Wireless Access Point
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddongyoung.comcxsecurity.com
Nov 26, 2025An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive information includingCVE-2025-65278 · Other software · Komal97 · reported by MITREHigh 7.5
An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive information including plaintext usernames and passwords.
- Product
- Grocerymart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919decaCVE-2025-65276 · Other software · Henzljw · reported by MITRECritical 9.8
An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 (2021-07-02). Due to missing authentication checks on /admin_index.php, an attacker can directly access the admin dashboard without valid credentials. This allows full administrative control including viewing/modifying user accounts, managing orders, changing payments, and editing product listings. Successful exploitation can lead to information disclosure, data manipulation, and privilege escalation.
- Product
- Hashtech
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 26, 2025An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information CVE-2025-65681 · Other software · Edly · reported by MITRELow 3.3
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
- Product
- Tutor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.tutor.edly.iogithub.com
Nov 26, 2025Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.CVE-2025-65672 · Other software · Classroomio · reported by MITREHigh 7.5
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.
- Product
- Classroomio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are oCVE-2025-62354 · Other software · cursor · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 9.8
Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution.
- Product
- cursor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66263 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 8.9
Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_setting.php allows reading arbitrary files. The `/var/tdf/download_setting.php` endpoint constructs file paths by concatenating user-controlled `$_GET['filename']` with a forced `.tgz` extension. Running on PHP 5.3.2 (pre-5.3.4), the application is vulnerable to null byte injection (%00), allowing attackers to bypass the extension restriction and traverse paths. By requesting `filename=../../../../etc/passwd%00`, the underlying C functions treat the null byte as a string terminator, ignoring the appended `.tgz` and enabling unauthenticated arbitrary file disclosure of any file readable by the web server user.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66261 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.9
Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec() allows remote code execution. The `/var/tdf/restore_settings.php` endpoint passes user-controlled `$_GET["name"]` parameter through `urldecode()` directly into `exec()` without validation or escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, `&&`, etc.) to achieve unauthenticated remote code execution as the web server user.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66257 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.2
Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files. The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66256 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.9
Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66255 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.9
Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages. The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66254 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 7.8
Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade parameter allows unauthenticated deletion of arbitrary files. The `deleteupgrade` parameter in `/var/www/upgrade_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/upload/` without any extension restriction or path sanitization, enabling attackers to remove critical system files.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66253 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.9
Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec() allows remote code execution via start_upgrade.php. The `/var/tdf/start_upgrade.php` endpoint passes user-controlled `$_GET["filename"]` directly into `exec()` without sanitization or shell escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, etc.) to achieve remote code execution as the web server user (likely root).
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66251 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 7.7
Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden parameter allows path traversal deletion of arbitrary .tgz files.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66250 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.2
Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network.CVE-2025-64657 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure App Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network.CVE-2025-64656 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.4
Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure App Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verificaCVE-2025-51741 · Other software · Interviewx · reported by MITREHigh 7.5
An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verification messages to arbitrary users via the /sendEmailCodeForResetPwd endpoint potentially causing a denial of service to the server or the downstream users.
- Product
- Echo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 25, 2025An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynCVE-2025-12816 · Other software · Digital Bazaar · reported by cret@cert.orgHigh 8.6
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
- Product
- node-forge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025UnForm Server versions < 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint.CVE-2025-34350 · Other software · Synergetic Data Systems, Inc. · reported by VulnCheckHigh 8.7
UnForm Server versions < 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so without enforcing authentication or restricting path inputs. As a result, an unauthenticated remote attacker can supply local filesystem paths to read arbitrary files accessible to the service account. On Windows deployments, providing a UNC path can also coerce the server into initiating outbound SMB authentication, potentially exposing NTLM credentials for offline cracking or relay. This issue may lead to sensitive information disclosure and, in some environments, enable further lateral movement.
- Product
- UnForm Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordunform.comvulncheck.com
Nov 25, 2025SiRcom SMART Alert (SiSA) allows unauthorized access to backend APIs.CVE-2025-13483 · Other software · SiRcom · reported by ics-cert@hq.dhs.govHigh 8.8
SiRcom SMART Alert (SiSA) allows unauthorized access to backend APIs. This allows an unauthenticated attacker to bypass the login screen using browser developer tools, gaining access to restricted parts of the application.
- Product
- SMART Alert (SiSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms.CVE-2025-64061 · Other software · Primakon · reported by MITREMedium 4.3
Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level (including standard or low-privileged users), can make a GET request to this endpoint and retrieve a complete, unfiltered list of all registered application users. Crucially, the API response body for this endpoint includes password hashes.
- Product
- Project Contract Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comprimakon.com
Nov 25, 2025Chamber Dashboard Business Directory: Unauthorized data exportCVE-2025-13414 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information, including sensitive business details.
- Product
- Chamber Dashboard Business Directory
- Affected
- up to 3.3.11
- What to do
- Affects up to 3.3.11. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025Ace Post Type Builder: Unauthorized custom taxonomy deletionCVE-2025-13405 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing authorization validation on the cptb_delete_custom_taxonomy() function in all versions up to, and including, 1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary custom taxonomies.
- Product
- Ace Post Type Builder
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Ace Post Type Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025atec Duplicate Page & Post: Unauthorized post duplicationCVE-2025-13404 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The atec Duplicate Page & Post plugin for WordPress is vulnerable to unauthorized post duplication due to missing authorization validation on the duplicate_post() function in all versions up to, and including, 1.2.20. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, including private and password-protected posts, leading to data exposure.
- Product
- atec Duplicate Page & Post
- Affected
- up to 1.2.20
- What to do
- Affects up to 1.2.20. Update atec Duplicate Page & Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Unauthorized access of dataCVE-2025-13389 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.
- Product
- Admin and Customer Messages After Order for WooCommerce: OrderConvo
- Affected
- up to 14
- What to do
- Affects up to 14. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025Social Images Widget: Unauthorized modification of dataCVE-2025-13386 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Social Images Widget
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Social Images Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025Refund Request for WooCommerce: Unauthorized modification of dataCVE-2025-12634 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_refund_status' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update refund statuses to approved or rejected.
- Product
- Refund Request for WooCommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Refund Request for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 25, 2025Autochat Automatic Conversation: Unauthorized modification of dataCVE-2025-12043 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Autochat Automatic Conversation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_auycht_saveCid' AJAX endpoint in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to connect and disconnect the client ID.
- Product
- Autochat Automatic Conversation
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Autochat Automatic Conversation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.