Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,704 results · page 273 of 775
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26605 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025Simplified: Unrestricted Upload of File with Dangerous TypeCVE-2025-22654 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified simplified allows Using Malicious Files.This issue affects Simplified: from n/a through <= 1.0.6.
- Product
- Simplified
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Simplified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025K Elements: Incorrect Privilege AssignmentCVE-2024-56000 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through < 5.4.0.
- Product
- K Elements
- What to do
- Update K Elements to the newest version.
Feb 18, 2025CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0.CVE-2025-24895 · Other software · italia · reported by GitHubCritical 9.1
CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: 1. Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in essence, is responsible for the management of the credentials and identity of users; 2. Service Provider (SP): the system that provides a service to the user and relies on the Identity Provider to authenticate the user, receives SAML assertions from the IdP to grant access to resources. The library cie-aspnetcore refers to the second entity, the SP, and implements the validation logic of SAML assertions within SAML responses. In affected versions there is no guarantee that the first signature refers to the root object, it follows that if an attacker injects an item signed as the first element, all other signatures will not be verified. The only requirement is to have an XML element legitimately signed by the IdP, a condition that is easily met using the IdP's public metadata. An attacker could create an arbitrary SAML response that would be accepted by SPs using vulne
- Product
- cie-aspnetcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID.CVE-2025-24894 · Other software · italia · reported by GitHubCritical 9.1
SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in essence, is responsible for the management of the credentials and identity of users; Service Provider (SP): the system that provides a service to the user and relies on the Identity Provider to authenticate the user, receives SAML assertions from the IdP to grant access to resources. The validation logic of the signature is central as it ensures that you cannot create a SAML response with arbitrary assertions and then impersonate other users. There is no guarantee that the first signature refers to the root object, it follows that if an attacker injects an item signed as the first element, all other signatures will not be verified. The only requirement is to have an XML element legitimately signed by the IdP, a condition that is easily met using the IdP's public metadata. An attacker could create an arbitrary SAML response that would be accepted by SPs using vulnerable SDK
- Product
- spid-aspnetcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to execuCVE-2024-55460 · Other software · reported by MITRECritical 9.8
A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to execute arbitrary code via a crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsgsrs.boardroomlimited.com
Feb 18, 2025Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way.CVE-2024-39327 · Other software · reported by MITRECritical 9.9
Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeviden.comsupport.bull.com
Feb 18, 2025A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication.CVE-2024-57045 · Other software · Dlink · reported by MITRECritical 9.8
A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page.
- Product
- Dir-859 A3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulCVE-2025-1023 · Other software · ChurchCRM · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.3
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.
- Product
- ChurchCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025CarSpot – Dealership Wordpress Classified: Privilege escalationCVE-2024-12860 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- CarSpot – Dealership Wordpress Classified
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update CarSpot – Dealership Wordpress Classified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 18, 2025Keap Official Opt-in Forms: Local File InclusionCVE-2024-13725 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution.
- Product
- Keap Official Opt-in Forms
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 17, 2025The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php.CVE-2025-25222 · Other software · LuxSoft · reported by vultures@jpcert.or.jpCritical 9.8
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.
- Product
- The LuxCal Web Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2025The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php.CVE-2025-25221 · Other software · LuxSoft · reported by vultures@jpcert.or.jpCritical 9.8
The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved.
- Product
- The LuxCal Web Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2025Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB veCVE-2021-46686 · Other software · Extra Innovation Inc. · reported by vultures@jpcert.or.jpCritical 9.8
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB ver.1.1.5 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker.
- Product
- acmailer CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.CVE-2025-1387 · Other software · Learning Digital · reported by twcert@cert.org.twCritical 9.8
Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.
- Product
- Orca HCM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Feb 16, 2025LTL Freight Quotes – FreightQuote Edition: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22290 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows SQL Injection.This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through <= 2.3.11.
- Product
- LTL Freight Quotes – FreightQuote Edition
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update LTL Freight Quotes – FreightQuote Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 15, 2025DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning oCVE-2024-57971 · Other software · eng · reported by MITRECritical 9.1
DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.
- Product
- KNOWAGE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2025The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, passworCVE-2025-26793 · Other software · Hirsch · reported by MITRECritical 9.3
The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."
- Product
- Enterphone MESH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnews.ycombinator.comsupport.identiv.com
Feb 15, 2025s2Member Pro: PHP Object InjectionCVE-2024-12562 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- s2Member Pro
- Affected
- up to 241216
- What to do
- Affects up to 241216. Update s2Member Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD records2member.comwordfence.com
Feb 15, 2025Oliver POS – A WooCommerce Point of Sale (POS): Sensitive Information ExposureCVE-2024-13513 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in turn can be used to change user account information including emails and account type. This allows attackers to then change account passwords resulting in a complete site takeover. Version 2.4.2.3 disabled logging but left sites with existing log files vulnerable.
- Product
- Oliver POS – A WooCommerce Point of Sale (POS)
- Affected
- up to 2.4.2.3
- What to do
- Affects up to 2.4.2.3. Update Oliver POS – A WooCommerce Point of Sale (POS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2025Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of PrivilCVE-2025-26506 · Other software · HP, Inc. · reported by hp-security-alert@hp.comCritical 9.2
Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privilege when processing a PostScript print job.
- Product
- Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the sourceCVE-2024-56973 · Other software · reported by MITRECritical 9.8
Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary code via the source and filename parameters to the ProcessUploadFromURL.jsp component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 14, 2025CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\maCVE-2024-56180 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue.
- Product
- Apache EventMesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 14, 2025The standard user uses the run as function to start the MEAC applications with administrative privileges.CVE-2025-0867 · Other software · SICK AG · reported by psirt@sick.deCritical 9.9
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level.
- Product
- SICK MEAC300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allowCVE-2024-13152 · Other software · BSS Software · reported by iletisim@usom.gov.trCritical 10
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allows SQL Injection. This issue affects Mobuy Online Machinery Monitoring Panel: before 2.0.
- Product
- Mobuy Online Machinery Monitoring Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 14, 2025In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints.CVE-2024-52577 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.5
In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
- Product
- Apache Ignite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Feb 14, 2025Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.CVE-2025-1298 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.
- Product
- com.transsion.carlcare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.tecno.comsecurity.tecno.com
Feb 14, 2025Widget Options: Improper Neutralization of Special Elements used in a Command ('Command Injection')CVE-2025-22630 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Marketing Fire Widget Options widget-options allows OS Command Injection.This issue affects Widget Options: from n/a through <= 4.1.0.
- Product
- Widget Options
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.CVE-2025-25067 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.3
mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensiCVE-2025-24865 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 10
The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.CVE-2025-22896 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.2
mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The Dingtian DT-R0 Series is vulnerable to an exploit that allows attackers to bypass login requirements by directly navigating to the main page.CVE-2025-1283 · Other software · Dingtian · reported by ics-cert@hq.dhs.govCritical 9.3
The Dingtian DT-R0 Series is vulnerable to an exploit that allows attackers to bypass login requirements by directly navigating to the main page.
- Product
- DT-R002
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govdingtian-tech.com
Feb 13, 2025Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB.CVE-2023-34399 · Other software · Mercedes-benz · reported by MITRECritical 9.8
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this table are serialized archive according boost library. The version of boost library contains vulnerability integer overflow.
- Product
- Headunit Ntg6 Mercedes-benz User Experience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.CVE-2025-1127 · Other software · Lexmark · reported by 7bc73191-a2b6-4c63-9918-753964601853Critical 9.1
The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.
- Product
- CX, XC, CS, MS, MX, XM, et. al.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POCVE-2025-1270 · Other software · Anapi Group · reported by cve-coordination@incibe.esCritical 9.1
Insecure direct object reference (IDOR) vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/ha_datos_hermano.php” endpoint to refer to another user. In addition, the first request could also allow the attacker to impersonate other users. As a result, all requests made after exploitation of the IDOR vulnerability will be executed with the privileges of the impersonated user.
- Product
- H6Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025WP Directorybox Manager: Authentication BypassCVE-2024-13182 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator.
- Product
- WP Directorybox Manager
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update WP Directorybox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlocalhostwordfence.com
Feb 13, 2025Campress: Local File InclusionCVE-2024-10763 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_products' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
- Product
- Campress
- Affected
- up to 1.35
- What to do
- Affects up to 1.35. Update Campress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 12, 2025Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled.CVE-2025-0896 · Other software · Orthanc · reported by ics-cert@hq.dhs.govCritical 9.2
Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access by an attacker.
- Product
- Orthanc server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice.CVE-2025-25286 · Other software · Islandora · reported by GitHubCritical 9.8
Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in `islandora/crayfish:4.1.0`. Some workarounds are available. The exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Alternatively or additionally, configure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.
- Product
- Crayfish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another userCVE-2024-7102 · Websites & servers · GitLab · reported by cve@gitlab.comCritical 9.6
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comhackerone.com
Feb 12, 2025An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.CVE-2024-57604 · Other software · Mayswind · reported by MITRECritical 9.8
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.
- Product
- Ezbookkeeping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.CVE-2024-57602 · Other software · Easyappointments · reported by MITRECritical 9.8
An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.
- Product
- Easyappointments
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying CVE-2022-31631 · Websites & servers · PHP Group · reported by security@php.netCritical 9.1
In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.php.netsecurity.netapp.com
Feb 12, 2025Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function.CVE-2025-25343 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025Koa is expressive middleware for Node.js using ES2017 async functions.CVE-2025-25200 · Other software · koajs · reported by GitHubCritical 9.2
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
- Product
- koa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSettings module.CVE-2025-25746 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSettings module.
- Product
- Dir-853 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddear-sunshine-ba5.notion.site
Feb 12, 2025D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings moduleCVE-2025-25744 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module.
- Product
- Dir-853 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddear-sunshine-ba5.notion.site
Feb 12, 2025D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings mCVE-2025-25742 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings module.
- Product
- Dir-853 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddear-sunshine-ba5.notion.site
Feb 12, 2025Stroom is a data processing, storage and analysis platform.CVE-2025-25182 · Other software · gchq · reported by GitHubCritical 9.4
Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2 that allows authentication bypass to a Stroom system when configured with ALB and installed in a way that the application is accessible not through the ALB itself. This vulnerability may also allow for server-side request forgery which may lead to code execution or further privileges escalations when using the AWS metadata URL. This scenario assumes that Stroom must be configured to use ALB Authentication integration and the application is network accessible. The vulnerability has been fixed in versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2.
- Product
- stroom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26361 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.1
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.