Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,369 results · page 105 of 348
Nov 3, 2025A use-after-free issue was addressed with improved memory management.CVE-2025-43457 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 3, 2025This issue was addressed through improved state management.CVE-2025-43454 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. A device may persistently fail to lock.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 3, 2025A use-after-free issue was addressed with improved memory management.CVE-2025-43438 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 3, 2025A use-after-free issue was addressed with improved memory management.CVE-2025-43434 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 3, 2025A use-after-free issue was addressed with improved memory management.CVE-2025-43432 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 3, 2025This issue was addressed through improved state management.CVE-2025-43430 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 3, 2025This issue was addressed through improved state management.CVE-2025-43427 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 3, 2025A logic issue was addressed with improved state management.CVE-2025-43376 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Nov 3, 2025Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet,CVE-2025-34501 · Other software · Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. · reported by VulnCheckHigh 7
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.
- Product
- Deck Mate 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordioactive.comvulncheck.com
Nov 3, 2025Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent CVE-2025-8558 · Other software · Proofpoint · reported by security@proofpoint.comLow 2.3
Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit. Successful exploitation prevents the server from receiving new events from affected agents, resulting in a partial loss of integrity and availability with no impact to confidentiality.
- Product
- Insider Threat Management (ITM) Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php.CVE-2025-63449 · Other software · Water Management System Project · reported by MITREMedium 5.4
Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php.
- Product
- Water Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1.CVE-2025-63448 · Other software · Water Management System Project · reported by MITREMedium 6.1
Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1.
- Product
- Water Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php.CVE-2025-63447 · Other software · Water Management System Project · reported by MITREMedium 6.1
Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php.
- Product
- Water Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php.CVE-2025-63446 · Other software · Water Management System Project · reported by MITREMedium 6.1
Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php.
- Product
- Water Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during theCVE-2025-11761 · Other software · HP Inc · reported by hp-security-alert@hp.comHigh 8.5
A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during the installation process. HP is releasing software updates to mitigate the potential vulnerability.
- Product
- HP Client Management Script Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter.CVE-2025-63443 · Other software · School Management System PHP Project · reported by MITREMedium 5.4
School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter.
- Product
- School Management System PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section.CVE-2025-63442 · Other software · Nababur · reported by MITREMedium 4.6
Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser
- Product
- Simple-user-management-system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2025A vulnerability was determined in CodeAstro Gym Management System 1.0.CVE-2025-12610 · Other software · CodeAstro · reported by VulDBLow 2
A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Nov 2, 2025A vulnerability was found in CodeAstro Gym Management System 1.0.CVE-2025-12609 · Other software · CodeAstro · reported by VulDBLow 2
A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. Performing a manipulation of the argument id/ini_weight results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 31, 2025Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change.CVE-2025-63563 · Other software · Summerpearlgroup · reported by MITREMedium 6.5
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.
- Product
- Vacation Rental Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization.CVE-2025-63562 · Other software · Summerpearlgroup · reported by MITREMedium 6.3
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by arbitrary users by manipulating request parameters (e.g., owner or resource id).
- Product
- Vacation Rental Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connectiCVE-2025-63561 · Other software · Summerpearlgroup · reported by MITREHigh 7.5
Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server’s connection pool and worker capacity, preventing legitimate users and APIs from accessing the service.
- Product
- Vacation Rental Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies.CVE-2025-36249 · Other software · IBM · reported by psirt@us.ibm.comLow 3.7
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
- Product
- Jazz for Service Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a manageCVE-2025-52665 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 10
A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. Affected Products: UniFi Access Application (Version 3.3.22 through 3.4.31). Mitigation: Update your UniFi Access Application to Version 4.0.21 or later.
- Product
- UniFi Access Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal opCVE-2025-34280 · Other software · Nagios · reported by VulnCheckHigh 8.6
Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web application service, resulting in remote code execution with the service's privileges.
- Product
- Network Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and EdiCVE-2020-36865 · Other software · Nagios · reported by VulnCheckMedium 5.1
Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Edit Config page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitraCVE-2025-63422 · Other software · reported by MITREHigh 7.5
Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitrarily change the administrator username and password via sending a crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Statmatic is a Laravel and Git powered content management system (CMS).CVE-2025-64112 · Other software · statamic · reported by GitHubHigh 8
Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.
- Product
- cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers to inject arbitrary CVE-2025-50574 · Other software · Hiruna · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers to inject arbitrary web script or HTML via the blog comment section parameter.
- Product
- Glamour Salon Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 29, 2025CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2025-64100 · Other software · ckan · reported by GitHubMedium 6.1
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2025-54384 · Other software · ckan · reported by GitHubMedium 6.3
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4.
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-64095 · Other software · dnnsoftware · reported by GitHubCritical 10
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files allowing defacing a website and combined with other issue, injection XSS payloads. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-64094 · Other software · dnnsoftware · reported by GitHubMedium 6.4
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, sanitization of the content of uploaded SVG files was not covering all possible XSS scenarios. This vulnerability exists because of an incomplete fix for CVE-2025-48378. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-62802 · Other software · dnnsoftware · reported by GitHubMedium 4.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025Sharp is a content management framework built for Laravel as a package.CVE-2025-62798 · Other software · code16 · reported by GitHubMedium 5.4
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
- Product
- sharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025Taiga is an open source project management platform.CVE-2025-62368 · Other software · taigaio · reported by GitHubCritical 9
Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.
- Product
- taiga-back
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025HP ThinPro 8.1 System management application failed to verify user's true id.CVE-2025-43017 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 8.5
HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.
- Product
- HP ThinPro 8.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025Taiga is an open source project management platform.CVE-2025-62367 · Other software · taigaio · reported by GitHubMedium 4.8
Taiga is an open source project management platform. In versions 6.8.3 and earlier, Taiga API is vulnerable to time-based blind SQL injection allowing sensitive data disclosure via response timing. This issue is fixed in version 6.9.0.
- Product
- taiga-back
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025Frappe Learning is a learning management system.CVE-2025-62778 · Other software · frappe · reported by GitHubLow 1.3
Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025ImageMagick is a software suite to create, edit, compose, or convert bitmap images.CVE-2025-62594 · Other software · ImageMagick · reported by GitHubMedium 4.7
ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4.CVE-2025-12288 · Other software · Bdtask · reported by VulDBLow 2.1
A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User Profile Handler. Performing manipulation results in authorization bypass. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Pharmacy Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A security vulnerability has been detected in Bdtask Wholesale Inventory Control and Inventory Management System up to 20251013.CVE-2025-12287 · Other software · Bdtask · reported by VulDBLow 2
A security vulnerability has been detected in Bdtask Wholesale Inventory Control and Inventory Management System up to 20251013. This impacts an unknown function of the file /Admin_dashboard/edit_profile. Such manipulation of the argument first_name/last_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Wholesale Inventory Control and Inventory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to eCVE-2025-61481 · Other software · reported by MITRECritical 10
An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.mikrotik.comhelp.mikrotik.com
Oct 27, 2025A vulnerability was found in CodeAstro Gym Management System 1.0.CVE-2025-12261 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 27, 2025Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execCVE-2025-11682 · Other software · Perx Technologies · reported by vulnerability@ncsc.chHigh 7.1
Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can upload a malicious SVG file containing a script payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can lead to session hijacking, data theft, or other unauthorized actions.This issue affects Customer Engagement & Loyalty Platform before 4.617.4.
- Product
- Customer Engagement & Loyalty Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability has been found in CodeAstro Gym Management System 1.0.CVE-2025-12242 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/check-attendance.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Oct 26, 2025Admin Management Xtended: Missing AuthorizationCVE-2025-62965 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin Management Xtended : from n/a through <= 2.5.1.
- Product
- Admin Management Xtended
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Admin Management Xtended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1.CVE-2025-12202 · Other software · ajayrandhawa · reported by VulDBLow 2.1
A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- User-Management-PHP-MYSQL web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2025A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1.CVE-2025-12201 · Other software · ajayrandhawa · reported by VulDBLow 2
A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- User-Management-PHP-MYSQL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2025An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a CVE-2025-4106 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 8.9
An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and version-specific diagnostic package and executing a leftover diagnostic command.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.