Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,525entries in the database

1,001 results · page 10 of 21

Apr 16, 2025Integration for WooCommerce and QuickBooks: Cross-Site Request Forgery (CSRF)CVE-2025-39600 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cross Site Request Forgery.This issue affects Integration for WooCommerce and QuickBooks: from n/a through <= 1.3.1.
Product
Integration for WooCommerce and QuickBooks
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Integration for WooCommerce and QuickBooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Hydra is a Continuous Integration service for Nix based projects.CVE-2025-32435 · Other software · NixOS · reported by GitHubLow 2.6
Hydra is a Continuous Integration service for Nix based projects. Evaluation of untrusted non-flake nix code could potentially access secrets that are accessible by the hydra user/group. This should not affect the signing keys, that are owned by the hydra-queue-runner and hydra-www users respectively.
Product
hydra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 10, 2025Linet ERP-Woocommerce Integration: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31411 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Path Traversal.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.12.
Product
Linet ERP-Woocommerce Integration
Affected
up to 3.5.12
What to do
Affects up to 3.5.12. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Privyr CRM Integration: Missing AuthorizationCVE-2025-32224 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shivam Mani Tripathi Privyr CRM Integration privy-crm-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Privyr CRM Integration: from n/a through <= 1.0.2.
Product
Privyr CRM Integration
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Privyr CRM Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Privilege EscalationCVE-2025-2075 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.
Product
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
Affected
up to 6.3.0.2
What to do
Affects up to 6.3.0.2. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 3, 2025The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin).CVE-2025-31487 · Other software · xwiki-contrib · reported by GitHubHigh 7.7
The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file's content in one of the returned JIRA fields (such as the summary or description for example). The vulnerability has been patched in the JIRA Extension v8.6.5.
Product
jira
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 1, 2025Perfect Font Awesome Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31861 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPOrbit Support Perfect Font Awesome Integration perfect-font-awesome-integration allows Stored XSS.This issue affects Perfect Font Awesome Integration: from n/a through <= 2.3.
Product
Perfect Font Awesome Integration
Affected
up to 2.3
What to do
Affects up to 2.3. Update Perfect Font Awesome Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Viral Loops WP Integration: Insertion of Sensitive Information Into Sent DataCVE-2025-31842 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Retrieve Embedded Sensitive Data.This issue affects Viral Loops WP Integration: from n/a through <= 3.4.0.
Product
Viral Loops WP Integration
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Viral Loops WP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Integration of Zoho CRM and Contact Form 7: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-31821 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integration of Zoho CRM and Contact Form 7 allows Phishing. This issue affects Integration of Zoho CRM and Contact Form 7: from n/a through 1.0.6.
Product
Integration of Zoho CRM and Contact Form 7
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Integration of Zoho CRM and Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP Modal Popup with Cookie Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31772 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Stored XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a through <= 2.4.
Product
WP Modal Popup with Cookie Integration
Affected
up to 2.4
What to do
Affects up to 2.4. Update WP Modal Popup with Cookie Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Bit Integrations: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30884 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Integrations bit-integrations allows Phishing.This issue affects Bit Integrations: from n/a through <= 2.4.10.
Product
Bit Integrations
Affected
up to 2.4.10
What to do
Affects up to 2.4.10. Update Bit Integrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2025-30863 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-contact-form-7-and-google-sheets allows Cross Site Request Forgery.This issue affects Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.0.9.
Product
Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Custom Script Integration: Cross-Site Request Forgery (CSRF)CVE-2025-30564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script Integration: from n/a through <= 2.1.
Product
Custom Script Integration
Affected
up to 2.1
What to do
Affects up to 2.1. Update Custom Script Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 12, 2025Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Server-Side Request ForgeryCVE-2024-13838 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.2 via the 'call_webhook' method of the Automator_Send_Webhook class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
Affected
up to 6.2
What to do
Affects up to 6.2. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2025Rankchecker.io Integration: Cross-Site Request Forgery (CSRF)CVE-2025-28857 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankchecker.io Integration: from n/a through <= 1.0.9.
Product
Rankchecker.io Integration
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Rankchecker.io Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to eCVE-2025-24049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to elevate privileges locally.
Product
Azure CLI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Mar 9, 2025Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g.CVE-2024-43107 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 7.2
Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin. This issue effects Gallagher MIPS Plugin v4.0 prior to v4.0.32, all versions of v3.0 and prior.
Product
Milestone Integration Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.gallagher.com
Mar 9, 2025Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server.CVE-2024-41724 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 8.7
Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affects all versions of Gallagher Command Centre prior to 9.20.1043.
Product
Command Centre Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.gallagher.com
Mar 5, 2025Spreadsheet Integration: Cross-Site Request ForgeryCVE-2025-1463 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improper nonce validation within the class-wpgsi-show.php script. This makes it possible for unauthenticated attackers to publish arbitrary posts, including private, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Spreadsheet Integration
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Spreadsheet Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2025LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server.CVE-2025-1080 · Other software · The Document Foundation · reported by security@documentfoundation.orgHigh 7.2
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.
Product
LibreOffice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record libreoffice.org lists.debian.org
Mar 4, 2025A flaw was found in Wildfly Elytron integration.CVE-2025-23368 · Other software · Red Hat · reported by Red HatHigh 8.1
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
Product
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Feb 28, 2025BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages: Unauthorized accessCVE-2025-1780 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.25. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
Product
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Affected
up to 3.4.25
What to do
Affects up to 3.4.25. Update BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages: Unauthorized accessCVE-2024-13358 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
Product
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Affected
up to 3.4.24
What to do
Affects up to 3.4.24. Update BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025WHMpress - WHMCS WordPress Integration: Local File InclusionCVE-2024-9193 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpress_domain_search_ajax_extended_results() function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. Utilizing the /admin/services.php file, this can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WHMpress - WHMCS WordPress Integration
Affected
up to 6.3-revision-0
What to do
Affects up to 6.3-revision-0. Update WHMpress - WHMCS WordPress Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record whmpress.com wordfence.com
Feb 19, 2025The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions.CVE-2024-6697 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.5
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service. An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a sysCVE-2024-6696 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.9
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. (CWE-1220) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not correctly perform an authorization check in the user console trash content An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025The product does not perform an authorization check when an actor attempts to access a resource or perform an action.CVE-2024-37363 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.5
The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source management service. When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.CVE-2024-37362 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.3
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. (CWE-522) Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, discloses database passwords when saving connections to RedShift. Products must not disclose sensitive information without cause. Disclosure of sensitive information can lead to further exploitation.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.CVE-2024-37361 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comCritical 9.9
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods. When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resoCVE-2024-5706 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not restrict JNDI identifiers during the creation of Community Dashboards, allowing control of system-level data sources. An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.CVE-2024-5705 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. (CWE-863) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, have modules enabled by default that allow execution of system level processes. When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software dCVE-2024-37360 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 4.4
Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79) Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.0 and 9.3.0.9, including 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface. Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 19, 2025The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that theCVE-2024-37359 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.6
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (CWE-918) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not validate the Host header of incoming HTTP/HTTPS requests. By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
Product
Pentaho Data Integration & Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pentaho.com
Feb 6, 2025Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScriCVE-2025-0982 · Computers, phones & browsers · Google Cloud · reported by cve-coordination@google.comCritical 9.4
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.
Product
Application Integration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cloud.google.com
Feb 3, 2025DigiTimber cPanel Integration: Cross-Site Request Forgery (CSRF)CVE-2025-22690 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects DigiTimber cPanel Integration: from n/a through <= 1.4.6.
Product
DigiTimber cPanel Integration
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update DigiTimber cPanel Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 31, 2025Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.CVE-2024-53007 · Other software · Bentley · reported by MITREMedium 6.4
Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.
Product
ProjectWise Integration Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bentley.com
Jan 29, 2025The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach tCVE-2024-23733 · Other software · reported by MITREHigh 7.5
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jan 24, 2025Linet ERP-Woocommerce Integration: Missing AuthorizationCVE-2025-24594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.7.
Product
Linet ERP-Woocommerce Integration
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2025Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any tarCVE-2025-24398 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
Product
Jenkins Bitbucket Server Integration Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io
Jan 21, 2025Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services).CVE-2025-21564 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile PLM Framework. CVSS 3.1 Base Score 8.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).
Product
Oracle Agile PLM Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jan 21, 2025Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services).CVE-2025-21556 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. While the vulnerability is in Oracle Agile PLM Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM Framework. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Product
Oracle Agile PLM Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Jan 21, 2025In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integrationCVE-2025-24458 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
Product
YouTrack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Jan 16, 2025MercadoLibre Integration: Cross-Site Request Forgery (CSRF)CVE-2025-23659 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hernanjh MercadoLibre Integration mercadolibre-integration allows Stored XSS.This issue affects MercadoLibre Integration: from n/a through <= 1.1.
Product
MercadoLibre Integration
Affected
up to 1.1
What to do
Affects up to 1.1. Update MercadoLibre Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21335 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21334 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com cisa.gov
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityCVE-2025-21333 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jan 14, 2025 (federal fix deadline Feb 4, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com exploit-db.com
Jan 11, 2025Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently |: Stored Cross-Site ScriptingCVE-2024-12412 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘active_tab’ parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently |
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2025Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.CVE-2024-13290 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.
Product
OhDear Integration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Jan 9, 2025S3Player – WooCommerce & Elementor Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22818 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration drm-protected-video-streaming allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor Integration: from n/a through <= 4.2.1.
Product
S3Player – WooCommerce & Elementor Integration
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update S3Player – WooCommerce & Elementor Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Advanced Form Integration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56293 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Stored XSS.This issue affects Advanced Form Integration: from n/a through <= 1.95.0.
Product
Advanced Form Integration
Affected
up to 1.95.0
What to do
Affects up to 1.95.0. Update Advanced Form Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.