Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 19 of 87
May 15, 2025A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4731 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type/ip_subnet leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability was found in Meteor up to 3.2.1 and classified as problematic.CVE-2025-4727 · Other software · Meteor · reported by VulDBMedium 6.3
A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedata_server.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.2 is able to address this issue. The identifier of the patch is f7ea6817b90952baaea9baace2a3b4366fee6a63. It is recommended to upgrade the affected component.
- Product
- Meteor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Clasify Classified Listing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12725 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Clasify Classified Listing
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Clasify Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421.CVE-2025-4701 · Other software · VITA-MLLM · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the file models/utils.py. The manipulation of the argument path leads to deserialization. It is possible to launch the attack on the local host.
- Product
- Freeze-Omni
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic.CVE-2025-4552 · Other software · Continew · reported by VulDBMedium 5.3
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/system/user/1/password. The manipulation leads to unverified password change. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Continew Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0.CVE-2025-4551 · Other software · Continew · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Continew Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical.CVE-2025-4544 · Network & remote access · D-Link · reported by VulDBHigh 7.5
A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of the component jhttpd. The manipulation of the argument def_max/def_time/def_tcp_max/def_tcp_time/def_udp_max/def_udp_time/def_icmp_max leads to stack-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as critical, was found in LyLme Spage 2.1.CVE-2025-4543 · Other software · LyLme · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in LyLme Spage 2.1. This affects an unknown part of the file lylme_spage/blob/master/admin/ajax_link.php. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2.CVE-2025-4542 · Other software · Freeebird · reported by VulDBLow 2.3
A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functionality of the file /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- Hotel 酒店管理系统 API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as critical has been found in LmxCMS 1.41.CVE-2025-4541 · Other software · Lmxcms · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in LmxCMS 1.41. Affected is the function manageZt of the file c\admin\ZtAction.class.php of the component POST Request Handler. The manipulation of the argument sortid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic.CVE-2025-4537 · Other software · yangzongzhuan · reported by VulDBLow 2.3
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive information in a cookie. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- RuoYi-Vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
May 11, 2025A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical.CVE-2025-4536 · Other software · Gosuncn Technology Group · reported by VulDBMedium 6.9
A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmgr/user/listByPage. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Audio-Visual Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0.CVE-2025-4535 · Other software · Gosuncn Technology Group · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unknown function of the file /config/config.properties of the component Configuration File Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Audio-Visual Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A.CVE-2025-4534 · Other software · SunGrow · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A. This issue affects some unknown processing. The manipulation leads to weak password requirements. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Logger1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0.CVE-2025-4533 · Other software · Jeecg · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819.CVE-2025-4532 · Other software · Shanghai Bairui Information Technology · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SunloginClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows.CVE-2025-4525 · Other software · Discord · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Discord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 10, 2025A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2.CVE-2025-4515 · Other software · Zylon · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The manipulation of the argument allow_origins leads to permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PrivateGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 10, 2025A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E.CVE-2025-4514 · Other software · Zhengzhou Jiuhua Electronic Technology · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. Affected by this issue is some unknown functionality of the file /javascript.php. The manipulation of the argument Value leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- mayicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle.CVE-2025-4513 · Other software · Catalyst · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Affected by this vulnerability is an unknown functionality of the file /auth/userkey/logout.php of the component Logout. The manipulation of the argument return leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- User Key Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7.CVE-2025-4512 · Other software · Inetum · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7. Affected is an unknown function of the file /astre/iodasweb/app.jsp. The manipulation of the argument action leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- IODAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic.CVE-2025-4495 · Other software · JAdmin-JAVA · reported by VulDBMedium 5.1
A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /memoAjax/save. The manipulation of the argument ID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- JAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0.CVE-2025-4494 · Other software · JAdmin-JAVA · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java of the component Admin Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- JAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0.CVE-2025-4482 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0. Affected by this vulnerability is an unknown functionality of the file /change_pass/forgot_password_sql.php. The manipulation of the argument Pat_BloodGroup1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Student Project Allocation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4462 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4461 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4460 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0.CVE-2025-4457 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Car Rental Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0.CVE-2025-4456 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Car Rental Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical.CVE-2025-4452 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this issue is the function formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical.CVE-2025-4451 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this vulnerability is the function formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04.CVE-2025-4450 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04. Affected is the function formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04.CVE-2025-4449 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04. This issue affects the function formEasySetupWizard3. The manipulation of the argument wan_connected leads to buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04.CVE-2025-4448 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical.CVE-2025-4446 · Other software · H3C · reported by VulDBHigh 8.6
A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical. This vulnerability affects the function Edit_List_SSID of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack needs to be approached within the local network.
- Product
- GR-5400AX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01.CVE-2025-4445 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical.CVE-2025-4440 · Other software · H3C · reported by VulDBHigh 8.6
A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical. Affected by this issue is the function EnableIpv6 of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
- Product
- GR-1800AX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6.CVE-2023-7303 · Other software · q2apro · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6. This affects the function process_request of the file q2apro-onsitenotifications-page.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.8 is able to address this issue. The patch is named 0ca85ca02f8aceb661e9b71fd229c45d388ea5b5. It is recommended to upgrade the affected component.
- Product
- q2apro-on-site-notifications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06.CVE-2025-4368 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06. Affected is the function formGetRouterStatus of the file /goform/MtuSetMacWan. The manipulation of the argument shareSpeed leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02 and classified as critical.CVE-2025-4354 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02 and classified as critical. Affected by this issue is the function check_dws_cookie of the file /storage. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DAP-1520
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424.CVE-2025-4353 · Other software · Brilliance · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424. Affected is an unknown function of the file /paraframework/queryTsDictionaryType.htm. The manipulation of the argument dictCn1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Golden Link Secondary System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424.CVE-2025-4352 · Other software · Brilliance · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424. This issue affects some unknown processing of the file /reprotframework/tcEntrFlowSelect.htm. The manipulation of the argument custTradeId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Golden Link Secondary System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability classified as critical was found in D-Link DIR-600L up to 2.07B01.CVE-2025-4350 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-600L up to 2.07B01. This vulnerability affects the function wake_on_lan. The manipulation of the argument host leads to command injection. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01.CVE-2025-4349 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument host leads to command injection. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability was found in D-Link DIR-600L up to 2.07B01 and classified as critical.CVE-2025-4345 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-600L up to 2.07B01 and classified as critical. This issue affects the function formSetLog. The manipulation of the argument host leads to buffer overflow. The attack may be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-600L up to 2.07B01.CVE-2025-4344 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-600L up to 2.07B01. This affects the function formLogin. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability has been found in D-Link DIR-600L up to 2.07B01 and classified as critical.CVE-2025-4343 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-600L up to 2.07B01 and classified as critical. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-600L up to 2.07B01.CVE-2025-4342 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-600L up to 2.07B01. Affected by this issue is the function formEasySetupWizard3. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01.CVE-2025-4341 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01. Affected by this vulnerability is the function sub_16570 of the file /htdocs/ssdpcgi of the component Request Header Handler. The manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-880L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03.CVE-2025-4340 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-890L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.