Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,704 results · page 270 of 775
Mar 4, 2025Newscrunch: Arbitrary file uploadsCVE-2025-1307 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Newscrunch
- Affected
- up to 1.8.4.1
- What to do
- Affects up to 1.8.4.1. Update Newscrunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Mar 3, 2025Donations Widget: PHP Object InjectionCVE-2025-0912 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
- Product
- Donations Widget
- Affected
- up to 3.19.4
- What to do
- Affects up to 3.19.4. Update Donations Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Mar 3, 2025Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html componentCVE-2025-26206 · Other software · Selldone · reported by MITRECritical 9
Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component
- Product
- Storefront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-27419 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.2
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing aggressive spidering. The vulnerability is caused by recursive crawling of dynamically generated URLs and insufficient handling of large volumes of requests. This vulnerability is fixed in 3.2.16.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0.CVE-2024-55532 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to version 2.6.0, which fixes this issue.
- Product
- Apache Ranger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwiki.apache.orgopenwall.com
Mar 3, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Proliz Software OBS allows Path Traversal.CVE-2024-8262 · Other software · Proliz Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Proliz Software OBS allows Path Traversal. This issue affects OBS: before 24.0927.
- Product
- OBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 3, 2025Residential Address Detection: Missing AuthorizationCVE-2025-27270 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Privilege Escalation.This issue affects Residential Address Detection: from n/a through <= 2.5.4.
- Product
- Residential Address Detection
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Residential Address Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Small Package Quotes – Worldwide Express Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-27268 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows SQL Injection.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.18.
- Product
- Small Package Quotes – Worldwide Express Edition
- Affected
- up to 5.2.18
- What to do
- Affects up to 5.2.18. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025SMS Alert Order Notifications: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26988 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.7.8.
- Product
- SMS Alert Order Notifications
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Ark Theme Core: Improper Control of Generation of Code ('Code Injection')CVE-2025-26970 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Ark Theme Core ark-core allows Code Injection.This issue affects Ark Theme Core: from n/a through < 1.71.0.
- Product
- Ark Theme Core
- Affected
- up to 1.70.0
- What to do
- Affects up to 1.70.0. Update Ark Theme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Bitcoin / AltCoin Payment Gateway for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26535 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce woo-altcoin-payment-gateway allows Blind SQL Injection.This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through <= 1.7.6.
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update Bitcoin / AltCoin Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025uListing: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-25150 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through <= 2.1.6.
- Product
- uListing
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025SQL injection vulnerability have been found in 101news affecting version 1.0 through the "searchtitle" parameter in search.php.CVE-2025-1875 · Other software · Mayuri K · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "searchtitle" parameter in search.php.
- Product
- 101news
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025SQL injection vulnerability have been found in 101news affecting version 1.0 through the "description" parameter in admin/add-category.php.CVE-2025-1874 · Other software · Mayuri K · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "description" parameter in admin/add-category.php.
- Product
- 101news
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagetitle" and "pagedescription" parameters in admin/contactus.php.CVE-2025-1873 · Other software · Mayuri K · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagetitle" and "pagedescription" parameters in admin/contactus.php.
- Product
- 101news
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025SQL injection vulnerability have been found in 101news affecting version 1.0 through the "sadminusername" parameter in admin/add-subadmins.php.CVE-2025-1872 · Other software · Mayuri K · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "sadminusername" parameter in admin/add-subadmins.php.
- Product
- 101news
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025SQL injection vulnerability have been found in 101news affecting version 1.0 through the "category" and "subcategory" parameters in admin/add-subcategory.php.CVE-2025-1871 · Other software · Mayuri K · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "category" and "subcategory" parameters in admin/add-subcategory.php.
- Product
- 101news
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagedescription" parameter in admin/aboutus.php.CVE-2025-1870 · Other software · Mayuri K · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagedescription" parameter in admin/aboutus.php.
- Product
- 101news
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/check_avalability.php.CVE-2025-1869 · Other software · Mayuri K · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/check_avalability.php.
- Product
- 101news
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response Smuggling.This issue affectCVE-2025-1867 · Other software · ithewei · reported by cve_disclosure@tech.gov.sgCritical 10
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response Smuggling.This issue affects libhv: through 1.3.3.
- Product
- libhv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows Pointer Manipulation, potentially leading CVE-2025-1866 · Other software · warmcat · reported by cve_disclosure@tech.gov.sgCritical 10
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows Pointer Manipulation, potentially leading to out-of-bounds memory access. This issue affects libwebsockets before 4.3.4 and is present in code built specifically for the Win32 platform. By default, the affected code is not executed unless one of the following conditions is met: LWS_WITHOUT_EXTENSIONS (default ON) is manually set to OFF in CMake. LWS_WITH_HTTP_STREAM_COMPRESSION (default OFF) is manually set to ON in CMake. Despite these conditions, when triggered in affected configurations, this vulnerability may allow attackers to manipulate pointers, potentially leading to memory corruption or unexpected behavior.
- Product
- libwebsockets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: bCVE-2025-1864 · Other software · radareorg · reported by cve_disclosure@tech.gov.sgCritical 10
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in radareorg radare2 allows Overflow Buffers.This issue affects radare2: before <5.9.9.
- Product
- radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2025In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is rCVE-2025-27590 · Other software · Oxidized Web project · reported by MITRECritical 9
In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web.
- Product
- Oxidized Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2025In wlan AP FW, there is a possible out of bounds write due to improper input validation.CVE-2025-20646 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comCritical 9.8
In wlan AP FW, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389074; Issue ID: MSV-1803.
- Product
- MT6890, MT7915, MT7916, MT7981, MT7986
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2025Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EaglCVE-2025-27583 · Other software · Serosoft · reported by MITRECritical 9.1
Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.
- Product
- Academia Student Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2025Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allCVE-2025-25948 · Other software · Academiaerp · reported by MITRECritical 9.1
Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.
- Product
- Student Information System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2025Academist Membership: Privilege EscalationCVE-2025-1671 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as any user, including site administrators.
- Product
- Academist Membership
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Academist Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 1, 2025Alloggio Membership: Authentication BypassCVE-2025-1638 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions. This makes it possible for unauthenticated attackers to log in as any user, including administrators, without knowing a password.
- Product
- Alloggio Membership
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Alloggio Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 1, 2025SetSail Membership: In all versions up to, and including, 1CVE-2025-1564 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a users identity through the social login. This makes it possible for unauthenticated attackers to log in as any user, including administrators and take over access to their account.
- Product
- SetSail Membership
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update SetSail Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 1, 2025Nokri – Job Board: Privilege escalationCVE-2024-12824 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage that to gain access to their account.
- Product
- Nokri – Job Board
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Nokri – Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 1, 2025ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build servCVE-2025-27554 · Other software · ToDesktop · reported by MITRECritical 9.9
ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build server (e.g., read secrets from the desktopify config.prod.json file), and consequently deploy updates to any app, via a postinstall script in package.json. No exploitation occurred.
- Product
- ToDesktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkibty.townnews.ycombinator.com
Feb 28, 2025An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi PrCVE-2025-23116 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.6
An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi Protect Cameras adjacent network to take control of UniFi Protect Cameras.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras manaCVE-2025-23115 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9
A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras management network.
- Product
- UniFi Protect Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component.CVE-2025-25379 · Other software · 07fly · reported by MITRECritical 9.6
Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component.
- Product
- 07flycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, CVE-2025-0159 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request.
- Product
- Storage Virtualize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025Application does not limit the number or frequency of user interactions, such as the number of incoming requests.CVE-2025-22273 · Other software · CyberArk · reported by cvd@cert.plCritical 9.3
Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
- Product
- Endpoint Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025WHMpress - WHMCS WordPress Integration: Local File InclusionCVE-2024-9193 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- WHMpress - WHMCS WordPress Integration
- Affected
- up to 6.3-revision-0
- What to do
- Affects up to 6.3-revision-0. Update WHMpress - WHMCS WordPress Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwhmpress.comwordfence.com
Feb 28, 2025WooCommerce Ultimate Gift Card: Arbitrary file uploadsCVE-2024-8425 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that this may have been patched on an older version than 2.9.2, however, we do not have access to older versions of the software to confirm when the patch was added. The only patched version we have confirmed is 2.9.3.
- Product
- WooCommerce Ultimate Gift Card
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update WooCommerce Ultimate Gift Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Feb 28, 2025DHVC Form: Privilege escalationCVE-2024-8420 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The DHVC Form plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.7. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on sites.
- Product
- DHVC Form
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update DHVC Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Feb 27, 2025Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9.CVE-2025-1744 · Other software · radareorg · reported by cve_disclosure@tech.gov.sgCritical 10
Out-of-bounds Write vulnerability in radareorg radare2 allows heap-based buffer over-read or buffer overflow.This issue affects radare2: before <5.9.9.
- Product
- radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Infoblox NIOS through 8.6.4 has Improper Access Control for Grids.CVE-2024-37567 · Other software · Infoblox · reported by MITRECritical 9.1
Infoblox NIOS through 8.6.4 has Improper Access Control for Grids.
- Product
- Nios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Infoblox NIOS through 8.6.4 has Improper Authentication for Grids.CVE-2024-37566 · Other software · Infoblox · reported by MITRECritical 9.8
Infoblox NIOS through 8.6.4 has Improper Authentication for Grids.
- Product
- Nios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.CVE-2024-36047 · Other software · Infoblox · reported by MITRECritical 9.8
Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation.
- Product
- Nios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Infoblox NIOS through 8.6.4 executes with more privileges than required.CVE-2024-36046 · Other software · Infoblox · reported by MITRECritical 9.8
Infoblox NIOS through 8.6.4 executes with more privileges than required.
- Product
- Nios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.CVE-2025-26325 · Other software · Shopxo · reported by MITRECritical 9.8
ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.CVE-2025-25570 · Other software · reported by MITRECritical 9.8
Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation.CVE-2024-38292 · Other software · Extremenetworks · reported by MITRECritical 9.8
In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation.
- Product
- Xiq-se
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.extremenetworks.com
Feb 27, 2025GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list.CVE-2024-55160 · Other software · G-fast · reported by MITRECritical 9.8
GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list.
- Product
- Gfast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/CVE-2024-51139 · Network & remote access · Draytek · reported by MITRECritical 9.8
Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.
- Product
- Vigor2620 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 CVE-2024-51138 · Network & remote access · Draytek · reported by MITRECritical 9.8
Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912 4.3.6.1 and earlier; Vigor3910 4.4.3.1 and earlier a stack-based buffer overflow vulnerability has been identified in the URL parsing functionality of the TR069 STUN server. This flaw occurs due to insufficient bounds checking on the amount of URL parameters, allowing an attacker to exploit the overflow by sending a maliciously crafted request. Consequently, a remote attacker can execute arbitrary code with elevated privileges.
- Product
- Vigor3912 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.