Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 31 of 87
Feb 16, 2025A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207.CVE-2025-1360 · Other software · Internet Web Solutions · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msg_to leads to cross site scripting. It is possible to launch the attack remotely. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Sublime CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0.CVE-2025-1359 · Other software · SIAM Industria de Automação e Monitoramento · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0. This issue affects some unknown processing of the file /qrcode.jsp. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SIAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10.CVE-2025-1358 · Other software · Pix Software · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Vivaz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability classified as problematic has been found in Seventh D-Guard up to 20250206.CVE-2025-1357 · Other software · Seventh · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Seventh D-Guard up to 20250206. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- D-Guard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical.CVE-2025-1353 · Other software · Kong · reported by VulDBHigh 7.3
A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The real existence of this vulnerability is still doubted at the moment. The vendor is not able to reproduce the issue.
- Product
- Insomnia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability has been found in GNU elfutils 0.192 and classified as critical.CVE-2025-1352 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.
- Product
- elfutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 16, 2025A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0.CVE-2025-1341 · Other software · Pmweb · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Pmweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329.CVE-2025-1340 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic.CVE-2025-1336 · Other software · Cmseasy · reported by VulDBMedium 5.3
A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library lib/admin/image_admin.php. The manipulation of the argument imgname leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cmseasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2025A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9.CVE-2025-1335 · Other software · Cmseasy · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_admin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cmseasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2025A vulnerability has been found in FastCMS up to 0.1.5 and classified as problematic.CVE-2025-1332 · Other software · Xjd2020 · reported by VulDBMedium 4.8
A vulnerability has been found in FastCMS up to 0.1.5 and classified as problematic. This vulnerability affects unknown code of the file /fastcms.html#/template/menu of the component Template Menu. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- Fastcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025Listivo - Classified Ads: Reflected Cross-Site ScriptingCVE-2024-13867 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.3.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Listivo - Classified Ads
- Affected
- up to 2.3.67
- What to do
- Affects up to 2.3.67. Update Listivo - Classified Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 12, 2025A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6.CVE-2025-1229 · Other software · olajowon · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected by this vulnerability is an unknown functionality of the file /read/?page=1&logfile=eee&match=. The manipulation of the argument path leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- Loggrove
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability classified as problematic has been found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6.CVE-2025-1228 · Other software · olajowon · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected is an unknown function of the file /read/?page=1&logfile=LOG_Monitor of the component Logfile Update Handler. The manipulation of the argument path leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- Loggrove
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03.CVE-2025-1225 · Other software · R1bbit · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interface. The manipulation leads to xml external entity reference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Yimioa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability classified as critical was found in ywoa up to 2024.07.03.CVE-2025-1224 · Other software · R1bbit · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Yimioa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03.CVE-2025-1216 · Other software · R1bbit · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Yimioa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability classified as problematic was found in vim up to 9.1.1096.CVE-2025-1215 · Other software · VIM · reported by VulDBLow 2.4
A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.
- Product
- VIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability classified as critical has been found in pihome-shc PiHome 2.0.CVE-2025-1214 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0.CVE-2025-1188 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/updateroutine.php. The manipulation of the argument tid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical.CVE-2025-1184 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModal_MQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability has been found in CodeZips Gym Management System 1.0 and classified as critical.CVE-2025-1183 · Other software · CodeZips · reported by VulDBMedium 5.3
A vulnerability has been found in CodeZips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/more-userprofile.php. The manipulation of the argument login_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Stored Cross-Site ScriptingCVE-2024-13506 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Affected
- up to 2.8.97
- What to do
- Affects up to 2.8.97. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 11, 2025A vulnerability, which was classified as critical, was found in GNU Binutils 2.43.CVE-2025-1182 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 11, 2025A vulnerability classified as critical was found in GNU Binutils 2.43.CVE-2025-1181 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 11, 2025A vulnerability classified as problematic has been found in GNU Binutils 2.43.CVE-2025-1180 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 11, 2025A vulnerability was found in GNU Binutils 2.43 and classified as critical.CVE-2025-1176 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 10, 2025A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical.CVE-2025-1167 · Other software · Mayuri K · reported by VulDBMedium 5.3
A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is some unknown functionality of the file /hr_soft/admin/Update_User.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Employee Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability, which was classified as critical, was found in Lumsoft ERP 8.CVE-2025-1165 · Other software · Lumsoft · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability was found in Allims lab.online up to 20250201 and classified as critical.CVE-2025-1157 · Other software · Allims · reported by VulDBMedium 5.3
A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the file /model/model_recuperar_senha.php. The manipulation of the argument recuperacao leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lab.online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical.CVE-2025-1156 · Other software · Pix Software · reported by VulDBMedium 6.9
A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login. The manipulation of the argument usuario leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Vivaz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1.CVE-2025-1155 · Other software · Webkul · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove this page in the long term.
- Product
- QloApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1.CVE-2025-1154 · Other software · xxyopen · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Novel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Feb 10, 2025A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44.CVE-2025-1153 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 10, 2025A vulnerability classified as problematic has been found in GNU Binutils 2.43.CVE-2025-1152 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 10, 2025A vulnerability was found in GNU Binutils 2.43 and classified as problematic.CVE-2025-1148 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 10, 2025A vulnerability has been found in GNU Binutils 2.43 and classified as problematic.CVE-2025-1147 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 8, 2025A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart.CVE-2025-1117 · Other software · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the argument coin leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.3 is able to address this issue. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 8, 2025A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart.CVE-2025-1116 · Other software · Dreamvention · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/live_search/module/live_search.searchresults. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Live AJAX Search Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Feb 8, 2025A vulnerability classified as problematic was found in RT-Thread up to 5.1.0.CVE-2025-1115 · Other software · Rt-thread · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_control/sys_device_find/sys_device_init/sys_device_open/sys_device_read/sys_device_register/sys_device_write/sys_event_delete/sys_event_recv/sys_event_send/sys_mb_delete/sys_mb_recv/sys_mb_send/sys_mb_send_wait/sys_mq_recv/sys_mq_send/sys_mq_urgent/sys_mutex_delete/sys_mutex_release/sys_mutex_take/sys_rt_timer_control/sys_rt_timer_delete/sys_rt_timer_start/sys_rt_timer_stop/sys_sem_delete/sys_sem_release/sys_sem_take/sys_shmat/sys_shmdt/sys_thread_create/sys_thread_delete/sys_thread_startup/sys_timer_delete/sys_timer_gettime/sys_timer_settime of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument arg[0] leads to information disclosure. An attack has to be approached locally.
- Product
- Rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025A vulnerability classified as problematic has been found in newbee-mall 1.0.CVE-2025-1114 · Other software · Newbee-mall Project · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component Add Category Page. The manipulation of the argument categoryName leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- Newbee-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025A vulnerability classified as critical has been found in CmsEasy 7.7.7.9.CVE-2025-1106 · Other software · Cmseasy · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/database_admin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cmseasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical.CVE-2025-1104 · Network & remote access · D-Link · reported by VulDBMedium 6.9
A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authentication bypass by spoofing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DHP-W310AV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802.CVE-2025-1103 · Network & remote access · D-Link · reported by VulDBHigh 7.1
A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blacklists of the file /goform/set_wifi_blacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtasty-foxtrot-3a8.notion.sitevuldb.com
Feb 6, 2025A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical.CVE-2025-1086 · Other software · Safetytest · reported by VulDBMedium 6.9
A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /static/. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cloud-Master Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03.CVE-2025-1085 · Other software · Animati · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PACS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0.CVE-2025-1084 · Other software · Mindskip · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xzs-mysql 学之思开源考试系统
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0.CVE-2025-1083 · Other software · Mindskip · reported by VulDBLow 2.3
A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the component CORS Handler. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xzs-mysql 学之思开源考试系统
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0.CVE-2025-1082 · Other software · Mindskip · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xzs-mysql 学之思开源考试系统
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical.CVE-2025-1078 · Other software · AppHouseKitchen · reported by VulDBMedium 4.8
A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the function shouldAcceptNewConnection of the file com.apphousekitchen.aldente-pro.helper of the component XPC Service. The manipulation leads to improper authorization. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.30 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional.
- Product
- AlDente Charge Limiter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.