Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,697 results · page 11 of 34
Sep 23, 2025The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process.CVE-2025-10548 · Other software · CleverControl · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.5
The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are executed with SYSTEM privileges. This can lead to full remote code execution with administrative rights. No patch is available as the vendor has been unresponsive. It is assumed that previous versions are also affected, but this is not confirmed.
- Product
- CleverControl employee monitoring software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Sep 22, 2025SEO Backlink Monitor: Server-Side Request Forgery (SSRF)CVE-2025-53457 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Server Side Request Forgery.This issue affects SEO Backlink Monitor: from n/a through <= 1.8.0.
- Product
- SEO Backlink Monitor
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update SEO Backlink Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025SEO Backlink Monitor: Cross-Site Request Forgery (CSRF)CVE-2025-53456 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Cross Site Request Forgery.This issue affects SEO Backlink Monitor: from n/a through <= 1.8.0.
- Product
- SEO Backlink Monitor
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update SEO Backlink Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2025Grafana is an open-source platform for monitoring and observability.CVE-2025-10630 · Other software · Grafana · reported by security@grafana.comMedium 4.3
Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via user-supplied regex query which could causes CPU usage to max out. This vulnerability is fixed in version 6.0.0.
- Product
- grafana-zabbix-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic.CVE-2025-58781 · Other software · Wireless Tsukamoto Co., Ltd. · reported by vultures@jpcert.or.jpMedium 6.3
WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic.
- Product
- WTW-EAGLE App for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58763 · Other software · Tautulli · reported by GitHubHigh 8
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to have been cloned from GitHub and installed manually. When Tautulli is cloned directly from GitHub and installed manually, the application manages updates and versioning through calls to the `git` command. In the code, this is performed through the `runGit` function in `versioncheck.py`. Since `shell=True` is passed to `subproces.Popen`, this call is vulnerable to subject to command injection, as shell characters within arguments will be passed to the underlying shell. A concrete location where this can be triggered is in the `checkout_git_branch` endpoint. This endpoint stores a user-supplied remote and branch name into the `GIT_REMOTE` and `GIT_BRANCH` configuration keys without sanitization. Downstream, these keys are then fetched and passed directly into `runGit` using a format string. Hence, code execution can be obtained by using `$()` interpolation in a command. Version 2.16.0 contain
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58762 · Other software · Tautulli · reported by GitHubCritical 9.1
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. This leads to remote code execution when combined with the `Script` notification agent. If an attacker with administrative access changes the URL of the PMS to a server they control, they can then abuse the `pms_image_proxy` to obtain a file write into the application filesystem. This can be done by making a `pms_image_proxy` request with a URL in the `img` parameter and the desired file name in the `img_format` parameter. Tautulli then uses a hash of the desired metadata together with the `img_format` in order to construct a file path. Since the attacker controls `img_format` which occupies the end of the file path, and `img_format` is not sanitised, the attacker can then use path traversal characters to specify filename of their choosing. If the specified file does not exist, Tautaulli will then attempt to fetch the image from the configured PMS. Since the attacker controls the PMS, they can return arbitrary content in response
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58761 · Other software · Tautulli · reported by GitHubHigh 8.6
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The `real_pms_image_proxy` is used to fetch an image directly from the backing Plex Media Server. The image to be fetched is specified through an `img` URL parameter, which can either be a URL or a file path. There is some validation ensuring that `img` begins with the prefix `interfaces/default/images` in order to be served from the local filesystem. However this can be bypassed by passing an `img` parameter which begins with a valid prefix, and then adjoining path traversal characters in order to reach files outside of intended directories. An attacker can exfiltrate files on the application file system, including the `tautulli.db` SQLite database containing active JWT tokens, as well as the `config.ini` file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. If the password is cracked, or if a valid JWT token is present in the database,
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Tautulli is a Python based monitoring and tracking tool for Plex Media Server.CVE-2025-58760 · Other software · Tautulli · reported by GitHubHigh 8.6
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the `/image` API endpoint is used to serve static images from the application's data directory to users. This endpoint can be accessed without authentication, and its intended purpose is for server background images and icons within the user interface. Attackers can exfiltrate files from the application file system, including the `tautulli.db` SQLite database containing active JWT tokens, as well as the `config.ini` file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. If the password is cracked, or if a valid JWT token is present in the database, an unauthenticated attacker can escalate their privileges to obtain administrative control over the application. Version 2.16.0 contains a fix for the issue.
- Product
- Tautulli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025WordPress Error Monitoring by Bugsnag: Cross-Site Request Forgery (CSRF)CVE-2025-58806 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Tom Longridge WordPress Error Monitoring by Bugsnag bugsnag allows Stored XSS.This issue affects WordPress Error Monitoring by Bugsnag: from n/a through <= 1.6.3.
- Product
- WordPress Error Monitoring by Bugsnag
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update WordPress Error Monitoring by Bugsnag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc.CVE-2025-58400 · Other software · RATOC Systems, Inc. · reported by vultures@jpcert.or.jpHigh 8.4
RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
- Product
- RATOC RAID Monitoring Manager for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpratocsystems.com
Sep 4, 2025In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy.CVE-2025-48560 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In monitor_hang, there is a possible memory corruption due to use after free.CVE-2025-20705 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.8
In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09989078; Issue ID: MSV-3964.
- Product
- MT2718, MT2735, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler.CVE-2009-20009 · Other software · Belkin International, Inc. · reported by VulnCheckCritical 9.3
Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially crafted HTTP request is sent with an oversized Authorization header, the application fails to properly validate the input length before copying it into a fixed-size buffer, resulting in memory corruption and potential remote code execution. Exploitation requires network access and does not require prior authentication.
- Product
- Bulldog Plus UPS Monitoring Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.coms3.belkin.com
Aug 28, 2025Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic.CVE-2025-58123 · Other software · Oetiker · reported by security@checkmk.comMedium 6.9
Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic.
- Product
- BGP Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025Simple Download Monitor: Time-based SQL InjectionCVE-2025-8977 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Download Monitor plugin for WordPress is vulnerable to time-based SQL Injection via the order parameter in all versions up to, and including, 3.9.33 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Simple Download Monitor
- Affected
- up to 3.9.33
- What to do
- Affects up to 3.9.33. Update Simple Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Aug 27, 2025Simple Download Monitor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58197 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Stored XSS.This issue affects Simple Download Monitor: from n/a through <= 3.9.34.
- Product
- Simple Download Monitor
- Affected
- up to 3.9.34
- What to do
- Affects up to 3.9.34. Update Simple Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2025A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated, rCVE-2025-20342 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid user credentials with privileges that allow for vKVM access on the affected device. Note: The affected vKVM client is also included in Cisco UCS Manager.
- Product
- Cisco Unified Computing System (Managed)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 27, 2025A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated,CVE-2025-20317 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.1
A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This vulnerability is due to insufficient verification of vKVM endpoints. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious webpage and potentially capture user credentials. Note: The affected vKVM client is also included in Cisco UCS Manager.
- Product
- Cisco Unified Computing System (Managed)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 22, 2025In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB.CVE-2025-6791 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7High 8.8
In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.This issue affects web: 24.10.0, 24.04.0, 23.10.0.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.com
Aug 22, 2025In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix WARN_ON for monitor mode on some devices On devices without WANT_MONITCVE-2025-38642 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix WARN_ON for monitor mode on some devices On devices without WANT_MONITOR_VIF (and probably without channel context support) we get a WARN_ON for changing the per-link setting of a monitor interface. Since we already skip AP_VLAN interfaces and MONITOR with WANT_MONITOR_VIF and/or NO_VIRTUAL_MONITOR should update the settings, catch this in the link change code instead of the warning.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 22, 2025In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors tracepoints Using DA monitors tracepoints with KASAN enableCVE-2025-38636 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200 trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0 This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g. the next automaton's data in this case). The error is harmless as, while printing the string, we stop at the null terminator, but it should still be fixed. Use the __string facilities while defining the tracepoints to avoid reading out of bound memory.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 20, 2025CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive fiCVE-2025-54927 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.9
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an autheCVE-2025-54926 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.2
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the applicatCVE-2025-54925 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially craftCVE-2025-54924 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated useCVE-2025-54923 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.7
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 18, 2025Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance.CVE-2025-55300 · Other software · komari-monitor · reported by GitHubHigh 8.6
Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. Prior to 1.0.4-fix1, WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users. Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution. This vulnerability is fixed in 1.0.4-fix1.
- Product
- komari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025librenms is a community-based GPL-licensed network monitoring system.CVE-2025-55296 · Other software · librenms · reported by GitHubMedium 5.5
librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template is rendered, potentially compromising other admin accounts. This vulnerability is fixed in 25.8.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2025A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804.CVE-2025-9099 · Other software · Acrel · reported by VulDBLow 2.1
A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNewsImg. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Environmental Monitoring Cloud Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability, which was classified as critical, was found in Dinstar Monitoring Platform 甘肃省危险品库监控平台 1.0.CVE-2025-8773 · Other software · Dinstar · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Dinstar Monitoring Platform 甘肃省危险品库监控平台 1.0. Affected is an unknown function of the file /itc/$%7BappPath%7D/login_getPasswordErrorNum.action. The manipulation of the argument userBean.loginName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Monitoring Platform 甘肃省危险品库监控平台
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms.CVE-2025-8284 · Other software · Packet Power · reported by ics-cert@hq.dhs.govCritical 9.3
By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users to access and manipulate monitoring and control functions.
- Product
- EMX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (rCVE-2025-53520 · Other software · EG4 Electronics · reported by ics-cert@hq.dhs.govHigh 8.6
The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the firmware is unencrypted and can be unpacked and altered without detection.
- Product
- EG4 12kPV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeg4electronics.comcisa.gov
Aug 8, 2025The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation.CVE-2025-52586 · Other software · EG4 Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write operations for voltage, current, and power configuration, operational status, alarms, telemetry, system reset, or inverter control commands, potentially disrupting power generation or reconfiguring inverter settings.
- Product
- EG4 12kPV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeg4electronics.comeg4electronics.com
Aug 6, 2025Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request.CVE-2025-51532 · Other software · Sagedpw · reported by MITREHigh 7.5
Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The vendor has stated that the issue is fixed in 2025_06_000, released in June 2025.
- Product
- Sage DPW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec4you-pentest.comsec4you-pentest.com
Aug 6, 2025IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking.CVE-2025-3354 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
- Product
- Tivoli Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking.CVE-2025-3320 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
- Product
- Tivoli Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`.CVE-2012-10029 · Other software · Nagios Enterprises · reported by VulnCheckHigh 8.6
Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.
- Product
- Nagios XI Graph Explorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsraw.githubusercontent.com
Aug 5, 2025Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead to a denial of servicCVE-2025-7674 · Other software · Roche Diagnostics · reported by 5cdcf916-2b10-4ec8-bfc1-d054821e439eHigh 7.1
Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead to a denial of service (DoS) due to negatively impacting the server's performance. This vulnerability has no impact on data confidentiality or integrity. This issue affects navify Monitoring before 1.08.00.
- Product
- navify Monitoring
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Grafana is an open-source platform for monitoring and observability.CVE-2025-8341 · Other software · Grafana · reported by security@grafana.comMedium 5
Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.
- Product
- grafana-infinity-datasource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.CVE-2025-45702 · Other software · Softperfect · reported by MITREMedium 6.5
SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.
- Product
- Connection Quality Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comsoftperfect.com
Jul 24, 2025Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no passworCVE-2025-4395 · Other software · Medtronic · reported by security@medtronic.comMedium 6.8
Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025
- Product
- MyCareLink Patient Monitor 24950
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files.CVE-2025-4394 · Other software · Medtronic · reported by security@medtronic.comMedium 6.8
Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025
- Product
- MyCareLink Patient Monitor 24950
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a biCVE-2025-4393 · Other software · Medtronic · reported by security@medtronic.comMedium 6.5
Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a binary payload to crash the service or elevate privileges. This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025
- Product
- MyCareLink Patient Monitor 24950
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor.CVE-2025-27930 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.4
Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor.
- Product
- Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems.CVE-2025-54138 · Other software · librenms · reported by GitHubHigh 7.5
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0.
- Product
- librenms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted CVE-2024-55040 · Other software · Sensaphone · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters.
- Product
- Web600 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsensaphone.com
Jul 21, 2025Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation.CVE-2025-4040 · Other software · Turpak · reported by iletisim@usom.gov.trHigh 7.1
Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects Automatic Station Monitoring System: before 5.0.6.51.
- Product
- Automatic Station Monitoring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 17, 2025Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URLCVE-2025-6185 · Other software · Leviton · reported by ics-cert@hq.dhs.govHigh 8.7
Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service.
- Product
- AcquiSuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Grafana is an open-source platform for monitoring and observability.CVE-2025-3415 · Other software · Grafana · reported by security@grafana.comMedium 4.3
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.