Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

460new WordPress flaws this week

394,717entries in the database

38,681 results · page 238 of 774

Jul 22, 2025Focus incorrectly truncated URLs towards the beginning instead of around the origin.CVE-2025-8043 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 22, 2025Thunderbird ignored paths when checking the validity of navigations in a frame.CVE-2025-8038 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 22, 2025Setting a nameless cookie with an equals sign in the value shadowed other cookies.CVE-2025-8037 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.1
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 22, 2025The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials.CVE-2025-8031 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 22, 2025On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computCVE-2025-8028 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 22, 2025Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcinCVE-2025-6523 · Other software · Devolutions · reported by security@devolutions.netCritical 9.5
Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier
Product
Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net
Jul 22, 2025An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform.CVE-2025-34143 · Other software · ETQ · reported by VulnCheckCritical 9.3
An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.
Product
Reliance CG (legacy)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record slcyber.io etq.com
Jul 22, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolantis Information Technologies Agentis allows SQL InjecCVE-2025-4285 · Other software · Rolantis Information Technologies · reported by iletisim@usom.gov.trCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolantis Information Technologies Agentis allows SQL Injection. This issue affects Agentis: before 4.32.
Product
Agentis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jul 22, 2025bSecure: Privilege EscalationCVE-2025-6187 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/order_info/ route with a permission_callback that always returns true, effectively bypassing all authentication. This makes it possible for unauthenticated attackers who know any user’s email to obtain a valid login cookie and fully impersonate that account.
Product
bSecure
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update bSecure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2025Website Contact Form With File Upload: Arbitrary file uploadsCVE-2015-10137 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Website Contact Form With File Upload
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Website Contact Form With File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 21, 2025FoxyPress: Arbitrary file uploadsCVE-2012-10020 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
FoxyPress
Affected
up to 0.4.2.1
What to do
Affects up to 0.4.2.1. Update FoxyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 21, 2025HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance.CVE-2025-54127 · Other software · haxtheweb · reported by GitHubCritical 9.3
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.
Product
issues
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 21, 2025Manager-io/Manager is accounting software.CVE-2025-54122 · Other software · Manager-io · reported by GitHubCritical 10
Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal services, cloud metadata endpoints, and exfiltration of sensitive data from isolated network segments. This vulnerability is fixed in version 25.7.21.2525.
Product
Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 21, 2025RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface.CVE-2025-54071 · Other software · rommapp · reported by GitHubCritical 9.4
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to Remote Code Execution on the system. The vulnerability permits arbitrary file write operations, allowing attackers to create or modify files at any filesystem location with user-supplied content. A user with viewer role or Scope.ASSETS_WRITE permission or above is required to pass authentication checks. The vulnerability is fixed in version 4.0.0-beta.4.
Product
romm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 21, 2025Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior.CVE-2025-52362 · Other software · reported by MITRECritical 9.1
Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the _proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Jul 21, 2025A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' CVE-2020-26799 · Other software · reported by MITRECritical 9.8
A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record suryadina.com luxsoft.eu
Jul 21, 2025In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file.CVE-2025-44654 · Network & remote access · Linksys · reported by MITRECritical 9.8
In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
Product
E2500 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Jul 21, 2025An issue was discovered in Eveo URVE Web Manager 27.02.2025.CVE-2025-36846 · Other software · Eveo · reported by MITRECritical 9.8
An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.
Product
Urve Web Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record smartoffice.expert syss.de
Jul 21, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 beforeCVE-2025-7393 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.
Product
Mail Login
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Jul 21, 2025In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions.CVE-2025-44658 · Network & remote access · Netgear · reported by MITRECritical 9.8
In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.
Product
Rax30 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com netgear.com
Jul 21, 2025In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf.CVE-2025-44655 · Other software · Totolink · reported by MITRECritical 9.8
In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
Product
A7100ru Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Jul 21, 2025An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdCVE-2025-46122 · Other software · Ruckuswireless · reported by MITRECritical 9.1
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.
Product
Ruckus Unleashed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sector7.computest.nl support.ruckuswireless.com
Jul 21, 2025An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stCVE-2025-46121 · Other software · Ruckuswireless · reported by MITRECritical 9.8
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the format string. A remote attacker can exploit this flaw either by sending a crafted request to the authenticated endpoint `/admin/_conf.jsp`, or without authentication and without direct network access to the controller by spoofing the MAC address of a favourite station and embedding malicious format specifiers in the DHCP hostname field, resulting in unauthenticated format-string processing and arbitrary code execution on the controller.
Product
Ruckus Unleashed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sector7.computest.nl support.ruckuswireless.com
Jul 21, 2025An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a patCVE-2025-46120 · Other software · Ruckuswireless · reported by MITRECritical 9.8
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remote unauthenticated attacker who can upload a template (e.g., via FTP) to escalate privileges and run arbitrary template code on the controller.
Product
Ruckus Unleashed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sector7.computest.nl support.ruckuswireless.com
Jul 21, 2025An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hidCVE-2025-46117 · Other software · Ruckuswireless · reported by MITRECritical 9.1
An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hidden debug script `.ap_debug.sh` invoked from the restricted CLI does not properly sanitize its input, allowing an authenticated attacker to execute arbitrary commands as root on the controller or specified target.
Product
Ruckus Unleashed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sector7.computest.nl support.ruckuswireless.com
Jul 21, 2025An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code executionCVE-2025-7624 · Network & remote access · Sophos · reported by security-alert@sophos.comCritical 9.8
An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA.
Product
Sophos Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sophos.com
Jul 21, 2025An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth rCVE-2025-6704 · Network & remote access · Sophos · reported by security-alert@sophos.comCritical 9.8
An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability (HA) mode.
Product
Sophos Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sophos.com
Jul 21, 2025Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region.CVE-2024-6107 · Other software · Canonical · reported by security@ubuntu.comCritical 9.6
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
Product
MAAS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net
Jul 21, 2025Certain modem models developed by Askey has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execCVE-2025-7921 · Other software · ASKEY · reported by twcert@cert.org.twCritical 9.3
Certain modem models developed by Askey has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and potentially execute arbitrary code.
Product
RTF8207w
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jul 21, 2025The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and CVE-2025-7343 · Other software · Digiwin · reported by twcert@cert.org.twCritical 9.3
The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
Product
SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digiwin.com twcert.org.tw
Jul 21, 2025File contents could be read from the local file system by an attacker.CVE-2025-24937 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0Critical 9
File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. The web application allows arbitrary files to be included in a file that was downloadable and executable by the web server.
Product
WaveSuite NOC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nokia.com
Jul 21, 2025The web application allows user input to pass unfiltered to a command executed on the underlying operating system.CVE-2025-24936 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0Critical 9
The web application allows user input to pass unfiltered to a command executed on the underlying operating system. The vulnerable component is bound to the network stack and the set of possible attackers extends up to and including the entire Internet. An attacker with low privileged access to the application has the potential to execute commands on the operating system under the context of the webserver.
Product
WaveSuite NOC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nokia.com
Jul 21, 2025WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commCVE-2025-7918 · Other software · Simopro Technology · reported by twcert@cert.org.twCritical 9.3
WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
Product
WinMatrix3 Web package
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jul 21, 2025WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code onCVE-2025-7916 · Other software · Simopro Technology · reported by twcert@cert.org.twCritical 9.3
WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized contents.
Product
WinMatrix3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jul 19, 2025Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVE-2025-53770 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.8
Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.
Product
SharePoint
On CISA’s list since
Jul 20, 2025 (federal fix deadline Jul 21, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com arstechnica.com
Jul 19, 2025Work The Flow File Upload: Arbitrary file uploadsCVE-2015-10138 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Work The Flow File Upload
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Work The Flow File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 19, 2025WP Mobile Detector: Arbitrary file uploadsCVE-2016-15043 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
WP Mobile Detector
Affected
up to 3.5
What to do
Affects up to 3.5. Update WP Mobile Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record aadityapurani.com blog.sucuri.net
Jul 19, 2025WPshop 2 – E-Commerce: Arbitrary file uploadsCVE-2015-10135 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxUpload function in versions before 1.3.9.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
WPshop 2 – E-Commerce
Fixed in
1.3.9.6
What to do
Update WPshop 2 – E-Commerce to 1.3.9.6 or newer.
Full record and what to do →NVD record g0blin.co.uk github.com
Jul 19, 2025Front End Editor: Arbitrary file uploadsCVE-2012-10019 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Front End Editor
Fixed in
2.3
What to do
Update Front End Editor to 2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jul 19, 2025An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer CVE-2025-29757 · Other software · Growatt · reported by csirt@divd.nlCritical 9.4
An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.
Product
https://oss.growatt.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Jul 19, 2025Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: PHP Object InjectionCVE-2025-7697 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.1 via deserialization of untrusted input within the verify_field_val() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
Product
Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 19, 2025Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms: PHP Object InjectionCVE-2025-7696 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.3 via deserialization of untrusted input within the verify_field_val() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
Product
Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 18, 2025A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL CVE-2025-7395 · Other software · wolfSSL · reported by facts@wolfssl.comCritical 9.2
A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL client failing to properly verify the server certificate's domain name, allowing any certificate issued by a trusted CA to be accepted regardless of the hostname.
Product
wolfSSL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 18, 2025 CrushFTP Unprotected Alternate Channel VulnerabilityCVE-2025-54309 · Other software · CrushFTP · reported by MITREExploitedCritical 9
CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.
Product
CrushFTP
On CISA’s list since
Jul 22, 2025 (federal fix deadline Aug 12, 2025)
What to do
Attackers are using this now. Install CrushFTP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog bleepingcomputer.com crushftp.com
Jul 18, 2025Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).CVE-2025-7783 · Other software · reported by 7ffcee3d-2c14-4c3e-b844-86c6a321a158Critical 9.4
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 18, 2025Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.CVE-2025-49747 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
Product
Azure Machine Learning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jul 18, 2025Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.CVE-2025-49746 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
Product
Azure Machine Learning
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jul 18, 2025Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.CVE-2025-47158 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9
Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
Product
Azure DevOps
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Jul 18, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-54079 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the endpoint `/html/atendido/Profile_Atendido.php`, in the `idatendido` parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.4.6 fixes the issue.
Product
WeGIA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 18, 2025An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a cCVE-2025-46001 · Other software · Simogeo · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Product
Filemanager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.