Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

453new WordPress flaws this week

394,547entries in the database

38,662 results · page 227 of 774

Aug 28, 2025Paymenter is a free and open-source webshop solution for hostings.CVE-2025-58048 · Other software · Paymenter · reported by GitHubCritical 9.9
Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. This vulnerability was patched by commit 87c3db4 and was released under the version 1.2.11 tag without any other code modifications compared to version 1.2.10. If upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures: updating nginx config to download attachments instead of executing them or disallowing access to /storage/ fully using a WAF such as Cloudflare.
Product
Paymenter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 28, 2025Sangoma FreePBX Authentication Bypass VulnerabilityCVE-2025-57819 · Other software · Sangoma · reported by GitHubExploitedCritical 10
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
Product
FreePBX
On CISA’s list since
Aug 29, 2025 (federal fix deadline Sep 19, 2025)
What to do
Attackers are using this now. Install Sangoma’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.freepbx.org github.com
Aug 28, 2025D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component.CVE-2025-55583 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.
Product
Dir-868l Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cybermaya.in supportannouncement.us.dlink.com
Aug 28, 2025Jobmonster: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-54738 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Jobmonster: from n/a through <= 4.7.9.
Product
Jobmonster
Affected
up to 4.7.9
What to do
Affects up to 4.7.9. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Golo: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-54725 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through <= 1.7.0.
Product
Golo
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Golo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Nest Addons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54720 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons nest-addons allows SQL Injection.This issue affects Nest Addons: from n/a through <= 1.6.3.
Product
Nest Addons
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Nest Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025WP Funnel Manager: Deserialization of Untrusted DataCVE-2025-52761 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager: from n/a through <= 1.4.0.
Product
WP Funnel Manager
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update WP Funnel Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Miraculous Core: Incorrect Privilege AssignmentCVE-2025-49388 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Core Plugin: from n/a through <= 2.0.7.
Product
Miraculous Core
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Miraculous Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Drag and Drop File Upload for Elementor Forms: Unrestricted Upload of File with Dangerous TypeCVE-2025-49387 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.5.3.
Product
Drag and Drop File Upload for Elementor Forms
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Drag and Drop File Upload for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025bidorbuy Store Integrator: Improper Control of Generation of Code ('Code Injection')CVE-2025-48100 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inclusion.This issue affects bidorbuy Store Integrator: from n/a through <= 2.12.0.
Product
bidorbuy Store Integrator
Affected
up to 2.12.0
What to do
Affects up to 2.12.0. Update bidorbuy Store Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025WooBeWoo Product Filter Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39496 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6.
Product
WooBeWoo Product Filter Pro
Fixed in
2.9.6
What to do
Update WooBeWoo Product Filter Pro to 2.9.6 or newer.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, thCVE-2024-58240 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 ("tls: fix race between async notify and socket close") took care of it. This will make the next fix easier.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Aug 28, 2025SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands witCVE-2025-54762 · Other software · DOS Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.3
SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges.
Product
SS1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp dos-osaka.co.jp
Aug 28, 2025SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands witCVE-2025-53970 · Other software · DOS Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.3
SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges.
Product
SS1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp dos-osaka.co.jp
Aug 28, 2025RingCentral Communications: Authentication BypassCVE-2025-7955 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.
Product
RingCentral Communications
Affected
1.5 to 1.6.8
What to do
Affects 1.5 to 1.6.8. Update RingCentral Communications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 27, 2025A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP).CVE-2025-34523 · Other software · Arcserve · reported by VulnCheckCritical 9.2
A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted data, a remote attacker can corrupt heap memory, potentially causing a denial of service or enabling arbitrary code execution depending on the memory layout and exploitation techniques used. This vulnerability is similar in nature to CVE-2025-34522 but affects a separate code path or component. No user interaction is required, and exploitation occurs in the context of the vulnerable process. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue.
Product
Unified Data Protection (UDP)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.arcserve.com
Aug 27, 2025A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP).CVE-2025-34522 · Other software · Arcserve · reported by VulnCheckCritical 9.2
A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without authentication by sending specially crafted input to the target system. Improper bounds checking allows an attacker to overwrite heap memory, potentially leading to application crashes or remote code execution. Exploitation occurs in the context of the affected process and does not require user interaction. The vulnerability poses a high risk due to its pre-authentication nature and potential for full compromise. This vulnerability affects all UDP versions prior to 10.2. UDP 10.2 includes the necessary patches and requires no action. Versions 8.0 through 10.1 are supported and require either patch application or upgrade to 10.2. Versions 7.x and earlier are unsupported or out of maintenance and must be upgraded to 10.2 to remediate the issue.
Product
Unified Data Protection (UDP)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.arcserve.com
Aug 27, 2025Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access cCVE-2025-34163 · Other software · Qingdao Dongsheng Weiye Software Co., Ltd. · reported by VulnCheckCritical 10
Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST request. This allows remote code execution on the server, potentially leading to full system compromise. The vulnerability is presumed to affect builds released prior to July 2025 and is remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-23 UTC.
Product
Dongsheng Logistics Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dongshengsoft.com cn-sec.com
Aug 27, 2025An unauthenticated SQL injection vulnerability exists in the GetLyfsByParams endpoint of Bian Que Feijiu Intelligent Emergency and Quality Control System, accesCVE-2025-34162 · Other software · Feijiu Medical Technology Co., Ltd. · reported by VulnCheckCritical 9.3
An unauthenticated SQL injection vulnerability exists in the GetLyfsByParams endpoint of Bian Que Feijiu Intelligent Emergency and Quality Control System, accessible via the /AppService/BQMedical/WebServiceForFirstaidApp.asmx interface. The backend fails to properly sanitize user-supplied input in the strOpid parameter, allowing attackers to inject arbitrary SQL statements. This can lead to data exfiltration, authentication bypass, and potentially remote code execution, depending on backend configuration. The vulnerability is presumed to affect builds released prior to June 2025 and is remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-23 UTC.
Product
Bian Que Feijiu Intelligent Emergency and Quality Control System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ivtbq.com cn-sec.com
Aug 27, 2025AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250.CVE-2025-34160 · Other software · Shanghai Aishu Information Technology Co., Ltd. · reported by VulnCheckCritical 10
AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/start_service accepts user-supplied input via POST and fails to sanitize command-like payloads. An attacker can inject shell syntax that is interpreted by the backend, enabling arbitrary command execution. The vulnerability is presumed to affect builds released prior to August 2025 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 UTC.
Product
AnyShare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cn-sec.com stack.chaitin.com
Aug 27, 2025A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the cCVE-2024-13985 · Other software · Zhejiang Dahua Technology Co., Ltd. · reported by VulnCheckCritical 10
A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without sanitization or authentication. By sending crafted HTTP requests, attackers can inject OS-level commands that are executed on the server, leading to full system compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-04-06 UTC.
Product
EIMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.csdn.net cn-sec.com
Aug 27, 2025QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthentiCVE-2024-13984 · Other software · Qi'anxin · reported by VulnCheckCritical 10
QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability in the rptsvr component that allows unauthenticated attackers to upload files to arbitrary locations on the server. The /rptsvr/upload endpoint fails to sanitize the filename parameter in multipart form-data requests, enabling path traversal. This allows attackers to place executable files in web-accessible directories, potentially leading to remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-08-23 UTC.
Product
TianQing Management Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.csdn.net cn-sec.com
Aug 27, 2025LiveBOS, an object-oriented business architecture middleware suite developed by Apex Software Co., Ltd., contains an arbitrary file upload vulnerability in its CVE-2024-13981 · Other software · Fujian Apex Software Co. Ltd. · reported by VulnCheckCritical 10
LiveBOS, an object-oriented business architecture middleware suite developed by Apex Software Co., Ltd., contains an arbitrary file upload vulnerability in its UploadFile.do;.js.jsp endpoint. This flaw affects the LiveBOS Server component and allows unauthenticated remote attackers to upload crafted files outside the intended directory structure via path traversal in the filename parameter. Successful exploitation may lead to remote code execution on the server, enabling full system compromise. The vulnerability is presumed to affect builds released prior to August 2024 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-08-23 UTC.
Product
LiveBOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record axsec.blog.csdn.net blog.csdn.net
Aug 27, 2025H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoinCVE-2024-13980 · Other software · H3C Group · reported by VulnCheckCritical 10
H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters, potentially leading to arbitrary command execution. This flaw does not require authentication and may be exploited without session cookies. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-08-28 UTC.
Product
Intelligent Management Center (iMC)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record axsec.blog.csdn.net blog.csdn.net
Aug 27, 2025A SQL injection vulnerability exists in the St.CVE-2024-13979 · Other software · Hangzhou Shengqiao Technology Co. Ltd. · reported by VulnCheckCritical 9.3
A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.
Product
St. Joe ERP System ("圣乔ERP系统")
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.csdn.net en.fofa.info
Aug 27, 2025A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management PCVE-2023-7309 · Other software · Zhejiang Dahua Technology Co., Ltd. · reported by VulnCheckCritical 10
A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management Platform), affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated remote attackers to upload arbitrary files to the server via crafted SOAP requests, including executable JSP payloads. Successful exploitation may lead to remote code execution (RCE) and full compromise of the affected system. The vulnerability is presumed to affect builds released prior to September 2023 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-02-15 UTC.
Product
Smart Park Integrated Management Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record developer.aliyun.com github.com
Aug 27, 2025Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability iCVE-2018-25115 · Network & remote access · D-Link · reported by VulnCheckCritical 10
Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contain a vulnerability in the service.cgi endpoint that allows remote attackers to execute arbitrary system commands without authentication. The flaw stems from improper input handling in the EVENT=CHECKFW parameter, which is passed directly to the system shell without sanitization. A crafted HTTP POST request can inject commands that are executed with root privileges, resulting in full device compromise. These router models are no longer supported at the time of assignment and affected version ranges may vary. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-08-21 UTC.
Product
DIR-110
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com legacy.us.dlink.com
Aug 27, 2025In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script.CVE-2025-50428 · Other software · Raspap · reported by MITRECritical 9.8
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sanitizing of user input passed via the interface parameter.
Product
Raspap-webgui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.smarttecs.com github.com
Aug 27, 2025Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow.CVE-2025-34161 · Other software · coolLabs Technologies · reported by VulnCheckCritical 9.4
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.
Product
Coolify
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coolify.io github.com
Aug 27, 2025Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow.CVE-2025-34159 · Other software · coolLabs Technologies · reported by VulnCheckCritical 9.4
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.
Product
Coolify
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coolify.io github.com
Aug 27, 2025Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow.CVE-2025-34157 · Other software · coolLabs Technologies · reported by VulnCheckCritical 9.4
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.
Product
Coolify
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record coolify.io github.com
Aug 27, 2025Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection CVE-2025-52122 · Other software · Solspace · reported by MITRECritical 9.8
Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).
Product
Freeform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 27, 2025OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php).CVE-2025-50989 · Other software · OPNsense · reported by MITRECritical 9.1
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typically root), potentially leading to full system compromise or lateral movement. This vulnerability arises from inadequate input validation and improper handling of user-supplied data in backend command invocations.
Product
OPNsense
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 27, 2025SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php.CVE-2025-50972 · Other software · Abantecart · reported by MITRECritical 9.8
SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Three techniques have been demonstrated: error-based injection using a crafted FLOOR-based payload, time-based blind injection via SLEEP(), and UNION-based injection to extract arbitrary data.
Product
Abantecart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 27, 2025Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability.CVE-2025-43728 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Product
ThinOS 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com
Aug 27, 2025The configuration file containing database logins and passwords is readable by any local user.CVE-2025-30063 · Other software · CGM · reported by cvd@cert.plCritical 9.4
The configuration file containing database logins and passwords is readable by any local user.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 27, 2025In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.CVE-2025-30057 · Other software · CGM · reported by cvd@cert.plCritical 9.4
In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 27, 2025The RunCommand function accepts any parameter, which is then passed for execution in the shell.CVE-2025-30056 · Other software · CGM · reported by cvd@cert.plCritical 9.4
The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 27, 2025The "system" function receives untrusted input from the user.CVE-2025-30055 · Other software · CGM · reported by cvd@cert.plCritical 9
The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 27, 2025The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data CVE-2025-30041 · Other software · CGM · reported by cvd@cert.plCritical 9
The paths "/cgi-bin/CliniNET.prd/utils/userlogstat.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl" expose data containing session IDs.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 27, 2025The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pCVE-2025-30040 · Other software · CGM · reported by cvd@cert.plCritical 9
The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 27, 2025Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users CVE-2025-30039 · Other software · CGM · reported by cvd@cert.plCritical 9
Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 27, 2025In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" parameter.CVE-2025-2313 · Other software · CGM · reported by cvd@cert.plCritical 9.4
In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" parameter.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 26, 2025Agiloft Release 28 downloads critical system packages over an insecure HTTP connection.CVE-2025-35115 · Other software · Agiloft · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.2
Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the contents of the download URL. Users should upgrade to Agiloft Release 30.
Product
Agiloft
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com wiki.agiloft.com
Aug 26, 2025In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free.CVE-2025-22408 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Aug 26, 2025In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free.CVE-2025-22403 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Aug 26, 2025In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free.CVE-2025-0075 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Aug 26, 2025In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free.CVE-2025-0074 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Aug 26, 2025Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext wiCVE-2025-55443 · Other software · Telpo · reported by MITRECritical 9.1
Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to: 1. Authenticate to the MDM web platform to execute administrative operations (device shutdown/factory reset/software installation); 2. Connect to the MQTT server to intercept/publish device data.
Product
Telpo MDM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Aug 26, 2025An arbitrary code execution vulnerability in Badaso CMS 2.9.11.CVE-2025-52353 · Other software · Uatech · reported by MITRECritical 9.8
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
Product
Badaso
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com medium.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.