Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 32 of 87
Feb 6, 2025A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1.CVE-2025-1074 · Other software · Webkul · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it.
- Product
- QloApps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2025A vulnerability classified as critical was found in CmsEasy 7.7.7.9.CVE-2025-0973 · Other software · Cmseasy · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in CmsEasy 7.7.7.9. This vulnerability affects the function backAll_action in the library lib/admin/database_admin.php of the file /index.php?case=database&act=backAll&admin_dir=admin&site=default. The manipulation of the argument select[] leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cmseasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2025A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22.CVE-2025-0972 · Other software · Zenvia · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22. This affects an unknown part of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 25.01.22.245a473c54 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Movidesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2025Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings: Information ExposureCVE-2024-12041 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12 via the /wp-json/directorist/v1/users/ endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including including usernames, email addresses, names, and more information about users.
- Product
- Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings
- Affected
- up to 8.0.12
- What to do
- Affects up to 8.0.12. Update Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 31, 2025Cleanup – Directory Listing & Classifieds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeglow Cleanup – Directory Listing & Classifieds WordPress Plugin cleanup-light allows Reflected XSS.This issue affects Cleanup – Directory Listing & Classifieds WordPress Plugin: from n/a through <= 1.0.4.
- Product
- Cleanup – Directory Listing & Classifieds
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Cleanup – Directory Listing & Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0880 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/updateplan.php. The manipulation of the argument planid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025A vulnerability classified as problematic has been found in Maybecms 1.2.CVE-2025-0871 · Other software · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Maybecms 1.2. This affects an unknown part of the file /mb/admin/index.php?u=article-edit of the component Add Article. The manipulation of the argument data_info[content] leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025A vulnerability was found in needyamin Library Card System 1.0 and classified as critical.CVE-2025-0842 · Other software · needyamin · reported by VulDBMedium 6.9
A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Library Card System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical.CVE-2025-0841 · Other software · Aridius · reported by VulDBMedium 6.9
A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
- Product
- XYZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jan 29, 2025A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43.CVE-2025-0840 · Other software · GNU · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Jan 28, 2025A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0.CVE-2025-0803 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/submit_plan_new.php. The manipulation of the argument planid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability was found in ESAFENET CDG V5 and classified as problematic.CVE-2025-0794 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability was found in ESAFENET CDG V5 and classified as problematic. Affected by this issue is some unknown functionality of the file /todoDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability has been found in ESAFENET CDG V5 and classified as critical.CVE-2025-0793 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability has been found in ESAFENET CDG V5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /todoDetail.jsp. The manipulation of the argument flowId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability, which was classified as critical, was found in ESAFENET CDG V5.CVE-2025-0792 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in ESAFENET CDG V5. Affected is an unknown function of the file /sdTodoDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability, which was classified as critical, has been found in ESAFENET CDG V5.CVE-2025-0791 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in ESAFENET CDG V5. This issue affects some unknown processing of the file /sdDoneDetail.jsp. The manipulation of the argument flowId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability classified as problematic was found in ESAFENET CDG V5.CVE-2025-0790 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in ESAFENET CDG V5. This vulnerability affects unknown code of the file /doneDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability classified as critical has been found in ESAFENET CDG V5.CVE-2025-0789 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in ESAFENET CDG V5. This affects an unknown part of the file /doneDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability was found in ESAFENET CDG V5 and classified as problematic.CVE-2025-0785 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability was found in ESAFENET CDG V5 and classified as problematic. This issue affects some unknown processing of the file /SysConfig.jsp. The manipulation of the argument help leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic.CVE-2025-0784 · Other software · Intelbras · reported by VulDBMedium 6.3
A vulnerability has been found in Intelbras InControl up to 2.21.58 and classified as problematic. This vulnerability affects unknown code of the file /v1/usuario/ of the component Registered User Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.59 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- InControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeldruin.notion.sitevuldb.com
Jan 28, 2025A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113.CVE-2025-0783 · Other software · pankajindevops · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- scale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdrive.google.com
Jan 28, 2025A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0.CVE-2024-11956 · Other software · Pimcore · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- customer-data-framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025A vulnerability classified as problematic was found in Pimcore 11.4.2.CVE-2024-11954 · Other software · Pimcore · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0.CVE-2025-0753 · Other software · Axiomatic · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0. This vulnerability affects the function AP4_StdcFileByteStream::ReadPartial of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0.CVE-2025-0751 · Other software · Axiomatic · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0. This affects the function AP4_BitReader::ReadBits of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical.CVE-2025-0734 · Other software · y_project · reported by VulDBMedium 5.1
A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RuoYi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jan 27, 2025A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows.CVE-2025-0733 · Other software · reported by VulDBLow 2
A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows.CVE-2025-0732 · Other software · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel.CVE-2025-0730 · Network & remote access · TP-Link · reported by VulDBMedium 6.3
A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. Affected is an unknown function of the file /usr_account_set.cgi of the component HTTP GET Request Handler. The manipulation of the argument username/password leads to use of get request method with sensitive query strings. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.0 Build 20250124 Rel. 54920(Beta) is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early. They reacted very professional and provided a pre-fix version for their customers.
- Product
- TL-SG108E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstatic.tp-link.com
Jan 27, 2025A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002.CVE-2024-12345 · Other software · INW · reported by VulDBMedium 6.7
A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack on the local host. Other endpoints might be affected as well.
- Product
- Krbyyyzo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2025A vulnerability classified as critical was found in needyamin image_gallery 1.0.CVE-2025-0722 · Other software · needyamin · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the component Cover Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- image_gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2025A vulnerability classified as problematic has been found in needyamin image_gallery 1.0.CVE-2025-0721 · Other software · needyamin · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- image_gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic.CVE-2025-0706 · Other software · JoeyBling · reported by VulDBMedium 5.1
A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/sys/admin.html. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- bootplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic.CVE-2025-0705 · Other software · JoeyBling · reported by VulDBMedium 6.9
A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this vulnerability is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument text leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- bootplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d.CVE-2025-0704 · Other software · JoeyBling · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. Affected is the function qrCode of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the argument w/h leads to resource consumption. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- bootplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d.CVE-2025-0703 · Other software · JoeyBling · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This issue affects some unknown processing of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument name leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- bootplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A vulnerability classified as critical was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d.CVE-2025-0702 · Other software · JoeyBling · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This vulnerability affects unknown code of the file src/main/java/io/github/controller/SysFileController.java. The manipulation of the argument portraitFile leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- bootplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A vulnerability classified as critical has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d.CVE-2025-0701 · Other software · JoeyBling · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This affects an unknown part of the file /admin/sys/user/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- bootplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025A vulnerability, which was classified as problematic, was found in Telstra Smart Modem Gen 2 up to 20250115.CVE-2025-0697 · Other software · Telstra · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in Telstra Smart Modem Gen 2 up to 20250115. This affects an unknown part of the component HTTP Header Handler. The manipulation of the argument Content-Disposition leads to injection. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Smart Modem Gen 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2025A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic.CVE-2024-13524 · Other software · obsproject · reported by VulDBLow 2
A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. The vendor disagrees that this issue is "something worth reporting, as every attack surface requires privileged access/user compromise".
- Product
- OBS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2025A vulnerability was found in Mobotix M15 4.3.4.83 and classified as problematic.CVE-2025-0576 · Other software · Mobotix · reported by VulDBMedium 6.9
A vulnerability was found in Mobotix M15 4.3.4.83 and classified as problematic. This issue affects some unknown processing of the file /control/player?center&eventlist&pda&dummy_for_reload=1736177631&p_evt. The manipulation of the argument p_qual leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- M15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2025A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic.CVE-2025-0575 · Other software · Union Bank of India · reported by VulDBLow 1.8
A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic. This vulnerability affects unknown code of the component Rooting Detection. The manipulation leads to protection mechanism failure. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Vyom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Jan 19, 2025A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1.CVE-2025-0567 · Other software · Epic Games · reported by VulDBLow 2
A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of the component Installer. The manipulation leads to untrusted search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation appears to be difficult.
- Product
- Launcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2025A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13.CVE-2025-0566 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpan.baidu.comvuldb.com
Jan 18, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0562 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/health_status_entry.php. The manipulation of the argument usrid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0.CVE-2025-0558 · Other software · TDuckCloud · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThemeRequest of the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java. The manipulation of the argument color leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- tduck-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2.CVE-2025-0557 · Other software · Hyland · reported by VulDBMedium 6.9
A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. This affects an unknown part of the file /share/s/ of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Alfresco Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0541 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/edit_member.php. The manipulation of the argument name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability classified as critical has been found in Codezips Gym Management System 1.0.CVE-2025-0535 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem_submit.php. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20.CVE-2025-0528 · Network & remote access · Tenda · reported by VulDBHigh 8.6
A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025The Motors – Car Dealer, Classifieds & Listing: Arbitrary shortcode executionCVE-2024-10970 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The Motors – Car Dealer, Classifieds & Listing
- Affected
- up to 1.4.43
- What to do
- Affects up to 1.4.43. Update The Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.