Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,686 results · page 247 of 774
Jun 11, 2025Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities.CVE-2022-4976 · Other software · ETJ · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities. The bundled library is affected by CVE-2014-8139, CVE-2014-8140 and CVE-2014-8141.
- Product
- Archive::Unzip::Burst
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered.CVE-2025-30085 · Other software · rsjoomla.com · reported by security@joomla.orgCritical 9.2
Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for Joomla was discovered. The issue occurs within the submission export feature and requires administrative access to the export feature.
- Product
- RSform!Pro component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode.CVE-2025-40912 · Other software · MIK · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.
- Product
- CryptX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow.CVE-2025-40914 · Other software · MIK · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.
- Product
- CryptX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2025-32711 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaim.security
Jun 11, 2025An integer overflow was present in `OrderedHashTable` used by the JavaScript engine.CVE-2025-49710 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 11, 2025Certain canvas operations could have lead to memory corruption.CVE-2025-49709 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 11, 2025For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers,CVE-2025-41663 · Other software · Weidmueller · reported by info@cert.vde.comCritical 9.8
For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges. To get into such a position, clients would need to use insecure proxy configurations.
- Product
- IE-SR-2TX-WL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession oCVE-2024-1244 · Other software · OSSEC · reported by 41c37e40-543d-43a2-b660-2fee83ea851aCritical 9.5
Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.
- Product
- OSSEC-HIDS Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentraze.compentraze.com
Jun 10, 2025Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure CVE-2024-1243 · Other software · Wazuh · reported by 41c37e40-543d-43a2-b660-2fee83ea851aCritical 9.5
Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.
- Product
- Wazuh Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compentraze.com
Jun 10, 2025A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3,CVE-2025-36852 · Other software · Niklas Portmann · reported by 36c7be3b-2937-45df-85ea-ca7133ea542cCritical 9.4
A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull request privileges to inject compromised artifacts from an untrusted environment into trusted production environments without detection. The vulnerability exploits a fundamental design flaw in the "first-to-cache wins" principle, where artifacts built in untrusted environments (feature branches, pull requests) can poison the cache used by trusted environments (protected branches, production deployments). This attack bypasses all traditional security measures including encryption, access controls, and checksum validation because the poisoning occurs during the artifact construction phase, before any security measures are applied.
- Product
- Azure Based Remote Cache Plugin for Nx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition oCVE-2025-2474 · Other software · BlackBerry · reported by secure@blackberry.comCritical 9.8
Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec.
- Product
- QNX Software Development Platform (SDP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.com
Jun 10, 2025Erxes <1.6.1 is vulnerable to Incorrect Access Control.CVE-2024-57190 · Other software · Erxes · reported by MITRECritical 9.8
Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint.
- Product
- Erxes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Jun 10, 2025A vulnerability has been identified in Energy Services (All versions with G5DFR).CVE-2025-40585 · Other software · Siemens · reported by productcert@siemens.comCritical 9.5
A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of G5DFR component and tamper with outputs from the device.
- Product
- Energy Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Jun 10, 2025GeoServer is an open source server that allows users to share and edit geospatial data.CVE-2025-30220 · Other software · geoserver · reported by GitHubCritical 9.9
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.
- Product
- geoserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.geoserver.orggithub.com
Jun 10, 2025GeoServer is an open source server that allows users to share and edit geospatial data.CVE-2024-34711 · Other software · geoserver · reported by GitHubCritical 9.3
GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP server. By default, GeoServer use PreventLocalEntityResolver class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must match the regex (?i)(jar:file|http|vfs)[^?#;]*\\.xsd. But the regex leaves a chance for attackers to request to any HTTP server or limited file. Attacker can abuse this to scan internal networks and gain information about them then exploit further. GeoServer 2.25.0 and greater default to the use of ENTITY_RESOLUTION_ALLOWLIST and does not require you to provide a system property.
- Product
- geoserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.geoserver.orggithub.com
Jun 10, 2025CozyStay: Deserialization of Untrusted DataCVE-2025-49507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through < 1.7.1.
- Product
- CozyStay
- What to do
- Update CozyStay to the newest version.
Jun 10, 2025WordPress-WPJobBoard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49455 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge WordPress-WPJobBoard click-pledge-wpjobboard allows Blind SQL Injection.This issue affects WordPress-WPJobBoard: from n/a through <= 25.07010000-WP6.8.1-JB5.11.5.
- Product
- WordPress-WPJobBoard
- Affected
- up to 25.07010000-WP6.8.1-JB5.11.5
- What to do
- Affects up to 25.07010000-WP6.8.1-JB5.11.5. Update WordPress-WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects.CVE-2025-43698 · Other software · Salesforce · reported by security@salesforce.comCritical 9.1
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025A SQL injection vulnerability has been found in DM Corporative CMS.CVE-2025-40657 · Other software · Dmacroweb · reported by cve-coordination@incibe.esCritical 9.3
A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the codform parameter in /modules/forms/collectform.asp.
- Product
- DM Corporative CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025A SQL injection vulnerability has been found in DM Corporative CMS.CVE-2025-40656 · Other software · Dmacroweb · reported by cve-coordination@incibe.esCritical 9.3
A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the cod parameter in /administer/node-selection/data.asp.
- Product
- DM Corporative CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025A SQL injection vulnerability has been found in DM Corporative CMS.CVE-2025-40655 · Other software · Dmacroweb · reported by cve-coordination@incibe.esCritical 9.3
A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name parameter in /antcatalogue.asp.
- Product
- DM Corporative CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025A SQL injection vulnerability has been found in DM Corporative CMS.CVE-2025-40654 · Other software · Dmacroweb · reported by cve-coordination@incibe.esCritical 9.3
A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name and cod parameters in /antbuspre.asp.
- Product
- DM Corporative CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request.CVE-2025-1041 · Other software · Avaya · reported by securityalerts@avaya.comCritical 9.9
An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.
- Product
- Avaya Call Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2025-42989 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.6
RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.CVE-2025-30515 · Other software · CyberData · reported by ics-cert@hq.dhs.govCritical 9.3
CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.
- Product
- 011209 SIP Emergency Intercom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.CVE-2025-30184 · Other software · CyberData · reported by ics-cert@hq.dhs.govCritical 9.3
CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.
- Product
- 011209 SIP Emergency Intercom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when rCVE-2025-49652 · Other software · Lablup · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cCritical 9.8
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
- Product
- BackendAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025listmonk is a standalone, self-hosted, newsletter and mailing list manager.CVE-2025-49136 · Other software · knadh · reported by GitHubCritical 9
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.
- Product
- listmonk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025MyStyle Custom Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48281 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer allows Blind SQL Injection.This issue affects MyStyle Custom Product Designer: from n/a through <= 3.21.1.
- Product
- MyStyle Custom Product Designer
- Affected
- up to 3.21.1
- What to do
- Affects up to 3.21.1. Update MyStyle Custom Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Multi CryptoCurrency Payments: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48141 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Zaytseff Multi CryptoCurrency Payments multi-crypto-currency-payment allows SQL Injection.This issue affects Multi CryptoCurrency Payments: from n/a through <= 2.0.7.
- Product
- Multi CryptoCurrency Payments
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Multi CryptoCurrency Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025MetalpriceAPI: Improper Control of Generation of Code ('Code Injection')CVE-2025-48140 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through <= 1.1.4.
- Product
- MetalpriceAPI
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update MetalpriceAPI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Incorrect Privilege AssignmentCVE-2025-48129 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Control of Generation of Code ('Code Injection')CVE-2025-48123 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48122 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows SQL Injection.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Recover abandoned cart for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47608 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce: from n/a through <= 2.5.
- Product
- Recover abandoned cart for WooCommerce
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Recover abandoned cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025SUMO Affiliates Pro: Unrestricted Upload of File with Dangerous TypeCVE-2025-32291 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Using Malicious Files.This issue affects SUMO Affiliates Pro: from n/a through < 11.1.0.
- Product
- SUMO Affiliates Pro
- What to do
- Update SUMO Affiliates Pro to the newest version.
Jun 9, 2025PressGrid - Frontend Publish Reaction & Multimedia: Deserialization of Untrusted DataCVE-2025-31429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.
- Product
- PressGrid - Frontend Publish Reaction & Multimedia
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update PressGrid - Frontend Publish Reaction & Multimedia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31424 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
- Product
- WP Lead Capturing Pages
- What to do
- Update WP Lead Capturing Pages to the newest version.
Jun 9, 2025PIMP - Creative MultiPurpose: Deserialization of Untrusted DataCVE-2025-31398 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpose: from n/a through 1.7.
- Product
- PIMP - Creative MultiPurpose
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PIMP - Creative MultiPurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025FLAP - Business: Deserialization of Untrusted DataCVE-2025-31396 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5.
- Product
- FLAP - Business
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update FLAP - Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025WBW Product Table PRO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31059 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in woobewoo WBW Product Table PRO woo-producttables-pro allows SQL Injection.This issue affects WBW Product Table PRO: from n/a through <= 2.2.6.
- Product
- WBW Product Table PRO
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update WBW Product Table PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025The Fashion - Model Agency One Page Beauty: Deserialization of Untrusted DataCVE-2025-31052 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affects The Fashion - Model Agency One Page Beauty Theme: from n/a through <= 1.4.4.
- Product
- The Fashion - Model Agency One Page Beauty
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update The Fashion - Model Agency One Page Beauty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Category Icon: Improper Restriction of XML External Entity ReferenceCVE-2025-31039 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through <= 1.0.3.
- Product
- Category Icon
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Category Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025PayU India: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31022 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through < 3.8.8.
- Product
- PayU India
- What to do
- Update PayU India to the newest version.
Jun 9, 2025TicketBAI Facturas para WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24767 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Blind SQL Injection.This issue affects TicketBAI Facturas para WooCommerce: from n/a through <= 3.19.
- Product
- TicketBAI Facturas para WooCommerce
- Affected
- up to 3.19
- What to do
- Affects up to 3.19. Update TicketBAI Facturas para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025WilderForge is a Wildermyth coremodding API.CVE-2025-49013 · Other software · WilderForge · reported by GitHubCritical 9.9
WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of `${{ github.event.review.body }}` and other user controlled variables directly inside shell script contexts in GitHub Actions workflows. This introduces a code injection vulnerability: a malicious actor submitting a crafted pull request review containing shell metacharacters or commands could execute arbitrary shell code on the GitHub Actions runner. This can lead to arbitrary command execution with the permissions of the workflow, potentially compromising CI infrastructure, secrets, and build outputs. Developers who maintain or contribute to the repos WilderForge/WilderForge, WilderForge/ExampleMod, WilderForge/WilderWorkspace, WilderForge/WildermythGameProvider, WilderForge/AutoSplitter, WilderForge/SpASM, WilderForge/thrixlvault, WilderForge/MassHash, and/or WilderForge/DLC_Disabler; as well as users who fork any of the above repositories and reuse affected GitHub Actions workflows, are affected. End users of any the above software and users who only install pre-built releases or artifacts are no
- Product
- WilderForge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeql.github.comdocs.github.com
Jun 9, 2025Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module.CVE-2025-3835 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 9.6
Zohocorp ManageEngine Exchange Reporter Plus versions 5721 and prior are vulnerable to Remote code execution in the Content Search module.
- Product
- Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to accCVE-2025-5893 · Other software · Honding Technology · reported by twcert@cert.org.twCritical 9.3
Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials.
- Product
- Smart Parking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 8, 2025The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default.CVE-2025-3461 · Other software · ON Semiconductor · reported by cve@takeonme.orgCritical 9.1
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
- Product
- Quantenna Wi-Fi chipset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.onsemi.comtakeonme.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.