Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,798 results · page 30 of 116
Apr 4, 2025Administrator Z: Cross-Site Request Forgery (CSRF)CVE-2025-32276 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Quý Lê 91 Administrator Z administrator-z allows Cross Site Request Forgery.This issue affects Administrator Z: from n/a through <= 2026.03.02.
- Product
- Administrator Z
- Affected
- up to 2026.03.02
- What to do
- Affects up to 2026.03.02. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Administrator Z: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32187 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quý Lê 91 Administrator Z administrator-z allows DOM-Based XSS.This issue affects Administrator Z: from n/a through <= 2026.03.02.
- Product
- Administrator Z
- Affected
- up to 2026.03.02
- What to do
- Affects up to 2026.03.02. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who CVE-2025-31285 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
- Product
- Trend Vision One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who couCVE-2025-31284 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
- Product
- Trend Vision One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users whoCVE-2025-31283 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
- Product
- Trend Vision One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Apr 2, 2025A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users wCVE-2025-31282 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 4.6
A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
- Product
- Trend Vision One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Apr 2, 2025A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings.CVE-2025-0415 · Other software · Moxa · reported by psirt@moxa.comCritical 9.2
A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for downstream systems that rely on its network services.
- Product
- EDF-G1002-BP Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actionsCVE-2025-28131 · Other software · Nagios · reported by MITREMedium 4.6
A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enabling unauthorized modifications that compromise system integrity and availability.
- Product
- Network Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel.CVE-2025-30006 · Other software · Xorcom · reported by VulnCheckMedium 6.1
Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects CompletePBX: all versions up to and including 5.2.35
- Product
- CompletePBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comxorcom.com
Mar 31, 2025Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands asCVE-2025-30004 · Other software · Xorcom · reported by VulnCheckHigh 8.8
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35
- Product
- CompletePBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comxorcom.com
Mar 31, 2025A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4CVE-2023-33302 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.7
A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests.
- Product
- FortiNDR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Mar 31, 2025Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces.CVE-2024-12021 · Other software · Black Duck · reported by disclosure@synopsys.comHigh 8.5
Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromise of local accounts managed by the Coverity platform as well as other standard impacts resulting from cross-site scripting.
- Product
- Coverity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.blackduck.com
Mar 28, 2025A vulnerability was found in the Infinispan component in Red Hat Data Grid.CVE-2024-6875 · Other software · Red Hat · reported by Red HatMedium 6.5
A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API.
- Product
- Red Hat Data Grid 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Mar 28, 2025Administrator Z: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2815 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26959 is a duplicate of this issue.
- Product
- Administrator Z
- Affected
- up to 2025.03.24
- What to do
- Affects up to 2025.03.24. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 24, 2025A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.CVE-2023-25610 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
- Product
- FortiSwitchManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database adminisCVE-2024-8774 · Other software · Simple SA · reported by cvd@cert.plHigh 7.7
The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch 6.30@a03.9, which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched.
- Product
- SIMPLE.ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random numCVE-2025-1796 · Other software · langgenius · reported by security@huntr.devHigh 8.8
A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset codes. The application uses `random.randint` for this purpose, which is not suitable for cryptographic use and can be cracked. An attacker with access to workflow tools can extract the PRNG output and predict future password reset codes, leading to a complete compromise of the application.
- Product
- langgenius/dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page.CVE-2024-9612 · Other software · danswer-ai · reported by security@huntr.devMedium 6.5
In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. However, the back-end does not verify the visibility status of the search page. Consequently, attackers can directly call the API to access the functionalities provided by the search page, bypassing the visibility restriction set by the administrator.
- Product
- danswer-ai/danswer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53.CVE-2025-27705 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 5.5
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator logs in. Attack complexity is high, attack requirements are present, privileges required are none, user interaction is required. The impact to confidentiality is low, the impact to availability is none, and the impact to system integrity is none.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53.CVE-2025-27704 · Other software · Absolute Security · reported by SecurityResponse@netmotionsoftware.comMedium 5.5
There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator logs in. Attack complexity is high, attack requirements are present, privileges required are none, user interaction is required. The impact to confidentiality is low, the impact to availability is none, and the impact to system integrity is none.
- Product
- Secure Access
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service.CVE-2025-26042 · Other software · reported by MITREMedium 6
Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php.CVE-2025-2202 · Other software · Innovación y Cualificación · reported by cve-coordination@incibe.esMedium 6.9
Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email.
- Product
- ajax.php plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php.CVE-2025-2199 · Other software · Innovación y Cualificación · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query in ‘searchActionsToUpdate’, ‘searchSpecialitiesPending’, ‘searchSpecialitiesLinked’, ‘searchUsersToUpdateProfile’, ‘training_action_data’, ‘showContinuingTrainingCourses’ and ‘showUsersToEdit’ in /local/administration/ajax.php.
- Product
- ajax.php plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2025A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their CVE-2025-25225 · Other software · hikashop.com · reported by security@joomla.orgMedium 6.5
A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.
- Product
- Hikashop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhikashop.com
Mar 13, 2025Froxlor is open-source server administration software.CVE-2025-29773 · Other software · froxlor · reported by GitHubMedium 5.8
Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential issues with account identification and security. This vulnerability can be exploited by authenticated users (e.g., reseller, customer) who can create accounts with the same email address that has already been used by another account, such as the admin. The attack vector is email-based, as the system does not prevent multiple accounts from registering the same email address, leading to possible conflicts and security issues. Version 2.2.6 fixes the issue.
- Product
- Froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrativeCVE-2025-0117 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 7.1
A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.
- Product
- GlobalProtect App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Mar 11, 2025The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the TinCVE-2021-37787 · Other software · Abocms · reported by MITREMedium 6.5
The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the TinyMCE module
- Product
- Abo.cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commandCVE-2024-45328 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.8
An incorrect authorization vulnerability [CWE-863] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu.
- Product
- FortiSandbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Mar 10, 2025SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter CVE-2025-0071 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.9
SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impact on integrity or availability.
- Product
- SAP Web Dispatcher and Internet Communication Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute aCVE-2025-22212 · Other software · tassos.gr · reported by security@joomla.orgLow 2.7
A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend.
- Product
- Convert Forms component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product.CVE-2025-1393 · Other software · Weidmueller · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product.
- Product
- PROCON-WIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-0011CVE-2025-27667 · Other software · Printerlogic · reported by MITRECritical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-0011.
- Product
- Vasion Print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BCVE-2024-0114 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.1
NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to access the HMC as an administrator. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
- Product
- NVIDIA Hopper HGX 8-GPU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Certain functionality within GMOD Apollo does not require authentication when passed with an administrative usernameCVE-2025-24924 · Other software · GMOD · reported by ics-cert@hq.dhs.govCritical 9.3
Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration.CVE-2025-27507 · Other software · zitadel · reported by GitHubCritical 9
The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field.CVE-2025-22270 · Other software · CyberArk · reported by cvd@cert.plHigh 7.3
An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additional error that allows bypassing the Content-Security-Policy policy, which mitigates JS code execution while still allowing HTML injection. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
- Product
- Endpoint Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administratiCVE-2025-22492 · Other software · Eaton · reported by CybersecurityCOE@eaton.comMedium 6.3
The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.100 of FRS.
- Product
- Foreseer Reporting Software (FRS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by iCVE-2024-46226 · Other software · Helpdeskz · reported by MITREMedium 4.8
A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket.
- Product
- Helpdeskz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 25, 2025A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption.CVE-2025-0760 · Other software · Tenable · reported by vulnreport@tenable.comLow 2.7
A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encryption.
- Product
- Tenable Identity Exposure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary CVE-2025-22211 · Other software · webdesigner-profi.de · reported by security@joomla.orgLow 3.4
A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend.
- Product
- JoomShopping component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwebdesigner-profi.de
Feb 25, 2025A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL CVE-2025-22210 · Other software · hikashop.com · reported by security@joomla.orgHigh 7.2
A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.
- Product
- Hikashop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhikashop.com
Feb 24, 2025Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.CVE-2025-26529 · Other software · Moodle Project · reported by patrick@puiterwijk.orgHigh 8.3
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgmoodle.org
Feb 21, 2025A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accountCVE-2025-25772 · Other software · Ujcms · reported by MITREMedium 5.1
A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.
- Product
- Jspxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to CVE-2025-0112 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 6.8
A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity.
- Product
- Cortex XDR Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Feb 18, 2025The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication, CVE-2022-41545 · Network & remote access · Netgear · reported by MITREMedium 6.4
The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication, with an HTTP header containing a base64 value of the plaintext username and password. Because the web server also does not utilize transport security by default, this renders the administrative credentials vulnerable to eavesdropping by an adversary during every authenticated request made by a client to the router over a WLAN, or a LAN, should the adversary be able to perform a man-in-the-middle attack.
- Product
- C7800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgnetgear.com
Feb 15, 2025A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commCVE-2025-22209 · Other software · joomsky.com · reported by security@joomla.orgMedium 4.7
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'searchpaymentstatus' parameter in the Employer Payment History search feature.
- Product
- JS Jobs component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2025A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commCVE-2025-22208 · Other software · joomsky.com · reported by security@joomla.orgMedium 4.7
A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands via the 'filter_email' parameter in the GDPR Erase Data Request search feature.
- Product
- JS Jobs component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025The standard user uses the run as function to start the MEAC applications with administrative privileges.CVE-2025-0867 · Other software · SICK AG · reported by psirt@sick.deCritical 9.9
The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level.
- Product
- SICK MEAC300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds,CVE-2024-12054 · Other software · ZF · reported by ics-cert@hq.dhs.govMedium 5.9
ZF Roll Stability Support Plus (RSSPlus) is vulnerable to an authentication bypass vulnerability targeting deterministic RSSPlus SecurityAccess service seeds, which may allow an attacker to remotely (proximal/adjacent with RF equipment or via pivot from J2497 telematics devices) call diagnostic functions intended for workshop or repair scenarios. This can impact system availability, potentially degrading performance or erasing software, however the vehicle remains in a safe vehicle state.
- Product
- RSSPlus 2M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensiCVE-2025-24865 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 10
The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.