Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16,433 results · page 111 of 329
Sep 7, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-10073 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2025A vulnerability was found in Portabilis i-Educar up to 2.10.CVE-2025-10072 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.11.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described improper access control behavior could no longer be reproduced."
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2025A vulnerability has been found in Portabilis i-Educar up to 2.10.CVE-2025-10071 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 2.12 is able to resolve this issue. The name of the patch is d53365e5656f6499a4deddf89d522814655f769d. The affected component should be upgraded.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2025A flaw has been found in Portabilis i-Educar up to 2.10.CVE-2025-10070 · Other software · Portabilis · reported by VulDBLow 2.1
A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /enturmacao-em-lote/. This manipulation causes improper access controls. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 2.12 is able to mitigate this issue. Patch name: d53365e5656f6499a4deddf89d522814655f769d. You should upgrade the affected component.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidentiality, integrity, CVE-2025-0010 · Other software · AMD · reported by psirt@amd.comMedium 6.1
An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidentiality, integrity, or availability.
- Product
- AMD Radeon™ RX 5000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resulting in loss of integCVE-2023-31365 · Other software · AMD · reported by psirt@amd.comLow 3.9
An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area resulting in loss of integrity or availability.
- Product
- AMD Radeon™ RX 7000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted application (RAS TA)CVE-2023-31322 · Other software · AMD · reported by psirt@amd.comHigh 8.7
Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted application (RAS TA) potentially leading to a read or write to shared memory resulting in loss of confidentiality, integrity, or availability.
- Product
- AMD Radeon™ RX 7000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic power management (DCVE-2023-31306 · Other software · AMD · reported by psirt@amd.comLow 3.3
Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic power management (DPM) functions resulting in an out of bounds read and loss of availability.
- Product
- AMD Radeon™ RX 5000 Series Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025ELEX WooCommerce Google Shopping (Google Product Feed): SQL InjectionCVE-2025-10046 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- ELEX WooCommerce Google Shopping (Google Product Feed)
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update ELEX WooCommerce Google Shopping (Google Product Feed) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2025On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nordic Semiconductor nRCVE-2025-9709 · Other software · Nordic Semiconductor · reported by 1c6b5737-9389-4011-8117-89fa251edfb2High 8.6
On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nordic Semiconductor nRF52810 allow attacker to perform EM Fault Injection and bypass APPROTECT at runtime, requiring the least amount of modification to the hardware system possible.
- Product
- nRF52810
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govraelize.com
Sep 5, 2025In the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x800080CVE-2025-39685 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 5, 2025A vulnerability was detected in Portabilis i-Educar up to 2.10.CVE-2025-10013 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.12 mitigates this issue. The patch is named d53365e5656f6499a4deddf89d522814655f769d. You should upgrade the affected component.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025A security vulnerability has been detected in Portabilis i-Educar up to 2.10.CVE-2025-10012 · Other software · Portabilis · reported by VulDBLow 2.1
A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 is sufficient to resolve this issue. It is advisable to upgrade the affected component. The vendor confirms, that "[t]he reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced".
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Woocommerce Gifts Product: Cross-Site Request Forgery (CSRF)CVE-2025-58878 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in usamafarooq Woocommerce Gifts Product woo-gift-product allows Cross Site Request Forgery.This issue affects Woocommerce Gifts Product: from n/a through <= 1.0.0.
- Product
- Woocommerce Gifts Product
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Gifts Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Woocommerce Notify Updated Product: Cross-Site Request Forgery (CSRF)CVE-2025-58856 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Notify Updated Product woocommerce-notify-updated-product allows Stored XSS.This issue affects Woocommerce Notify Updated Product: from n/a through <= 1.6.
- Product
- Woocommerce Notify Updated Product
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Woocommerce Notify Updated Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Product Carousel Slider for Elementor: Missing AuthorizationCVE-2025-58816 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Carousel Slider for Elementor: from n/a through <= 2.1.3.
- Product
- Product Carousel Slider for Elementor
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Product Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ibtana – Ecommerce Product Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58786 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons allows DOM-Based XSS.This issue affects Ibtana – Ecommerce Product Addons: from n/a through <= 0.4.7.6.
- Product
- Ibtana – Ecommerce Product Addons
- Affected
- up to 0.4.7.6
- What to do
- Affects up to 0.4.7.6. Update Ibtana – Ecommerce Product Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025A weakness has been identified in Portabilis i-Educar up to 2.10.CVE-2025-10011 · Other software · Portabilis · reported by VulDBLow 2.1
A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArredondamento/edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent.CVE-2025-32347 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 4, 2025In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valiCVE-2025-38715 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2025In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that endCVE-2025-38710 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - dip->i_depth); As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time. So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there. Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated. Tested with the syzkaller repro.c and xfstests '-g quick'.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2025In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer wheCVE-2025-38709 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size. Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2025In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a nCVE-2025-38698 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2025NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potentially disclosing infCVE-2025-23261 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potentially disclosing information to unauthorized users.
- Product
- NVOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govnvidia.custhelp.com
Sep 4, 2025In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow.CVE-2025-36906 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025There is a possible escalation of privilege due to test/debugging code left in a production build.CVE-2025-36899 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 8.4
There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Sitecore Multiple Products Deserialization of Untrusted Data VulnerabilityCVE-2025-53690 · Other software · Sitecore · reported by 9947ef80-c5d5-474a-bbab-97341a59000eExploitedCritical 9
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the use of default machine keys. This flaw allows attackers to exploit exposed ASP.NET machine keys to achieve remote code execution.
- Product
- Multiple Products
- On CISA’s list since
- Sep 4, 2025 (federal fix deadline Sep 25, 2025)
- What to do
- Attackers are using this now. Install Sitecore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogcloud.google.comsupport.sitecore.com
Sep 3, 2025A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a crosCVE-2025-20328 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed. This vulnerability existed because of insufficient validation of user-supplied input to the user profile component of Cisco Webex Meetings. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could have allowed the attacker to conduct an XSS attack against the targeted user.
- Product
- Cisco Webex Meetings
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Sep 3, 2025SummaryUsers with webhook permissions can conduct SSRF via webhooks.CVE-2025-9821 · Other software · Mautic · reported by security@mautic.orgLow 2.7
SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact. Resources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix.
- Product
- Mautic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A weakness has been identified in Portabilis i-Educar up to 2.10.CVE-2025-9760 · Other software · Portabilis · reported by VulDBLow 2.1
A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A flaw has been found in Portabilis i-Educar up to 2.10.CVE-2025-9738 · Other software · Portabilis · reported by VulDBLow 2
A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_tipo_ensino_cad.php. Executing manipulation of the argument nm_tipo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 31, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-9724 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was determined in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /intranet/educar_nivel_ensino_cad.php. Executing manipulation of the argument nm_nivel/descricao can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability was found in Portabilis i-Educar up to 2.10.CVE-2025-9723 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_regime_cad.php. Performing manipulation of the argument nm_tipo results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 31, 2025A vulnerability has been found in Portabilis i-Educar up to 2.10.CVE-2025-9722 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability has been found in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_tipo_ocorrencia_disciplinar_cad.php. Such manipulation of the argument nm_tipo/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 31, 2025A flaw has been found in Portabilis i-Educar up to 2.10.CVE-2025-9721 · Other software · Portabilis · reported by VulDBLow 2
A flaw has been found in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/FormulaMedia/edit. This manipulation of the argument nome/formulaMedia causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 31, 2025A vulnerability was detected in Portabilis i-Educar up to 2.10.CVE-2025-9720 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edit of the component Cadastrar tabela de arredondamento Page. The manipulation of the argument Nome results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 30, 2025A weakness has been identified in Portabilis i-Educar up to 2.10.CVE-2025-9687 · Other software · Portabilis · reported by VulDBLow 2.1
A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/HistoricoEscolar/processamentoApi. Executing manipulation can lead to improper authorization. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A security flaw has been discovered in Portabilis i-Educar up to 2.10.CVE-2025-9686 · Other software · Portabilis · reported by VulDBLow 2.1
A security flaw has been discovered in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/AreaConhecimento/edit of the component Listagem de áreas de conhecimento Page. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A vulnerability was identified in Portabilis i-Educar up to 2.10.CVE-2025-9685 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was identified in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/AreaConhecimento/view of the component Listagem de áreas de conhecimento Page. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-9684 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was determined in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/edit of the component Formula de Cálculo de Média Page. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2025-55202 · Other software · opencast · reported by GitHubLow 2.7
Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A vulnerability was identified in Portabilis i-Educar up to 2.10.CVE-2025-9653 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_projeto_cad.php of the component Cadastrar projeto Page. Such manipulation of the argument nome/observacao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 29, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-9652 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of the component Cadastrar tipo de transferência Page. This manipulation of the argument nm_tipo/desc_tipo causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 29, 2025Uncaught exception issue exists in Multiple products in bizhub series.CVE-2025-54777 · Other software · Konica Minolta, Inc. · reported by vultures@jpcert.or.jpMedium 5.3
Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it may cause a denial-of-service issue that disable the Web Connection feature.
- Product
- Multiple products in bizhub series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkonicaminolta.jp
Aug 29, 2025Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability.CVE-2025-53508 · Other software · iND Co.,Ltd · reported by vultures@jpcert.or.jpHigh 8.6
Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed and sensitive information may be obtained. As for the details of affected product names and versions, refer to the information under [Product Status].
- Product
- HL330-DLS (for module MC7700)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability.CVE-2025-53507 · Other software · iND Co.,Ltd · reported by vultures@jpcert.or.jpHigh 7.1
Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploited, configuration information, such as admin password, may be disclosed. As for the details of affected product names and versions, refer to the information under [Product Status].
- Product
- HL330-DLS (for module MC7700)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A vulnerability was found in Portabilis i-Educar up to 2.10.CVE-2025-9609 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results in improper authorization. The attack can be executed remotely. The exploit has been made public and could be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A vulnerability has been found in Portabilis i-Educar up to 2.10.CVE-2025-9608 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A flaw has been found in Portabilis i-Educar up to 2.10.CVE-2025-9607 · Other software · Portabilis · reported by VulDBLow 2.1
A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A vulnerability was detected in Portabilis i-Educar up to 2.10.CVE-2025-9606 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing a manipulation of the argument cod_agenda results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.12 addresses this issue. Upgrading the affected component is advised. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced."
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.