Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 8 of 87
Jul 18, 2025A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9.CVE-2025-7795 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. Affected by this issue is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability classified as critical was found in Tenda FH451 1.0.0.9.CVE-2025-7794 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9.CVE-2025-7793 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary. The manipulation of the argument webSiteId leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic.CVE-2025-7789 · Other software · Xuxueli · reported by VulDBLow 2.9
A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with insufficient computational effort. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical.CVE-2025-7788 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1.CVE-2025-7787 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10.CVE-2025-7786 · Other software · Gnuboard · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing of the file /bbs/scrap_popin_update/qa/ of the component Post Reply Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- g6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0.CVE-2025-7785 · Other software · thinkgem · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the file src/main/java/com/jeesite/modules/sys/web/SsoController.java. The manipulation of the argument redirect leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0.CVE-2025-7763 · Other software · thinkgem · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.
- Product
- JeeSite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1.CVE-2025-7762 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing of the file /menu_nat_more.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015.CVE-2025-7758 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability classified as problematic was found in ZCMS 3.6.0.CVE-2025-7748 · Other software · reported by VulDBLow 2
A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article Page. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9.CVE-2025-7747 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. The manipulation of the argument PPW leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1.CVE-2025-7729 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file usersProfiles.shtm. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this issue and confirmed that it will be fixed in the upcoming release 2.8.0.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1.CVE-2025-7728 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. Affected is an unknown function of the file users.shtm. The manipulation of the argument Username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this issue and confirmed that it will be fixed in the upcoming release 2.8.0.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical.CVE-2025-7627 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue is the function fileUpload of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical.CVE-2025-7626 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this vulnerability is the function onlinePreview of the file /onlinePreview. The manipulation of the argument url leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd.CVE-2025-7625 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the function Download of the file /download. The manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, has been found in gmg137 snap7-rs up to 1.142.1.CVE-2025-7616 · Other software · gmg137 · reported by VulDBLow 2
A vulnerability, which was classified as critical, has been found in gmg137 snap7-rs up to 1.142.1. Affected by this issue is the function pthread_cond_destroy of the component Public API. The manipulation leads to memory corruption. The exploit has been disclosed to the public and may be used.
- Product
- snap7-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748.CVE-2025-7615 · Other software · TOTOLINK · reported by VulDBLow 2.1
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748.CVE-2025-7614 · Other software · TOTOLINK · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical.CVE-2025-7602 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /arp_sys.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical was found in Tenda AX1803 1.0.0.1.CVE-2025-7598 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda AX1803 1.0.0.1. Affected by this vulnerability is the function formSetWifiMacFilterCfg of the file /goform/setWifiFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AX1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical has been found in Tenda AX1803 1.0.0.1.CVE-2025-7597 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda AX1803 1.0.0.1. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AX1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical.CVE-2025-7576 · Other software · Teledyne · reported by VulDBMedium 5.5
A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical. Affected by this issue is some unknown functionality of the file /priv/production/production.html of the component Production Tools. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FLIR FB-Series O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical.CVE-2025-7575 · Other software · Zavy86 · reported by VulDBMedium 5.1
A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function image_drop_upload_ajax/image_delete_ajax of the file submit.php. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 1.0.78 is able to address this issue. The identifier of the patch is 98ea9ee4a2052c4327f89d2f7688cc1b5749450d. It is recommended to upgrade the affected component.
- Product
- WikiDocs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702.CVE-2025-7574 · Other software · LB-LINK · reported by VulDBHigh 8.9
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore of the file /cgi-bin/lighttpd.cgi of the component Web Interface. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC1900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 2025CVE-2025-7573 · Other software · LB-LINK · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This issue affects the function bs_GetManPwd in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC1900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702.CVE-2025-7572 · Other software · LB-LINK · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulnerability affects the function bs_GetHostInfo in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC1900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical has been found in UTT HiPER 840G up to 3.1.1-190328.CVE-2025-7571 · Other software · UTT · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in UTT HiPER 840G up to 3.1.1-190328. This affects an unknown part of the file /goform/aspApBasicConfigUrcp. The manipulation of the argument Username leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HiPER 840G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic.CVE-2025-7567 · Other software · reported by VulDBLow 2.1
A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic. This issue affects some unknown processing of the file header.html. The manipulation of the argument lang/system_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability has been found in jshERP up to 3.5 and classified as critical.CVE-2025-7566 · Other software · Jishenghua · reported by VulDBLow 2
A vulnerability has been found in jshERP up to 3.5 and classified as critical. This vulnerability affects the function exportExcelByParam of the file /src/main/java/com/jsh/erp/controller/SystemConfigController.java. The manipulation of the argument Title leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22.CVE-2025-7565 · Other software · LB-LINK · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22.CVE-2025-7564 · Other software · LB-LINK · reported by VulDBHigh 7.1
A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22. Affected by this issue is some unknown functionality of the file /etc/shadow. The manipulation with the input root:blinkadmin leads to hard-coded credentials. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability classified as problematic was found in Sapido RB-1802 1.0.32.CVE-2025-7554 · Network & remote access · Sapido · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in Sapido RB-1802 1.0.32. This vulnerability affects unknown code of the file urlfilter.asp of the component URL Filtering Page. The manipulation of the argument URL address leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- RB-1802
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215.CVE-2025-7553 · Network & remote access · D-Link · reported by VulDBLow 2
A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215. This affects an unknown part of the component System Time Page. The manipulation of the argument NTP Server leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-818LW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability was found in Tenda FH1201 1.2.0.14(408) and classified as critical.CVE-2025-7549 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda FH1201 1.2.0.14(408) and classified as critical. This issue affects the function frmL7ProtForm of the file /goform/L7Prot. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability has been found in Tenda FH1201 1.2.0.14(408) and classified as critical.CVE-2025-7548 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda FH1201 1.2.0.14(408) and classified as critical. This vulnerability affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45.CVE-2025-7546 · Other software · GNU · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Jul 13, 2025A vulnerability classified as problematic was found in GNU Binutils 2.45.CVE-2025-7545 · Other software · GNU · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Jul 13, 2025A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical.CVE-2025-7532 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408).CVE-2025-7531 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). This affects the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408).CVE-2025-7530 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function fromPptpUserAdd of the file /goform/PPTPDClient. The manipulation of the argument Username leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408).CVE-2025-7529 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408). Affected by this vulnerability is the function fromNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408).CVE-2025-7528 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability was found in Jinher OA 1.0 and classified as problematic.CVE-2025-7523 · Other software · Jinher · reported by VulDBMedium 5.5
A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability classified as critical was found in Tenda FH451 1.0.0.9.CVE-2025-7506 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatlimit of the file /goform/Natlimit of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9.CVE-2025-7505 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function frmL7ProtForm of the file /goform/L7Prot of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability has been found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical.CVE-2025-7488 · Other software · JoeyBling · reported by VulDBLow 2.1
A vulnerability has been found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical. This vulnerability affects the function Download of the file /file/download. The manipulation of the argument Name leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- SpringBoot_MyBatisPlus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26.CVE-2025-7487 · Other software · JoeyBling · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- SpringBoot_MyBatisPlus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.