Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 30 of 87
Mar 1, 2025A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical.CVE-2025-1791 · Other software · Zorlan · reported by VulDBMedium 5.3
A vulnerability has been found in Zorlan SkyCaiji 2.9 and classified as critical. This vulnerability affects the function fileAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument save_data leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- SkyCaiji
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2025A vulnerability, which was classified as critical, was found in rizinorg rizin up to 0.8.0.CVE-2025-1788 · Other software · rizinorg · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, was found in rizinorg rizin up to 0.8.0. This affects the function rz_utf8_encode in the library /librz/util/utf8.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- rizin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Privilege escalationCVE-2025-1570 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset_pin_code() and reset_user_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
- Product
- Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 27, 2025A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic.CVE-2025-1745 · Other software · LinZhaoguan · reported by VulDBMedium 5.3
A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. This vulnerability affects unknown code of the component Logout. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- pb-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0.CVE-2025-1743 · Other software · zyx0814 · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pichome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0.CVE-2025-1742 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0. Affected by this issue is some unknown functionality of the file /home.php. The manipulation of the argument page_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1.CVE-2025-1741 · Other software · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admin/users.php of the component Admin Page. The manipulation of the argument query/q leads to deserialization. The attack can be launched remotely. Upgrading to version 7.4.1-pl2 is able to address this issue. The identifier of the patch is 4816c8b748f6a5b965c8994e2cf10861bf6e68aa. It is recommended to upgrade the affected component. The vendor acted highly professional and even fixed this issue in the discontinued commercial edition as b1gMail 7.4.0-pl3.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 25, 2025A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1.CVE-2025-1676 · Other software · hzmanyun · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Education and Training System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Classified Listing – Classified ads & Business Directory: Sensitive Information ExposureCVE-2025-1063 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for unauthenticated attackers to extract sensitive data including API keys and tokens.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 24, 2025A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8.CVE-2025-1646 · Other software · Lumsoft · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Lumsoft ERP 8. Affected by this issue is some unknown functionality of the file /Api/TinyMce/UploadAjaxAPI.ashx of the component ASPX File Handler. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability classified as critical was found in Benner Connecta 1.0.5330.CVE-2025-1645 · Other software · Benner · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Benner Connecta 1.0.5330. Affected by this vulnerability is an unknown functionality of the file /Usuarios/Usuario/EditarLogado/. The manipulation of the argument Handle leads to improper control of resource identifiers. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Connecta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0.CVE-2025-1644 · Other software · Benner · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar. The manipulation of the argument idItAg leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 1.2.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- ModernaNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical.CVE-2025-1640 · Other software · Benner · reported by VulDBMedium 6.9
A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/JS_CarregaCombo?formName=DADOS_PESSOAIS_PLANO&additionalCondition=&insideParameters=&elementToReturn=DADOS_PESSOAIS_PLANO&ordenarPelaDescricao=true&direcaoOrdenacao=asc&_=1739290047295. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- ModernaNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic.CVE-2025-1618 · Other software · vTiger · reported by VulDBMedium 5.3
A vulnerability has been found in vTiger CRM 6.4.0/6.5.0 and classified as problematic. This vulnerability affects unknown code of the file /modules/Mobile/index.php. The manipulation of the argument _operation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925.CVE-2025-1617 · Other software · Netis · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, was found in Netis WF2780 2.1.41925. This affects an unknown part of the component Wireless 2.4G Menu. The manipulation of the argument SSID leads to cross site scripting. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WF2780
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1616 · Other software · FiberHome · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality of the component Diagnosis. The manipulation of the argument Destination Address leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1615 · Other software · FiberHome · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the component NAT Submenu. The manipulation of the argument Description leads to cross site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1614 · Other software · FiberHome · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pf_Description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical.CVE-2025-1610 · Other software · LB-LINK · reported by VulDBMedium 5.3
A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/set_blacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1900 Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnoisy-caravel-a9a.notion.sitevuldb.com
Feb 23, 2025A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical.CVE-2025-1609 · Other software · LB-LINK · reported by VulDBMedium 5.3
A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this vulnerability is the function websGetVar of the file /goform/set_cmd. The manipulation of the argument cmd leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1900 Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnoisy-caravel-a9a.notion.sitevuldb.com
Feb 23, 2025A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2.CVE-2025-1608 · Other software · LB-LINK · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. Affected is the function websGetVar of the file /goform/set_manpwd. The manipulation of the argument routepwd leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1900 Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnoisy-caravel-a9a.notion.sitevuldb.com
Feb 23, 2025A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic.CVE-2025-1595 · Other software · Anhui Xufan Information Technology · reported by VulDBMedium 6.9
A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EasyCVR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1.CVE-2025-1594 · Other software · Ffmpeg · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ffmpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordffmpeg.orgtrac.ffmpeg.org
Feb 23, 2025A vulnerability, which was classified as problematic, has been found in otale tale up to 2.0.5.CVE-2025-1585 · Other software · otale · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in otale tale up to 2.0.5. This issue affects the function OptionsService of the file src/main/resources/templates/themes/default/partial/header.html. The manipulation of the argument logo_url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- tale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8.CVE-2025-1584 · Other software · opensolon · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.9 is able to address this issue. The name of the patch is f46e47fd1f8455b9467d7ead3cdb0509115b2ef1. It is recommended to upgrade the affected component.
- Product
- Solon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2025A vulnerability classified as problematic has been found in Harpia DiagSystem 12.CVE-2025-1575 · Other software · Harpia · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument cod/codexame leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DiagSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Feb 22, 2025A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3.CVE-2025-1557 · Other software · Ofcms Project · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in OFCMS 1.1.3. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ofcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2025A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0.CVE-2025-1556 · Other software · westboy · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing of the file /system of the component Template Management. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- CicadasCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1.CVE-2025-1555 · Other software · hzmanyun · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Education and Training System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical.CVE-2025-1546 · Other software · BDCOM · reported by VulDBMedium 6.9
A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is the function log_operate_clear of the file /webui/modules/log/operate.mds. The manipulation of the argument start_code leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Behavior Management and Auditing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210.CVE-2025-1544 · Other software · dingfanzu · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.php. The manipulation of the argument shopId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3.CVE-2025-1543 · Other software · iteachyou · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /resource/js/ueditor-1.4.3.3. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025A vulnerability, which was classified as critical, has been found in D-Link DAP-1320 1.00.CVE-2025-1539 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DAP-1320 1.00. Affected by this issue is the function replace_special_char of the file /storagein.pd-XXXXXX. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DAP-1320
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlegacy.us.dlink.comtasty-foxtrot-3a8.notion.site
Feb 21, 2025A vulnerability classified as critical was found in D-Link DAP-1320 1.00.CVE-2025-1538 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of the file /dws/api/. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DAP-1320
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlegacy.us.dlink.comtasty-foxtrot-3a8.notion.site
Feb 20, 2025Ultimate Classified Listings: Cross-Site Request ForgeryCVE-2024-13753 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the update_profile function. This makes it possible for unauthenticated attackers to modify victim's email via a forged request, which might lead to account takeover, granted they can trick a user into performing an action such as clicking on a link.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2025Ultimate Classified Listings: Stored Cross-Site ScriptingCVE-2024-13748 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 19, 2025A vulnerability, which was classified as problematic, was found in lmxcms 1.41.CVE-2025-1465 · Other software · Lmxcms · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Maintenance. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025A vulnerability, which was classified as critical, has been found in Baiyi Cloud Asset Management System up to 20250204.CVE-2025-1464 · Other software · Baiyi · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Baiyi Cloud Asset Management System up to 20250204. This issue affects some unknown processing of the file /wuser/admin.house.collect.php. The manipulation of the argument project_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cloud Asset Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025CarSpot – Dealership Wordpress Classified: Privilege escalationCVE-2024-12860 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- CarSpot – Dealership Wordpress Classified
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update CarSpot – Dealership Wordpress Classified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 17, 2025A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic.CVE-2025-1392 · Network & remote access · D-Link · reported by VulDBMedium 5.1
A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/webproc?getpage=html/index.html&var:menu=24gwlan&var:page=24G_basic. The manipulation of the argument SSID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-816
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-1380 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /dashboard/admin/del_plan.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2025A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286.CVE-2025-1378 · Other software · Radare · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, was found in radare2 5.9.9 33286. Affected is an unknown function in the library /libr/main/rasm2.c of the component rasm2. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0.0 is able to address this issue. The patch is identified as c6c772d2eab692ce7ada5a4227afd50c355ad545. It is recommended to upgrade the affected component.
- Product
- Radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2025A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192.CVE-2025-1377 · Other software · GNU · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.
- Product
- elfutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 17, 2025A vulnerability classified as problematic was found in GNU elfutils 0.192.CVE-2025-1376 · Other software · GNU · reported by VulDBLow 2
A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.
- Product
- elfutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 16, 2025A vulnerability has been found in GNU elfutils 0.192 and classified as problematic.CVE-2025-1371 · Other software · GNU · reported by VulDBMedium 4.8
A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue.
- Product
- elfutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 16, 2025A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux.CVE-2025-1370 · Other software · MicroWorld · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf of the file epsdaemon of the component Autoscan USB. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eScan Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux.CVE-2025-1369 · Other software · MicroWord · reported by VulDBLow 2
A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of the component USB Password Handler. The manipulation leads to os command injection. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eScan Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical.CVE-2025-1366 · Other software · MicroWord · reported by VulDBMedium 4.8
A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function strcpy of the component VirusPopUp. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eScan Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability, which was classified as critical, was found in GNU elfutils 0.192.CVE-2025-1365 · Other software · GNU · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
- Product
- elfutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 16, 2025A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical.CVE-2025-1364 · Other software · MicroWord · reported by VulDBMedium 4.8
A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is the function passPrompt of the component USB Protection Service. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eScan Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.