Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,845 results · page 7 of 37
Aug 12, 2025Substance3D - Viewer versions 0.25 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cCVE-2025-49560 · Other software · Adobe · reported by AdobeHigh 7.8
Substance3D - Viewer versions 0.25 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTCVE-2025-51629 · Other software · reported by MITREHigh 8.8
A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Temp parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2025HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends.CVE-2025-54378 · Other software · haxtheweb · reported by GitHubHigh 8.3
HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below of haxcms-php, API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation. The API endpoints within the HAX CMS application check if a user is authenticated, but don't check for authorization before performing an operation. This is fixed in versions 11.0.14 of haxcms-nodejs and 11.0.9 of haxcms-php.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sentCVE-2025-53882 · Other software · SUSE · reported by meissner@suse.deMedium 4.8
A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.
- Product
- openSUSE Tumbleweed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend.CVE-2025-54139 · Other software · haxtheweb · reported by GitHubMedium 4.3
HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend.CVE-2025-54137 · Other software · haxtheweb · reported by GitHubHigh 7.3
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.CVE-2025-54134 · Other software · haxtheweb · reported by GitHubHigh 7.1
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform.CVE-2025-54129 · Other software · haxtheweb · reported by GitHubMedium 4.3
HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts. An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites. This is fixed in version 11.0.5.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.CVE-2025-54128 · Other software · haxtheweb · reported by GitHubHigh 7.2
HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance.CVE-2025-54127 · Other software · haxtheweb · reported by GitHubCritical 9.3
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025haxcms-nodejs and haxcms-php are backends for HAXcms.CVE-2025-53642 · Other software · haxtheweb · reported by GitHubMedium 4.8
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel: Stored Cross-Site ScriptingCVE-2025-6068 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
- Affected
- up to 2.4.31
- What to do
- Affects up to 2.4.31. Update FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2025An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when pasCVE-2025-34099 · Other software · VICIdial Group · reported by VulnCheckCritical 9.3
An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.
- Product
- VICIdial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comvulncheck.com
Jul 9, 2025Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by useCVE-2025-53675 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- Product
- Jenkins Warrior Framework Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Jul 9, 2025Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by useCVE-2025-53668 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- Product
- Jenkins VAddy Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Jul 9, 2025Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by CVE-2025-53666 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- Product
- Jenkins Dead Man's Snitch Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Jul 8, 2025Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security LevelsCVE-2025-7031 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4.
- Product
- Config Pages Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Substance3D - Viewer versions 0.22 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2025-43584 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Viewer versions 0.22 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Substance3D - Viewer versions 0.22 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service.CVE-2025-43583 · Other software · Adobe · reported by AdobeMedium 5.5
Substance3D - Viewer versions 0.22 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cCVE-2025-43582 · Other software · Adobe · reported by AdobeHigh 7.8
Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user, scope unchanged. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Substance3D - Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deseriaCVE-2025-42963 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment.
- Product
- SAP NetWeaver Application Server for Java (Log Viewer )
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2025In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages CVE-2025-6725 · Other software · Progress Software · reported by security@progress.comMedium 5.4
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
- Product
- Kendo UI for jQuery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtelerik.comtelerik.com
Jul 1, 2025Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: DOM-Based Reflected Cross-Site ScriptingCVE-2025-5314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
- Affected
- up to 2.3.65
- What to do
- Affects up to 2.3.65. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 24, 2025Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows alCVE-2025-36537 · Other software · TeamViewer · reported by psirt@teamviewer.comHigh 7
Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
- Product
- Full Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 20253D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery: Stored Cross-Site ScriptingCVE-2025-5289 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.
- Product
- 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
- Affected
- up to 1.16.15
- What to do
- Affects up to 1.16.15. Update 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2025Lewe ChordPress: Cross-Site Request Forgery (CSRF)CVE-2025-52789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a through <= 4.0.1.
- Product
- Lewe ChordPress
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Lewe ChordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025MicroDicom DICOM Viewer suffers from an out-of-bounds write vulnerability.CVE-2025-5943 · Other software · MicroDicom · reported by ics-cert@hq.dhs.govHigh 8.6
MicroDicom DICOM Viewer suffers from an out-of-bounds write vulnerability. Remote attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit the vulnerability in that the user must either visit a malicious website or open a malicious DICOM file locally.
- Product
- DICOM Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025HAX CMS PHP allows users to manage their microsite universe with a PHP backend.CVE-2025-49141 · Other software · haxtheweb · reported by GitHubHigh 8.5
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `gitImportSite` functionality obtains a URL string from a POST request and insufficiently validates user input. The `set_remote` function later passes this input into `proc_open`, yielding OS command injection. An authenticated attacker can craft a URL string that bypasses the validation checks employed by the `filter_var` and `strpos` functions in order to execute arbitrary OS commands on the backend server. The attacker can exfiltrate command output via an HTTP request. Version 11.0.3 contains a patch for the issue.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025HAX CMS PHP allows users to manage their microsite universe with a PHP backend.CVE-2025-49139 · Other software · haxtheweb · reported by GitHubMedium 5.3
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, in the HAX site editor, users can create a website block to load another site in an iframe. The application allows users to supply a target URL in the website block. When the HAX site is visited, the client's browser will query the supplied URL. An authenticated attacker can create a HAX site with a website block pointing at an attacker-controlled server running Responder or a similar tool. The attacker can then conduct a phishing attack by convincing another user to visit their malicious HAX site to harvest credentials. Version 11.0.0 contains a patch for the issue.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025HAX CMS PHP allows users to manage their microsite universe with a PHP backend.CVE-2025-49138 · Other software · haxtheweb · reported by GitHubMedium 6.5
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, an authenticated Local File Inclusion (LFI) vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server (www-data). The vulnerability stems from the way the HAXCMS backend handles the location field in the site's outline. When a user sends a POST request to /system/api/saveOutline, the backend stores the provided location value directly into the site.json file associated with the site, without validating or sanitizing the input. Later the location parameter is interpreted by the CMS to resolve and load the content for a given node. If the location field contains a relative path like `../../../etc/passwd`, the application will attempt to read and render that file. Version 11.0.0 fixes the issue.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025HAX CMS PHP allows users to manage their microsite universe with a PHP backend.CVE-2025-49137 · Other software · haxtheweb · reported by GitHubHigh 8.5
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the application does not sufficiently sanitize user input, allowing for the execution of arbitrary JavaScript code. The 'saveNode' and 'saveManifest' endpoints take user input and store it in the JSON schema for the site. This content is then rendered in the generated HAX site. Although the application does not allow users to supply a `script` tag, it does allow the use of other HTML tags to run JavaScript. Version 11.0.0 fixes the issue.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2025-5481 · Other software · Sante · reported by zdi-disclosures@trendmicro.comHigh 7.8
Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26168.
- Product
- DICOM Viewer Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025Freemind Viewer: Stored Cross-Site ScriptingCVE-2025-5536 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Freemind Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'freemind' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Freemind Viewer
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Freemind Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 4, 2025An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint.CVE-2025-46204 · Other software · Changeweb · reported by MITREMedium 6.5
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.CVE-2025-46203 · Other software · Changeweb · reported by MITREMedium 6.5
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.
- Product
- Unifiedtransform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls.CVE-2025-48996 · Other software · haxtheweb · reported by GitHubMedium 5.3
HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the `haxPsuUsage` API endpoint, related to a flat present in open-apis versions up to and including 10.0.2. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues (e.g., HAX-3), this could assist in targeted attacks such as unauthorized content modification or deletion. Commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 patches the vulnerability.
- Product
- issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2025IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authenCVE-2025-1499 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authenticated user.
- Product
- InfoSphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability.CVE-2025-5307 · Other software · Santesoft · reported by ics-cert@hq.dhs.govHigh 8.4
Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability. A local attacker could exploit this issue to potentially disclose information and to execute arbitrary code on affected installations of Sante DICOM Viewer Pro.
- Product
- Sante DICOM Viewer Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE TumblCVE-2025-23394 · Other software · SUSE · reported by meissner@suse.deCritical 9.8
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
- Product
- openSUSE Tumbleweed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability.CVE-2025-3480 · Other software · MedDream · reported by zdi-disclosures@trendmicro.comMedium 6.5
MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of MedDream WEB DICOM Viewer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Web Portal. The issue results from the lack of encryption when transmitting credentials. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-25842.
- Product
- WEB DICOM Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticaCVE-2025-4762 · Other software · Lleidanet PKI · reported by 8ca67973-55d1-4246-bb7c-ce7e65ad8782Low 2
Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.
- Product
- eSigna
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latestCVE-2025-1752 · Other software · run-llama · reported by security@huntr.devHigh 7.5
A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025Improper access control in Azure allows an unauthorized attacker to disclose information over a network.CVE-2025-33072 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper access control in Azure allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft msagsfeedback.azurewebsites.net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive informCVE-2025-45618 · Other software · Huangjian888 · reported by MITREMedium 6.5
Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive information via a crafted payload.
- Product
- Jeeweb-mybatis-springboot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we haCVE-2022-21546 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.5
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal WRITE SAME with no data buffer.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025MicroDicom DICOM Viewer is vulnerable to an out-of-bounds read which may allow an attacker to cause memory corruption within the application.CVE-2025-36521 · Other software · MicroDicom · reported by ics-cert@hq.dhs.govHigh 8.6
MicroDicom DICOM Viewer is vulnerable to an out-of-bounds read which may allow an attacker to cause memory corruption within the application. The user must open a malicious DCM file for exploitation.
- Product
- DICOM Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govmicrodicom.com
May 1, 2025MicroDicom DICOM Viewer is vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code.CVE-2025-35975 · Other software · MicroDicom · reported by ics-cert@hq.dhs.govHigh 8.6
MicroDicom DICOM Viewer is vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code. The user must open a malicious DCM file for exploitation.
- Product
- DICOM Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability classified as problematic has been found in baseweb JSite up to 1.0.CVE-2025-3970 · Other software · baseweb · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in baseweb JSite up to 1.0. Affected is an unknown function of the file /sys/office/save. The manipulation of the argument Remarks leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- JSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025Luxion KeyShot Viewer KSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2025-1045 · Other software · Luxion · reported by zdi-disclosures@trendmicro.comHigh 7.8
Luxion KeyShot Viewer KSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24586.
- Product
- KeyShot Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.keyshot.comzerodayinitiative.com
Apr 22, 2025A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0 (440).CVE-2025-43952 · Other software · reported by MITREMedium 6.1
A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0 (440). It allows an attacker to inject malicious scripts via the IW_SessionID_ parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.