Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,382 results · page 16 of 28
Sep 2, 2025A vulnerability was determined in Tenda CP6 11.10.00.243.CVE-2025-9828 · Network & remote access · Tenda · reported by VulDBLow 2.9
A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized.
- Product
- CP6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid useCVE-2025-46047 · Other software · Silverpeas · reported by MITREMedium 6.5
A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.
- Product
- Silverpeas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-9812 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20.CVE-2025-9806 · Network & remote access · Tenda · reported by VulDBLow 0.9
A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation with the input Fireitup causes hard-coded credentials. The attack can only be executed locally. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized.
- Product
- F1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0.CVE-2025-9797 · Other software · mrvautin · reported by VulDBLow 1.9
A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/product/edit/ of the component Edit Product Page. This manipulation causes injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- expressCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423.CVE-2025-9783 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423. This issue affects the function sub_418030 of the file /boafrm/formParentControl. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-9748 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected by this issue is the function fromIpsecitem of the file /goform/IPSECsave of the component httpd. Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow. The attack may be performed from remote.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability was determined in Tenda AC9 15.03.05.19.CVE-2025-9731 · Network & remote access · Tenda · reported by VulDBLow 1.1
A vulnerability was determined in Tenda AC9 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation causes hard-coded credentials. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized.
- Product
- AC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-9724 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was determined in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /intranet/educar_nivel_ensino_cad.php. Executing manipulation of the argument nm_nivel/descricao can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability was determined in O2OA up to 10.0-410.CVE-2025-9716 · Other software · Zoneland · reported by VulDBLow 2
A vulnerability was determined in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_processplatform_assemble_designer/jaxrs/form of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
- Product
- O2oa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-9684 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was determined in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/edit of the component Formula de Cálculo de Média Page. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A vulnerability was determined in Voice Changer App up to 1.1.0.CVE-2025-9675 · Other software · Voice Changer Project · reported by VulDBLow 1.9
A vulnerability was determined in Voice Changer App up to 1.1.0. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.tuyangkeji.changevoice. Executing manipulation can lead to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized.
- Product
- Voice Changer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-9652 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of the component Cadastrar tipo de transferência Page. This manipulation of the argument nm_tipo/desc_tipo causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 28, 2025A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4.CVE-2025-9603 · Other software · Telesquare · reported by VulDBLow 2.1
A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TLR-2005KSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810.CVE-2025-9589 · Other software · Cudy · reported by VulDBLow 1.1
A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. Affected is an unknown function of the file /etc/shadow. Executing manipulation can lead to use of default password. The attack needs to be launched locally. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WR1200EA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A vulnerability was determined in Comfast CF-N1 2.6.0.CVE-2025-9585 · Other software · Comfast · reported by VulDBLow 2.1
A vulnerability was determined in Comfast CF-N1 2.6.0. This affects the function wifilith_delete_pic_file of the file /usr/bin/webmgnt. This manipulation of the argument portal_delete_picname causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CF-N1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001.CVE-2025-9575 · Network & remote access · Linksys · reported by VulDBLow 2.1
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function cgiMain of the file /cgi-bin/upload.cgi. Executing manipulation of the argument filename can lead to os command injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RE6250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025A vulnerability was determined in Linksys E1700 1.0.0.4.003.CVE-2025-9528 · Network & remote access · Linksys · reported by VulDBLow 2
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function systemCommand of the file /goform/systemCommand. Executing manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E1700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0.CVE-2025-9434 · Other software · 1000projects · reported by VulDBLow 2.1
A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/edit_title.php?id=1. Executing manipulation of the argument desc can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Online Project Report Submission and Evaluation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2025A vulnerability was determined in jqlang jq up to 1.6.CVE-2025-9403 · Other software · jqlang · reported by VulDBLow 1.9
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.
- Product
- jq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 24, 2025A vulnerability was determined in Scada-LTS up to 2.7.8.1.CVE-2025-9388 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2025A vulnerability was determined in Belkin AX1800 1.1.00.016.CVE-2025-9379 · Other software · Belkin · reported by VulDBHigh 8.6
A vulnerability was determined in Belkin AX1800 1.1.00.016. Affected by this vulnerability is an unknown functionality of the component Firmware Update Handler. This manipulation causes insufficient verification of data authenticity. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AX1800
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001.CVE-2025-9356 · Network & remote access · Linksys · reported by VulDBHigh 7.4
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function inboundFilterAdd of the file /goform/inboundFilterAdd. Executing manipulation of the argument ruleName can lead to stack-based buffer overflow. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RE6250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3.CVE-2025-9310 · Other software · yeqifu · reported by VulDBMedium 5.5
A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unknown functionality of the file /carRental_war/druid/login.html of the component Druid. Executing manipulation can lead to hard-coded credentials. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
- Product
- carRental
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025A vulnerability was determined in cmake 4.1.20250725-gb5cce23.CVE-2025-9301 · Other software · reported by VulDBLow 1.9
A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgitlab.kitware.com
Aug 20, 2025A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001.CVE-2025-9249 · Network & remote access · Linksys · reported by VulDBHigh 7.4
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function DHCPReserveAddGroup of the file /goform/DHCPReserveAddGroup. This manipulation of the argument enable_group/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RE6250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability was determined in Swatadru Exam-Seating-Arrangement up to 97335ccebf95468d92525f4255a2241d2b0b002f.CVE-2025-9238 · Other software · Swatadru · reported by VulDBMedium 5.5
A vulnerability was determined in Swatadru Exam-Seating-Arrangement up to 97335ccebf95468d92525f4255a2241d2b0b002f. Affected is an unknown function of the file /student.php of the component Student Login. Executing manipulation of the argument email can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Exam-Seating-Arrangement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 19, 2025A vulnerability was determined in neurobin shc up to 4.0.3.CVE-2025-9174 · Other software · neurobin · reported by VulDBLow 1.9
A vulnerability was determined in neurobin shc up to 4.0.3. This vulnerability affects the function make of the file src/shc.c of the component Filename Handler. Executing manipulation can lead to os command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized.
- Product
- shc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
Aug 19, 2025A vulnerability was determined in SolidInvoice up to 2.4.0.CVE-2025-9169 · Other software · Solidinvoice · reported by VulDBLow 2
A vulnerability was determined in SolidInvoice up to 2.4.0. Impacted is an unknown function of the file /quotes of the component Quote Module. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Solidinvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2.CVE-2025-9157 · Other software · appneta · reported by VulDBLow 1.9
A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2. The impacted element is the function untrunc_packet of the file src/tcpedit/edit_packet.c of the component tcprewrite. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. This patch is called 73008f261f1cdf7a1087dc8759115242696d35da. Applying a patch is advised to resolve this issue.
- Product
- tcpreplay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 19, 2025A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425.CVE-2025-9149 · Other software · Wavlink · reported by VulDBLow 2.1
A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. This impacts the function sub_4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guest_ssid causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- WL-NU516U1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A vulnerability was determined in Scada-LTS 2.7.8.1.CVE-2025-9139 · Other software · Scada-lts · reported by VulDBLow 2.1
A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower."
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025A vulnerability was determined in Netis WF2419 1.2.29433.CVE-2025-9119 · Other software · Netis · reported by VulDBLow 1.9
A vulnerability was determined in Netis WF2419 1.2.29433. This vulnerability affects unknown code of the file /index.htm of the component Wireless Settings Page. This manipulation of the argument SSID with the input <img/src/onerror=prompt(8)> causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WF2419
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025A vulnerability was determined in Portabilis i-Diario up to 1.5.0.CVE-2025-9107 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Diario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2025A vulnerability was determined in Elseplus File Recovery App 4.4.21 on Android.CVE-2025-9098 · Other software · Elseplus · reported by VulDBLow 1.9
A vulnerability was determined in Elseplus File Recovery App 4.4.21 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- File Recovery App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2025A vulnerability was determined in Tenda AC20 16.03.08.12.CVE-2025-9089 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC20 16.03.08.12. This issue affects the function sub_48E628 of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was determined in mtons mblog up to 3.5.0.CVE-2025-9005 · Other software · mtons · reported by VulDBLow 2.9
A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposure through error message. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was determined in LemonOS up to nightly-2024-07-12 on LemonOS.CVE-2025-9001 · Other software · Lemonos · reported by VulDBMedium 5.5
A vulnerability was determined in LemonOS up to nightly-2024-07-12 on LemonOS. Affected by this issue is the function HTTPGet of the file /Applications/Steal/main.cpp of the component HTTP Client. The manipulation of the argument chunkSize leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Lemonos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was determined in D-Link DIR-619L 6.02CN02.CVE-2025-8978 · Network & remote access · D-Link · reported by VulDBMedium 6.6
A vulnerability was determined in D-Link DIR-619L 6.02CN02. Affected is the function FirmwareUpgrade of the component boa. The manipulation leads to insufficient verification of data authenticity. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was determined in linlinjava litemall up to 1.8.0.CVE-2025-8974 · Other software · linlinjava · reported by VulDBLow 2.9
A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the input X-Litemall-Token leads to hard-coded credentials. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- litemall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was determined in jeecgboot JimuReport up to 2.1.1.CVE-2025-8963 · Other software · jeecgboot · reported by VulDBMedium 5.3
A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/testConnection of the component Data Large Screen Template. The manipulation leads to deserialization. The attack may be launched remotely. The vendor response to the GitHub issue report is: "Modified, next version updated".
- Product
- JimuReport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025A vulnerability was determined in Tenda AC20 up to 16.03.08.12.CVE-2025-8939 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/WifiGuestSet. The manipulation of the argument shareSpeed leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025A vulnerability was determined in mtons mblog up to 3.5.0.CVE-2025-8927 · Other software · mtons · reported by VulDBLow 2.9
A vulnerability was determined in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality of the file /email/send_code of the component Verification Code Handler. The manipulation of the argument email leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- mblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025A vulnerability was determined in Portabilis i-Diario up to 1.6.CVE-2025-8919 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the component History Page. The manipulation of the argument código/objetivo habilidade leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Diario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4.CVE-2025-8908 · Other software · Shanghai Lingdang Information Technology · reported by VulDBLow 2.1
A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. Affected by this issue is some unknown functionality of the file crm/WeiXinApp/yunzhijia/event.php. The manipulation of the argument openid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+."
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025A vulnerability was determined in LibTIFF up to 4.5.1.CVE-2025-8851 · Other software · Libtiff · reported by VulDBMedium 4.8
A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.
- Product
- Libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025A vulnerability was determined in NASM Netwide Assember 2.17rc0.CVE-2025-8844 · Other software · NASM · reported by VulDBLow 1.9
A vulnerability was determined in NASM Netwide Assember 2.17rc0. This vulnerability affects the function parse_smacro_template of the file preproc.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Netwide Assember
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usdrive.google.com
Aug 11, 2025A vulnerability was determined in jshERP up to 3.5.CVE-2025-8840 · Other software · Jishenghua · reported by VulDBLow 2.1
A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025A vulnerability was determined in JasPer up to 4.2.5.CVE-2025-8836 · Other software · Jasper Project · reported by VulDBLow 1.9
A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.
- Product
- Jasper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 11, 2025A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801.CVE-2025-8832 · Network & remote access · Linksys · reported by VulDBHigh 7.4
A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This vulnerability affects the function setDMZ of the file /goform/setDMZ. The manipulation of the argument DMZIPAddress leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RE6250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.