Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,686 results · page 256 of 774
May 1, 2025LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing remote attackersCVE-2025-47154 · Other software · Ladybird · reported by MITRECritical 9
LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing remote attackers to execute arbitrary code via a crafted .js file. NOTE: the GitHub README says "Ladybird is in a pre-alpha state, and only suitable for use by developers."
- Product
- Ladybird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown.CVE-2025-46558 · Other software · xwiki-contrib · reported by GitHubCritical 9
XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting (XSS) through HTML. In particular, using Markdown syntax, it's possible for any user to embed Javascript code that will then be executed on the browser of any other user visiting either the document or the comment that contains it. In the instance that this code is executed by a user with admins or programming rights, this issue compromises the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in version 8.9.
- Product
- syntax-markdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.CVE-2025-30392 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure AI Bot Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.CVE-2025-30390 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Machine Learning
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025XWiki is a generic wiki platform.CVE-2025-32974 · Other software · xwiki · reported by GitHubCritical 9
XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that would gain more rights due to the editing. This analysis doesn't consider certain kinds of properties, allowing a user to put malicious scripts in there that will be executed after a user with script, admin, or programming rights edited the page. Such a malicious script could impact the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in versions 15.10.8 and 16.2.0.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025XWiki is a generic wiki platform.CVE-2025-32973 · Other software · xwiki · reported by GitHubCritical 9
XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without programming rights and contains an XWiki.ComponentClass, there is no warning that this will grant programming rights to this object. An attacker who created such a malicious object could use this to gain programming rights on the wiki. For this, the attacker needs to have edit rights on at least one page to place this object and then get an admin user to edit that document. This issue has been patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs.CVE-2025-32444 · Other software · vllm-project · reported by GitHubCritical 10
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack. vLLM instances that do not make use of the mooncake integration are not vulnerable. This issue has been patched in version 0.8.5.
- Product
- vllm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025YesWiki is a wiki system written in PHP.CVE-2025-46348 · Other software · YesWiki · reported by GitHubCritical 10
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code eCVE-2025-0520 · Other software · ShowDoc · reported by VulnCheckCritical 9.4
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.
- Product
- ShowDoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025Bookgy does not provide for proper authorisation control in multiple areas of the application.CVE-2025-40619 · Other software · Bookgy · reported by cve-coordination@incibe.esCritical 9.3
Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to reach private areas and/or areas intended for other roles.
- Product
- Bookgy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025SQL injection vulnerability in Bookgy.CVE-2025-40618 · Other software · Bookgy · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDRESERVA" parameter in /bkg_imprimir_comprobante.php
- Product
- Bookgy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025SQL injection vulnerability in Bookgy.CVE-2025-40617 · Other software · Bookgy · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkg_seleccionar_hora_ajax.php.
- Product
- Bookgy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition functionCVE-2025-25962 · Other software · reported by MITRECritical 9.8
An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php.CVE-2025-25403 · Other software · reported by MITRECritical 9.8
Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level documCVE-2025-4083 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.1
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 28, 2025Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.CVE-2025-31651 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
- Product
- Apache Tomcat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Apr 28, 2025Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form ofCVE-2015-2079 · Other software · Usermin · reported by MITRECritical 9.9
Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comcode-white.com
Apr 28, 2025IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, CVE-2025-46661 · Other software · IPW · reported by MITRECritical 10
IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier.
- Product
- Metazo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comipwsystems.com
Apr 28, 2025An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between tCVE-2025-3200 · Other software · Wiesemann & Theis · reported by info@cert.vde.comCritical 9.1
An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems.
- Product
- Com-Server++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal').CVE-2025-26692 · Other software · SIOS Technology, Inc. · reported by vultures@jpcert.or.jpCritical 9.2
Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, arbitrary code may be executed by a remote unauthenticated attacker with the Windows system privilege where the product is running.
- Product
- Quick Agent V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmfp-support.sios.jp
Apr 26, 2025Order Delivery Date: Does not have authorization and CSRF checksCVE-2025-2907 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
- Product
- Order Delivery Date
- Fixed in
- 12.3.1
- What to do
- Update Order Delivery Date to 12.3.1 or newer.
Apr 25, 2025NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.CVE-2025-32985 · Other software · Netscout · reported by MITRECritical 9.8
NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.
- Product
- Ngeniusone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration.CVE-2025-32980 · Other software · reported by MITRECritical 9.8
NETSCOUT nGeniusONE before 6.4.0 P11 b3245 has a Weak Sudo Configuration.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2025Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.CVE-2025-25775 · Other software · Codeastro · reported by MITRECritical 9.8
Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.
- Product
- BUS Ticket Booking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Apr 25, 2025Craft CMS Code Injection VulnerabilityCVE-2025-32432 · Other software · Craft CMS · reported by GitHubExploitedCritical 10
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
- Product
- Craft CMS
- On CISA’s list since
- Mar 20, 2026 (federal fix deadline Apr 3, 2026)
- What to do
- Attackers are using this now. Install Craft CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Apr 25, 2025The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation inCVE-2025-2470 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability.
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Apr 25, 2025Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file.CVE-2025-46616 · Other software · Quantum · reported by MITRECritical 9.9
Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage.
- Product
- StorNext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentCVE-2025-46275 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials.
- Product
- WGS-804HPT-V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database.CVE-2025-46274 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database.
- Product
- UNI-NMS-Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.CVE-2025-46273 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.
- Product
- UNI-NMS-Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host syCVE-2025-46272 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host system.
- Product
- WGS-804HPT-V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data.CVE-2025-46271 · Other software · Planet Technology · reported by ics-cert@hq.dhs.govCritical 9.3
UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data.
- Product
- UNI-NMS-Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issueCVE-2025-26382 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 9.3
Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue
- Product
- iSTAR Configuration Utility (ICU)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Apr 24, 2025h11 is a Python implementation of HTTP/1.1.CVE-2025-43859 · Other software · python-hyper · reported by GitHubCritical 9.1
h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.
- Product
- h11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp.CVE-2025-43858 · Other software · Bluegrams · reported by GitHubCritical 9.2
YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.
- Product
- YoutubeDLSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025SAP NetWeaver Unrestricted File Upload VulnerabilityCVE-2025-31324 · Network & remote access · SAP · reported by cna@sap.comExploitedRansomwareCritical 10
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
- Product
- NetWeaver
- On CISA’s list since
- Apr 29, 2025 (federal fix deadline May 20, 2025)
- What to do
- Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogme.sap.comurl.sap
Apr 24, 2025PowerPress Podcasting: Unrestricted Upload of File with Dangerous TypeCVE-2025-46264 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue affects PowerPress Podcasting: from n/a through <= 11.12.5.
- Product
- PowerPress Podcasting
- Affected
- up to 11.12.5
- What to do
- Affects up to 11.12.5. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Frontend Dashboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46248 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5.
- Product
- Frontend Dashboard
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Flynax Bridge: Privilege escalationCVE-2025-3604 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
- Product
- Flynax Bridge
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Flynax Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 24, 2025Flynax Bridge: Privilege escalationCVE-2025-3603 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- Flynax Bridge
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Flynax Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 24, 2025Database Toolset: Arbitrary file deletionCVE-2025-3065 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Database Toolset
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 23, 2025Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability.CVE-2025-2767 · Other software · Arista · reported by zdi-disclosures@trendmicro.comCritical 9.6
Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the processing of the User-Agent HTTP header. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24407.
- Product
- NG Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may lead to remote arbitraCVE-2025-45429 · Network & remote access · Tenda · reported by MITRECritical 9.8
In the Tenda ac9 v1.0 router with firmware V15.03.05.14_multi, there is a stack overflow vulnerability in /goform/WifiWpsStart, which may lead to remote arbitrary code execution.
- Product
- Ac9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025XWiki is a generic wiki platform.CVE-2025-32969 · Other software · xwiki · reported by GitHubCritical 9.3
XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Prevent unregistered users from editing pages, regardless of the page rights" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025In Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of /goform/SetSysAutoRebbotCfg has a stack overflow vulnerability, which can lead tCVE-2025-45428 · Network & remote access · Tenda · reported by MITRECritical 9.8
In Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of /goform/SetSysAutoRebbotCfg has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
- Product
- Ac9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025In Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of /goform/WifiBasicSet has a stack overflow vulnerability, which can lead to remote CVE-2025-45427 · Network & remote access · Tenda · reported by MITRECritical 9.8
In Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of /goform/WifiBasicSet has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
- Product
- Ac9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellCVE-2025-42605 · Other software · Meon · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for the initiation, modification, or cancellation operations. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body to gain unauthorized access to other user accounts. Successful exploitation of this vulnerability could allow remote attacker to perform authorized manipulation of data associated with other user accounts.
- Product
- Bidding Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server hostCVE-2025-37087 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server host.
- Product
- HPE Performance Cluster Manager (HPCM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser.CVE-2025-32965 · Other software · XRPLF · reported by GitHubCritical 9.3
xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch. To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key.
- Product
- xrpl.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025LabVantage before LV 8.8.0.13 HF6 allows local file inclusion.CVE-2025-43951 · Other software · reported by MITRECritical 9.8
LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabvantage.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.