Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,662 results · page 226 of 774
Sep 4, 2025Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be exploited by an unauthentCVE-2025-7385 · Other software · Concept Intermedia · reported by cvd@cert.plCritical 9.3
Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be exploited by an unauthenticated remote attacker. Versions 4.0 and above are not affected.
- Product
- GOV CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 20255ire is a cross-platform desktop artificial intelligence assistant and model context protocol client.CVE-2025-58357 · Other software · nanbingxyz · reported by GitHubCritical 9.6
5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Version 0.13.2 contains a vulnerability in the chat page's script gadgets that enables content injection attacks through multiple vectors: malicious prompt injection pages, compromised MCP servers, and exploited tool integrations. This is fixed in version 0.14.0.
- Product
- 5ire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384.CVE-2025-36904 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check.CVE-2025-36897 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106.CVE-2025-36896 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Elevation of PrivilegeCVE-2025-36890 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
Elevation of Privilege
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-55748 · Other software · xwiki · reported by GitHubCritical 9.3
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2025-55747 · Other software · xwiki · reported by GitHubCritical 9.3
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Sitecore Multiple Products Deserialization of Untrusted Data VulnerabilityCVE-2025-53690 · Other software · Sitecore · reported by 9947ef80-c5d5-474a-bbab-97341a59000eExploitedCritical 9
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
- Product
- Multiple Products
- On CISA’s list since
- Sep 4, 2025 (federal fix deadline Sep 25, 2025)
- What to do
- Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcloud.google.comsupport.sitecore.com
Sep 3, 2025A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them wiCVE-2025-56752 · Other software · Ruijie · reported by MITRECritical 9.4
A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them with unrestricted access to alter administrative settings and potentially seize control of affected devices via crafted HTTP POST request to /user.cgi.
- Product
- Rg-es228gs-p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass arCVE-2025-57052 · Other software · Davegamble · reported by MITRECritical 9.8
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
- Product
- Cjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-0r.comlists.debian.org
Sep 3, 2025Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore ExperienCVE-2025-53693 · Other software · Sitecore · reported by 9947ef80-c5d5-474a-bbab-97341a59000eCritical 9.8
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
- Product
- Sitecore Experience Manager (XM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.watchtowr.comsupport.sitecore.com
Sep 3, 2025Incorrect Default Permissions vulnerability in Apache DolphinScheduler.CVE-2024-43166 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.
- Product
- Apache DolphinScheduler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Sep 3, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, BruteCVE-2025-1740 · Other software · Akinsoft · reported by iletisim@usom.gov.trCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force. This issue affects MyRezzta: from s2.03.01 before v2.05.01.
- Product
- MyRezzta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 3, 2025RealHomes: Incorrect Privilege AssignmentCVE-2024-32444 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.3.6.
- Product
- RealHomes
- Affected
- up to 4.3.6
- What to do
- Affects up to 4.3.6. Update RealHomes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2025In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow.CVE-2025-26416 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 2, 2025In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion.CVE-2025-22435 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 2, 2025In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code.CVE-2025-22429 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 2, 2025Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability.CVE-2025-9276 · Other software · Cockroach Labs · reported by zdi-disclosures@trendmicro.comCritical 9.8
Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image. The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195.
- Product
- cockroach-k8s-request-cert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details.CVE-2025-9696 · Other software · SunPower · reported by ics-cert@hq.dhs.govCritical 9.4
The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the attacker to perform actions such as firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices.
- Product
- PVS6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password.CVE-2025-6519 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Critical 9.3
E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7.CVE-2025-5662 · Other software · h2oai · reported by security@huntr.devCritical 9.8
A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path.CVE-2025-57140 · Other software · Ruisitech · reported by MITRECritical 9.8
rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path.
- Product
- Ruisibi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system.CVE-2025-52551 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Critical 9.3
E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system.
- Product
- E2 Facility Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot.CVE-2025-52549 · Other software · Copeland LP · reported by dd59f033-460c-4b88-a075-d4d3fedb6191Critical 9.2
E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters.
- Product
- E3 Supervisory Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker tCVE-2024-28988 · Other software · SolarWinds · reported by psirt@solarwinds.comCritical 9.8
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability was found by the ZDI team after researching a previous vulnerability and providing this report. The ZDI team was able to discover an unauthenticated attack during their research. We recommend all Web Help Desk customers apply the patch, which is now available. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
- Product
- Web Help Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comsolarwinds.com
Sep 1, 2025In BootRom, there's a possible missing payload size check.CVE-2022-38696 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In BootRom, there's a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
- Product
- SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In FDL1, there is a possible missing payload size check.CVE-2022-38693 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In FDL1, there is a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
- Product
- SC9863A//T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation.CVE-2022-38692 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges.
- Product
- SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution andCVE-2025-6507 · Other software · h2oai · reported by security@huntr.devCritical 9.8
A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. This issue affects the latest master branch version 3.47.0.99999. The vulnerability arises from the ability to bypass regular expression filters intended to prevent malicious parameter injection in JDBC connections. Attackers can manipulate spaces between parameters to evade detection, allowing for unauthorized file access and code execution. The vulnerability is addressed in version 3.46.0.8.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier.CVE-2025-54857 · Other software · Seiko Solutions Inc. · reported by vultures@jpcert.or.jpCritical 9.3
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier. If exploited, a remote unauthenticated attacker may execute arbitrary OS commands with root privileges.
- Product
- SkyBridge BASIC MB-A130
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025School Management: Unrestricted Upload of File with Dangerous TypeCVE-2025-31100 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management allows Upload a Web Shell to a Web Server.This issue affects School Management: from n/a through 1.93.1 (02-07-2025).
- Product
- School Management
- Affected
- up to 1.93.1
- What to do
- Affects up to 1.93.1. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025Login with phone number: Missing AuthorizationCVE-2024-32832 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
- Product
- Login with phone number
- Affected
- up to 1.6.93
- What to do
- Affects up to 1.6.93. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 30, 2025Sunway ForceControl version 6.1 SP3 and earlier contains a stack-based buffer overflow vulnerability in the SNMP NetDBServer service, which listens on TCP port CVE-2011-10032 · Other software · Sunway · reported by VulnCheckCritical 9.3
Sunway ForceControl version 6.1 SP3 and earlier contains a stack-based buffer overflow vulnerability in the SNMP NetDBServer service, which listens on TCP port 2001. The flaw is triggered when the service receives a specially crafted packet using opcode 0x57 with an overly long payload. Due to improper bounds checking during packet parsing, attacker-controlled data overwrites the Structured Exception Handler (SEH), allowing arbitrary code execution in the context of the service. This vulnerability can be exploited remotely without authentication and may lead to full system compromise on affected Windows hosts.
- Product
- ForceControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaluigi.altervista.orgsunwayland.com
Aug 30, 2025BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality.CVE-2010-10016 · Other software · BS.Player · reported by VulnCheckCritical 10
BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u files, the application fails to properly validate the length of playlist entries, resulting in a buffer overflow condition. This flaw occurs during parsing of long URLs embedded in the playlist, allowing overwrite of Structured Exception Handler (SEH) records. The vulnerability is triggered upon opening a crafted playlist file and affects the Unicode parsing logic in the Windows client.
- Product
- BS.Player Free and Pro Editions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbsplayer.comraw.githubusercontent.com
Aug 30, 2025ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of CVE-2009-20011 · Other software · ContentKeeper Technologies · reported by VulnCheckCritical 10
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.
- Product
- ContentKeeper Web Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaushack.comraw.githubusercontent.com
Aug 30, 2025Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem.CVE-2009-20010 · Other software · Dogfood CRM · reported by VulnCheckCritical 9.3
Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from unsanitized user input passed via a POST request to the data parameter, which is processed by the underlying shell without adequate escaping. This allows attackers to inject arbitrary shell commands and execute them on the server. The flaw is exploitable without authentication and was discovered by researcher LSO.
- Product
- Dogfood CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comsourceforge.net
Aug 30, 2025Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler.CVE-2009-20009 · Other software · Belkin International, Inc. · reported by VulnCheckCritical 9.3
Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before copying it into a fixed-size buffer, resulting in memory corruption and potential remote code execution. Exploitation requires network access and does not require prior authentication.
- Product
- Bulldog Plus UPS Monitoring Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.coms3.belkin.com
Aug 30, 2025A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands.CVE-2025-54946 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.3
A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary CVE-2025-54945 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 10
An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deCVE-2025-54943 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.3
A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deploCVE-2025-54942 · Other software · SUNNET Technology Co., Ltd. · reported by ART@zuso.aiCritical 9.3
A missing authentication for critical function vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to access deployment functionality without prior authentication.
- Product
- Corporate Training Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A heap-based buffer overflow vulnerability in NetSupport Manager 14.x versions prior to 14.12.0000 allows a remote, unauthenticated attacker to cause a denial oCVE-2025-34164 · Other software · NetSupport Ltd. · reported by VulnCheckCritical 9.3
A heap-based buffer overflow vulnerability in NetSupport Manager 14.x versions prior to 14.12.0000 allows a remote, unauthenticated attacker to cause a denial of service (DoS) or execute arbitrary code.
- Product
- NetSupport Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsupportmanager.comvulncheck.com
Aug 29, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-58159 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.9
WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension. Because the uploaded file is written directly to disk without adequate sanitization or extension restrictions, a spreadsheet file followed by PHP code can be uploaded and executed on the server, leading to arbitrary code execution. This is due to insufficient mitigation of CVE-2025-22133. This issue has been patched in version 3.4.11.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component.CVE-2024-46484 · Other software · Trendnet · reported by MITRECritical 9.8
TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component.
- Product
- Tv-ip410 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025An improper authentication vulnerability has been reported to affect VioStor.CVE-2025-52856 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.3
An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and later
- Product
- VioStor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/javCVE-2025-44033 · Other software · Aaluoxiang · reported by MITRECritical 9.8
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/java/cn/gson/oasys/mappers/AddressMapper.java
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.CVE-2025-8861 · Other software · Changing · reported by twcert@cert.org.twCritical 9.3
TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.
- Product
- TSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 29, 2025Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator CVE-2025-8857 · Other software · Changing · reported by twcert@cert.org.twCritical 9.3
Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator credentials embedded in the source code.
- Product
- Clinic Image System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchtsecurity.comtwcert.org.tw
Aug 28, 2025Valtimo is a platform for Business Process Automation.CVE-2025-58059 · Other software · valtimo-platform · reported by GitHubCritical 9.1
Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to: running executables on the application host, inspecting and extracting data from the host environment or application properties, spring beans (application context, database pooling). The following conditions have to be met in order to perform this attack: the user must be logged in, have the admin role, and must have some knowledge about running scripts via a the Camunda/Operator engine. Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade. If no scripting is needed in any of the processes, it could be possible to disable it altogether via the ProcessEngineConfiguration. However, this workaround could lead to unexpected side-effects.
- Product
- valtimo-backend-libraries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.