Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,612 results · page 12 of 73
Jan 23, 2026SiteLock Security – WP Hardening, Login Security & Malware Scans: Missing AuthorizationCVE-2026-24532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through <= 5.0.2.
- Product
- SiteLock Security – WP Hardening, Login Security & Malware Scans
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update SiteLock Security – WP Hardening, Login Security & Malware Scans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Registration & Login with Mobile Phone Number for WooCommerce: Missing AuthorizationCVE-2025-69052 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registration & Login with Mobile Phone Number for WooCommerce: from n/a through <= 1.3.1.
- Product
- Registration & Login with Mobile Phone Number for WooCommerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Registration & Login with Mobile Phone Number for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2026Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter.CVE-2021-47848 · Other software · satndy · reported by VulnCheckHigh 8.8
Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter. Attackers can manipulate the login request by sending a crafted username with SQL injection techniques to gain unauthorized administrative access.
- Product
- Aplikasi-Biro-Travel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 21, 2026Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers CVE-2021-47846 · Other software · I Want Source Codes · reported by VulnCheckHigh 8.8
Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentication. Attackers can exploit the vulnerability by sending crafted SQL injection payloads in email and password parameters across police, incharge, user, and HQ login endpoints.
- Product
- Digital Crime Report Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantfilemanager.comiwantsourcecodes.com
Jan 17, 2026Registration & Login with Mobile Phone Number for WooCommerce: Authentication BypassCVE-2025-10484 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.
- Product
- Registration & Login with Mobile Phone Number for WooCommerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Registration & Login with Mobile Phone Number for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwoocommerce.comwordfence.com
Jan 16, 2026In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) viCVE-2025-31510 · Other software · lemonldap-ng · reported by MITREHigh 7.2
In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) via the tab parameter, for Choice authentication.
- Product
- LemonLDAP::NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.ow2.orglists.debian.org
Jan 15, 2026Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests.CVE-2021-47801 · Other software · Vianeos · reported by VulnCheckHigh 8.8
Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit this vulnerability by crafting malicious POST requests with specially constructed SQL payloads that trigger database sleep functions to extract information.
- Product
- Vianeos OctoPUS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvianeos.comvianeos.com
Jan 15, 2026Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint.CVE-2021-47777 · Other software · Ribccs · reported by VulnCheckHigh 8.8
Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint. Attackers can inject stacked SQL queries using payloads like ';WAITFOR DELAY '0:0:3'-- to manipulate database queries and potentially extract or modify database information.
- Product
- Build Smart ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordribccs.comexploit-db.com
Jan 15, 2026An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to theCVE-2026-22919 · Other software · SICK AG · reported by psirt@sick.deLow 3.8
An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of sensitive data.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login.CVE-2026-22913 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication.CVE-2026-22912 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users.
- Product
- TDC-X401GL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password parameterCVE-2023-54340 · Other software · WorkOrder · reported by VulnCheckHigh 8.8
WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password parameters. Attackers can inject malicious SQL queries using techniques like OR '1'='1' and stacked queries to access database information or execute administrative commands.
- Product
- WorkOrder CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 13, 2026eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request.CVE-2023-54335 · Other software · Extplorer · reported by VulnCheckCritical 9.3
eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system.
- Product
- eXtplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextplorer.netexploit-db.com
Jan 13, 2026Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts.CVE-2022-50896 · Other software · Testa · reported by VulnCheckMedium 5.1
Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts. Attackers can craft a specially encoded payload in the redirect parameter to execute arbitrary JavaScript in victim's browser context.
- Product
- Testa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Jan 13, 2026VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials.CVE-2022-50892 · Other software · VIAVIWEB · reported by VulnCheckHigh 8.8
VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials. Attackers can exploit the login page by injecting 'admin' or 1=1-- - payload to gain unauthorized access to the administrative interface.
- Product
- VIAVIWEB Wallpaper Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comviaviweb.com
Jan 12, 2026Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’.CVE-2025-41006 · Other software · Imaster · reported by cve-coordination@incibe.esCritical 9.3
Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’.
- Product
- MEMS Events CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2025-14976 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.8. This is due to missing or incorrect nonce validation on the 'process_row_actions' function with the 'delete' action. This makes it possible for unauthenticated attackers to delete arbitrary post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected
- up to 4.4.8
- What to do
- Affects up to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2026A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.CVE-2025-60538 · Other software · Go-shiori · reported by MITREMedium 6.5
A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.
- Product
- Shiori
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized aCVE-2025-66744 · Other software · reported by MITREHigh 7.5
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized access to sensitive information within the system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026the Login Widget: AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code executionCVE-2020-36875 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.
- Product
- the Login Widget
- What to do
- Update the Login Widget to the newest version.
Full record and what to do →NVD recordaccessally.comwpscan.com
Jan 9, 2026BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites.CVE-2025-14598 · Other software · BeeS Software Solutions · reported by cret@cert.orgCritical 9.8
BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database.
- Product
- BET ePortal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordafnaan.mecloudilyaerp.com
Jan 9, 2026This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session ICVE-2026-22082 · Network & remote access · Tenda · reported by vdisclose@cert-in.org.inHigh 8.8
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session ID through its web-based administrative interface. A remote attacker could exploit this vulnerability by intercepting network traffic and capturing the session ID during insecure transmission. Successful exploitation of this vulnerability could allow the attacker to hijack an authenticated session and compromise sensitive configuration information on the targeted device.
- Product
- 300Mbps Wireless Router F3 and N300 Easy Setup Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credentiaCVE-2026-22079 · Network & remote access · Tenda · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credentials during the initial login or post-factory reset setup through the web-based administrative interface. An attacker on the same network could exploit this vulnerability by intercepting network traffic and capturing the credentials transmitted in plaintext. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unauthorized access to the targeted device.
- Product
- 300Mbps Wireless Router F3 and N300 Easy Setup Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDeskCVE-2025-61549 · Other software · Edubusinesssolutions · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping. This allows attackers to execute arbitrary JavaScript in the context of a victim s browser session
- Product
- Print Shop Pro Webdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive inCVE-2025-62877 · Other software · SUSE · reported by meissner@suse.deCritical 9.8
Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.
- Product
- harvester
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Jan 8, 2026NeuVector supports login authentication through OpenID Connect.CVE-2025-66001 · Other software · SUSE · reported by meissner@suse.deHigh 8.8
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
- Product
- neuvector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Jan 7, 2026An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories.CVE-2025-66620 · Other software · Columbia Weather Systems · reported by ics-cert@hq.dhs.govHigh 8.6
An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, and the ability to modify or remove data stored in the file system.
- Product
- MicroServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the 'CVE-2020-36912 · Other software · Plexus · reported by VulnCheckMedium 5.1
Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the 'pagina' GET parameter. Attackers can craft malicious links that redirect users to arbitrary websites by exploiting improper input validation in the parameter.
- Product
- Plexus anblick Digital Signage Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.compacketstormsecurity.com
Jan 5, 2026LoginWP - Pro: Missing AuthorizationCVE-2025-46255 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Marketing Fire LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a through 4.0.8.5.
- Product
- LoginWP - Pro
- Affected
- up to 4.0.8.5
- What to do
- Affects up to 4.0.8.5. Update LoginWP - Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026LoginWP - Pro: Missing AuthorizationCVE-2025-39561 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Marketing Fire, LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a through 4.0.8.5.
- Product
- LoginWP - Pro
- Affected
- up to 4.0.8.5
- What to do
- Affects up to 4.0.8.5. Update LoginWP - Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2026REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.CVE-2024-55374 · Other software · Vanderbilt · reported by MITREMedium 5.3
REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.
- Product
- Redcap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025SiteLock Security – WP Hardening, Login Security & Malware Scans: Missing AuthorizationCVE-2025-62128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through <= 5.0.1.
- Product
- SiteLock Security – WP Hardening, Login Security & Malware Scans
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update SiteLock Security – WP Hardening, Login Security & Malware Scans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Heateor Social Login: Cross-Site Request Forgery (CSRF)CVE-2025-68998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.
- Product
- Heateor Social Login
- Affected
- up to 1.1.39
- What to do
- Affects up to 1.1.39. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WordPress Social Login and Register: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68974 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.
- Product
- WordPress Social Login and Register
- Affected
- up to 7.7.0
- What to do
- Affects up to 7.7.0. Update WordPress Social Login and Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2025Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.CVE-2025-54322 · Other software · Xspeeder · reported by MITRECritical 10
Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.
- Product
- SXZOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2025Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.CVE-2025-68943 · Other software · Gitea · reported by MITREMedium 5.3
Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Dec 24, 2025Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page.CVE-2025-8769 · Other software · MegaSys Computer Technologies · reported by ics-cert@hq.dhs.govCritical 9.3
Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page. Due to improper input validation, an attacker can inject arbitrary Perl code through a crafted HTTP request, leading to remote code execution on the server.
- Product
- Telenium Online Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner.CVE-2025-68915 · Other software · Riello · reported by MITREMedium 5.5
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner.
- Product
- NetMan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection.CVE-2025-68914 · Other software · Riello · reported by MITREMedium 6.5
Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table.
- Product
- NetMan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL.CVE-2025-60935 · Other software · Returnfi · reported by MITREMedium 6.1
An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the next_url parameter in the login endpoint and could lead to phishing or token theft after successful authentication.
- Product
- Blitz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 22, 2025Feather Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-62107 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather Login Page: from n/a through <= 1.1.7.
- Product
- Feather Login Page
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2025-13220 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode attributes in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Sensitive Information ExposureCVE-2025-12492 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.0 via the ajax_get_members function. This is due to the use of a predictable low-entropy token (5 hex characters derived from md5 of post ID) to identify member directories and insufficient authorization checks on the unauthenticated AJAX endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, display names, user roles (including administrator accounts), profile URLs, and user IDs by enumerating predictable directory_id values or brute-forcing the small 16^5 token space.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup.CVE-2025-62004 · Other software · BullWall · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.7
BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in after boot and before SIP MFA is running. The SIP services do not retroactively enforce MFA or disconnect sessions that were not subject to SIP MFA. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions mayy also be affected. BullWall plans to improve detection method documentation.
- Product
- Server Intrusion Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Dec 18, 2025Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login.CVE-2025-64400 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.1
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missing a separate check that the enrollment editor has access (or belongs to) the organization that they are adding a user to.
- Product
- com.palantir.controlpanel:control-panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Login Page Customizer – Customizer Login Page, Admin Page, Custom Design: Missing AuthorizationCVE-2025-49902 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in A WP Life Login Page Customizer – Customizer Login Page, Admin Page, Custom Design customizer-login-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Page Customizer – Customizer Login Page, Admin Page, Custom Design: from n/a through <= 2.1.1.
- Product
- Login Page Customizer – Customizer Login Page, Admin Page, Custom Design
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Login Page Customizer – Customizer Login Page, Admin Page, Custom Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2025AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login.CVE-2025-34439 · Other software · World Wide Broadcast Network · reported by VulnCheckMedium 4.8
AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can craft a link to redirect users to arbitrary external sites, enabling phishing attacks.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchocapikk.comgithub.com
Dec 17, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2025-13217 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the YouTube Video 'value' field in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping on user-supplied YouTube video URLs in the `um_profile_field_filter_hook__youtube_video()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the injected user's profile page.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 17, 2025There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and nCVE-2025-65185 · Other software · Entrinsik · reported by MITRELow 2.8
There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then reviewing application responses.
- Product
- Informer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordentrinsik.comtriaxiomsecurity.com
Dec 16, 2025An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing CVE-2025-65427 · Other software · Dbitnet · reported by MITREMedium 6.5
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations.
- Product
- Dbit N300 T1 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.