Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16,433 results · page 113 of 329
Aug 5, 2025A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10.CVE-2025-8543 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php. The manipulation of the argument nm_raca leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 5, 2025A vulnerability was found in Portabilis i-Educar 2.10.CVE-2025-8542 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the argument fantasia/razao_social leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 4, 2025A vulnerability was found in Portabilis i-Educar 2.10.CVE-2025-8541 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/public_uf_cad.php. The manipulation of the argument nome leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 4, 2025A vulnerability was found in Portabilis i-Educar 2.10.CVE-2025-8540 · Other software · Portabilis · reported by VulDBLow 1.9
A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iovuldb.com
Aug 4, 2025A weakness has been identified in Portabilis i-Educar 2.10.CVE-2025-8539 · Other software · Portabilis · reported by VulDBLow 1.9
A weakness has been identified in Portabilis i-Educar 2.10. This affects an unknown function of the file /intranet/public_distrito_cad.php. This manipulation of the argument nome causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.12 mitigates this issue. It is recommended to upgrade the affected component. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkarinagante.github.io
Aug 4, 2025A security flaw has been discovered in Portabilis i-Educar 2.10.CVE-2025-8538 · Other software · Portabilis · reported by VulDBLow 1.9
A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation of the argument name/description results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.12 is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor explains, that "[t]he reported attack vector was tested against the corrected version, and the previously described XSS behavior could no longer be reproduced".
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkarinagante.github.io
Aug 4, 2025Certain Draytek products are affected by Insecure Configuration.CVE-2025-44643 · Other software · reported by MITREHigh 8.6
Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.CVE-2025-8109 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 8.8
Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.CVE-2025-41658 · Other software · CODESYS · reported by info@cert.vde.comMedium 5.5
CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
- Product
- Runtime Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2025A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10.CVE-2025-8510 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2025A vulnerability was found in Portabilis i-Educar 2.9.CVE-2025-8509 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_cad.php. The manipulation of the argument matricula leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2025A vulnerability was found in Portabilis i-Educar 2.9.CVE-2025-8508 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_avaliacao_desempenho_cad.php. The manipulation of the argument titulo_avaliacao/descricao leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2025A vulnerability was found in Portabilis i-Educar 2.9.CVE-2025-8507 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account aCVE-2025-6077 · Other software · Partner Software · reported by cret@cert.orgCritical 9.8
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions.
- Product
- Partner Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpartnersoftware.comkb.cert.org
Aug 1, 2025IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirCVE-2025-2824 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
- Product
- Operational Decision Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate dCVE-2025-8286 · Other software · Güralp Systems · reported by ics-cert@hq.dhs.govCritical 9.3
The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.
- Product
- Güralp FMUS Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025Cross-site scripting vulnerability has been identified in HPE Telco Service Activator productCVE-2025-37109 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comLow 3.5
Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product
- Product
- HPE Telco Service Activator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025Cross-site scripting vulnerability has been identified in HPE Telco Service Activator productCVE-2025-37108 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comLow 3.5
Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product
- Product
- HPE Telco Service Activator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request.CVE-2025-50847 · Other software · Cs-cart · reported by MITREMedium 6.5
Cross Site Request Forgery (CSRF) vulnerability in CS Cart 4.18.3, allows attackers to add products to a user's comparison list via a crafted HTTP request.
- Product
- Cs-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.CVE-2025-8370 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9. Affected is an unknown function of the file /intranet/educar_escolaridade_lst.php. The manipulation of the argument descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.CVE-2025-8369 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9. This issue affects some unknown processing of the file /intranet/educar_avaliacao_desempenho_lst.php. The manipulation of the argument titulo_avaliacao leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability classified as problematic was found in Portabilis i-Educar 2.9.CVE-2025-8368 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_lst.php. The manipulation of the argument campo_busca/cpf leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9.CVE-2025-8367 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9. This affects an unknown part of the file /intranet/funcionario_vinculo_lst.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability was found in Portabilis i-Educar 2.9.CVE-2025-8366 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_lst.php. The manipulation of the argument nome/matricula_servidor leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A vulnerability was found in Portabilis i-Educar 2.10.CVE-2025-8365 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file atendidos_cad.php. The manipulation of the argument nome/nome_social/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10.CVE-2025-8346 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /educar_aluno_lst.php. The manipulation of the argument ref_cod_matricula with the input "><img%20src=x%20onerror=alert(%27CVE-Hunters%27)> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025Apple Multiple Products Buffer Overflow VulnerabilityCVE-2025-31277 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedHigh 8.8
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
- Product
- Multiple Products
- On CISA’s list since
- Mar 20, 2026 (federal fix deadline Apr 3, 2026)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsupport.apple.comsupport.apple.com
Jul 29, 2025A maliciously crafted 3DM file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability.CVE-2025-7675 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted 3DM file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
- Product
- Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 29, 2025A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability.CVE-2025-7497 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
- Product
- Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 29, 2025A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability.CVE-2025-6637 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
- Product
- Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 29, 2025A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability.CVE-2025-6636 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- Product
- Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 29, 2025A maliciously crafted PRT file, when linked or imported into certain Autodesk products, can force an Out-of-Bounds Read vulnerability.CVE-2025-6635 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PRT file, when linked or imported into certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- Product
- Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 29, 2025A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability.CVE-2025-6631 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
- Product
- Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 29, 2025A maliciously crafted 3DM file, when linked or imported into certain Autodesk products, can force a Heap-Based Overflow vulnerability.CVE-2025-5043 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted 3DM file, when linked or imported into certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
- Product
- Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 29, 2025A maliciously crafted X_T file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability.CVE-2025-5038 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted X_T file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
- Product
- Shared Components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Jul 28, 2025OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device fiCVE-2025-53695 · Other software · Johnson Controls, Inc · reported by ot-cert@dragos.comCritical 9.4
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
- Product
- iSTAR Ultra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Jul 26, 2025Educenter: Stored Cross-Site ScriptingCVE-2025-5529 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Educenter
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Educenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Jul 26, 2025Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2025-54380 · Other software · opencast · reported by GitHubMedium 6.5
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2025Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print CVE-2025-3508 · Other software · HP Inc. · reported by hp-security-alert@hp.comMedium 6
Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print job information.
- Product
- Certain HP DesignJet products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac.CVE-2025-22165 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.9
This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives . You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives . This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE).
- Product
- Sourcetree for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A vulnerability has been found in Dahua products.CVE-2025-31701 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comHigh 8.1
A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.
- Product
- IPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025A vulnerability has been found in Dahua products.CVE-2025-31700 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comHigh 8.1
A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending specially crafted malicious packets, potentially causing service disruption (e.g., crashes) or remote code execution (RCE). Some devices may have deployed protection mechanisms such as Address Space Layout Randomization (ASLR), which reduces the likelihood of successful RCE exploitation. However, denial-of-service (DoS) attacks remain a concern.
- Product
- IPC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI.CVE-2025-53528 · Other software · zmievsa · reported by GitHubHigh 7.6
Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. This XSS would notably allow an attacker to execute JavaScript code on a user's session for any application based on Cadwyn via a one-click attack. The vulnerability has been fixed in version 5.4.3.
- Product
- cadwyn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in TDuckCloud tduck-platform 5.1 and classified as critical.CVE-2025-7888 · Other software · TDuckCloud · reported by VulDBLow 2.1
A vulnerability was found in TDuckCloud tduck-platform 5.1 and classified as critical. This issue affects the function UserFormDataMapper of the file src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java. The manipulation of the argument formKey leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- tduck-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0.CVE-2025-7869 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file intranet/educar_turma_tipo_det.php?cod_turma_tipo=ID of the component Turma Module. The manipulation of the argument nm_tipo leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in Portabilis i-Educar up to 2.10.CVE-2025-7868 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad.php of the component Calendar Module. The manipulation of the argument Motivo/descricao results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0.CVE-2025-7867 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component Agenda Module. The manipulation of the argument novo_titulo/novo_descricao leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in Portabilis i-Educar 2.9.0.CVE-2025-7866 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Educar 2.9.0. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/educar_deficiencia_lst.php of the component Disabilities Module. The manipulation of the argument Deficiência ou Transtorno leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-sCVE-2025-20288 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.
- Product
- Cisco Unified Contact Center Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jul 16, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47645 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.
- Product
- ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.