Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,704 results · page 261 of 775
Apr 7, 2025The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands andCVE-2025-3362 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.8
The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.
- Product
- iSherlock 4.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 7, 2025The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands andCVE-2025-3361 · Other software · HGiga · reported by twcert@cert.org.twCritical 9.8
The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server.
- Product
- iSherlock 4.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController componentCVE-2025-28413 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeControllerCVE-2025-28412 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSaveCVE-2025-28411 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting useCVE-2025-28410 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has administrative privileges
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properCVE-2025-28408 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the deptId parameter
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameterCVE-2025-28406 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus methodCVE-2025-28405 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameterCVE-2025-28402 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Langflow Missing Authentication VulnerabilityCVE-2025-3248 · Other software · Langflow · reported by VulnCheckExploitedRansomwareCritical 9.8
Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.
- Product
- Langflow
- On CISA’s list since
- May 5, 2025 (federal fix deadline May 26, 2025)
- What to do
- Attackers are using this now. Install Langflow’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Apr 7, 2025In wlan service, there is a possible out of bounds write due to an incorrect bounds check.CVE-2025-20654 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comCritical 9.8
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00406897; Issue ID: MSV-2875.
- Product
- MT6890, MT7622, MT7915, MT7916, MT7981, MT7986
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025LNbits is a Lightning wallet and accounts system.CVE-2025-32013 · Other software · lnbits · reported by GitHubCritical 9.3
LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
- Product
- lnbits
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2025Drag and Drop Multiple File Upload for WooCommerce: Arbitrary file movingCVE-2025-2941 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the wc-upload-file[] parameter in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
- Product
- Drag and Drop Multiple File Upload for WooCommerce
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Drag and Drop Multiple File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 5, 2025An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrCVE-2021-47667 · Other software · Zend · reported by MITRECritical 10
An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmp_name parameter when dropping off a file via a POST /dropoff request.
- Product
- ZendTo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprojectblack.ioprojectblack.io
Apr 4, 2025In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-freeCVE-2024-11235 · Websites & servers · PHP Group · reported by security@php.netCritical 9.2
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025CMP – Coming Soon & Maintenance: Unrestricted Upload of File with Dangerous TypeCVE-2025-32118 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in NiteoThemes CMP – Coming Soon & Maintenance cmp-coming-soon-maintenance allows Using Malicious Files.This issue affects CMP – Coming Soon & Maintenance: from n/a through <= 4.1.14.
- Product
- CMP – Coming Soon & Maintenance
- Affected
- up to 4.1.14
- What to do
- Affects up to 4.1.14. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025aiven-extras is a PostgreSQL extension.CVE-2025-31480 · Other software · aiven · reported by GitHubCritical 9.1
aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and ensure they run the latest version issuing ALTER EXTENSION aiven_extras UPDATE TO '1.1.16' after installing it. This needs to happen in each database aiven_extras has been installed in.
- Product
- aiven-extras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025BentoML is a Python library for building online serving systems optimized for AI apps and model inference.CVE-2025-27520 · Other software · bentoml · reported by GitHubCritical 9.8
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
- Product
- BentoML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Booking Calendar and Notification: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31403 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shiptrack Booking Calendar and Notification booking-calendar-and-notification allows Blind SQL Injection.This issue affects Booking Calendar and Notification: from n/a through <= 4.0.3.
- Product
- Booking Calendar and Notification
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Booking Calendar and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Woffice CRM: Authentication BypassCVE-2025-2798 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being used. This can be combined with CVE-2025-2797 to bypass the user approval process if an Administrator can be tricked into taking an action such as clicking a link.
- Product
- Woffice CRM
- Affected
- up to 5.4.21
- What to do
- Affects up to 5.4.21. Update Woffice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhub.woffice.iowordfence.com
Apr 4, 2025Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotCVE-2025-28146 · Other software · Edimax · reported by MITRECritical 9.8
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel
- Product
- Br-6478ac V3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 4, 2025Homey: Incorrect Privilege AssignmentCVE-2024-51800 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.
- Product
- Homey
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplieCVE-2025-2244 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.5
A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.
- Product
- GravityZone Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025tagDiv Composer: PHP Object InstantiationCVE-2024-13645 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- tagDiv Composer
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtagdiv.comwordfence.com
Apr 3, 2025CrushFTP Authentication Bypass VulnerabilityCVE-2025-31161 · Other software · CrushFTP · reported by MITREExploitedRansomwareCritical 9.8
CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.
- Product
- CrushFTP
- On CISA’s list since
- Apr 7, 2025 (federal fix deadline Apr 28, 2025)
- What to do
- Attackers are using this now. Install CrushFTP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcrushftp.comoutpost24.com
Apr 3, 2025Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key VulnerabilityCVE-2025-30406 · Other software · Gladinet · reported by MITREExploitedCritical 9
Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing for remote code execution.
- Product
- CentreStack
- On CISA’s list since
- Apr 8, 2025 (federal fix deadline Apr 29, 2025)
- What to do
- Attackers are using this now. Install Gladinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggladinetsupport.s3.us-east-1.amazonaws.comcentrestack.com
Apr 3, 2025A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13.CVE-2025-29462 · Network & remote access · Tenda · reported by MITRECritical 9.8
A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socketRead function to process HTTP request messages, resulting in the overwriting of a buffer on the stack.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.CVE-2025-29064 · Other software · Totolink · reported by MITRECritical 9.8
An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.
- Product
- X18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Netwrix Password Secure through 9.2 allows command injection.CVE-2025-26818 · Other software · Netwrix · reported by MITRECritical 9.8
Netwrix Password Secure through 9.2 allows command injection.
- Product
- Password Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.netwrix.comsecurity.netwrix.com
Apr 3, 2025Netwrix Password Secure 9.2.0.32454 allows OS command injection.CVE-2025-26817 · Other software · Netwrix · reported by MITRECritical 9.8
Netwrix Password Secure 9.2.0.32454 allows OS command injection.
- Product
- Password Secure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.netwrix.comsecurity.netwrix.com
Apr 3, 2025SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.CVE-2025-29647 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php.CVE-2024-22611 · Other software · Open-emr · reported by MITRECritical 9.8
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityCVE-2025-22457 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedRansomwareCritical 9
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
- Product
- Connect Secure, Policy Secure, and ZTA Gateways
- On CISA’s list since
- Apr 4, 2025 (federal fix deadline Apr 11, 2025)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogforums.ivanti.comcisa.gov
Apr 3, 2025Social Share And Social Locker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31911 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems Social Share And Social Locker social-share-and-social-locker-arsocial allows Blind SQL Injection.This issue affects Social Share And Social Locker: from n/a through <= 1.4.2.
- Product
- Social Share And Social Locker
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Social Share And Social Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.CVE-2025-22930 · Other software · Os4ed · reported by MITRECritical 9.8
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.CVE-2025-22929 · Other software · Os4ed · reported by MITRECritical 9.8
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaginCVE-2025-22926 · Other software · Os4ed · reported by MITRECritical 9.8
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS).CVE-2025-2946 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Critical 9.1
pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).CVE-2025-2945 · Other software · pgadmin.org · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Critical 9.9
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.
- Product
- pgAdmin 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.CVE-2025-22928 · Other software · Os4ed · reported by MITRECritical 9.8
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaginCVE-2025-22927 · Other software · Os4ed · reported by MITRECritical 9.1
An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal by sending a crafted POST request to /Modules.php?modname=messaging/Inbox.php&modfunc=save&filename.
- Product
- Opensis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure.CVE-2025-31484 · Other software · conda-forge · reported by GitHubCritical 9.3
conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a package to the conda-forge channel, bypassing our feedstock-token + upload process. The security logs on anaconda.org were check for any packages that were not copied from the cf-staging to the conda-forge channel and none were found.
- Product
- infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025The Tauri shell plugin allows access to the system shell.CVE-2025-31477 · Other software · tauri-apps · reported by GitHubCritical 9.3
The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricted to a reasonable number of protocols like https or mailto by default. This default restriction was not functional due to improper validation of the allowed protocols, allowing for potentially dangerous protocols like file://, smb://, or nfs:// and others to be opened by the system registered protocol handler. By passing untrusted user input to the open endpoint these potentially dangerous protocols can be abused to gain remote code execution on the system. This either requires direct exposure of the endpoint to application users or code execution in the frontend of a Tauri application. This vulnerability is fixed in 2.2.1.
- Product
- plugins-workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClustCVE-2025-29085 · Other software · reported by MITRECritical 9.8
SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 2, 2025An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not haCVE-2025-29063 · Other software · Lb-link · reported by MITRECritical 9.8
An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not handled properly.
- Product
- Bl-ac2100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead wCVE-2025-29062 · Other software · Lb-link · reported by MITRECritical 9.8
An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead webservice.
- Product
- Bl-ac2100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cause the application tCVE-2024-38392 · Other software · reported by MITRECritical 9.1
Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cause the application to run untrusted code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025In the Linux kernel, the following vulnerability has been resolved: fs/netfs/read_collect: add to next->prev_donated If multiple subrequests donate data to thCVE-2025-21988 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: fs/netfs/read_collect: add to next->prev_donated If multiple subrequests donate data to the same "next" request (depending on the subrequest completion order), each of them would overwrite the `prev_donated` field, causing data corruption and a BUG() crash ("Can't donate prior to front").
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 2, 2025Front End Users: Arbitrary file uploadsCVE-2025-2005 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Front End Users
- Affected
- up to 3.2.32
- What to do
- Affects up to 3.2.32. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.