Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

1,460 results · page 12 of 30

May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5168 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5167 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as problematic. Affected by this vulnerability is the function LWOImporter::GetS0 in the library assimp/code/AssetLib/LWO/LWOLoader.h. The manipulation of the argument out leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 26, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5166 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-5165 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 23, 2025WP Smart Import: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47453 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes WP Smart Import wp-smart-import allows PHP Local File Inclusion.This issue affects WP Smart Import: from n/a through <= 1.1.3.
Product
WP Smart Import
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update WP Smart Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 21, 2025A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import funCVE-2025-45753 · Other software · Vtiger · reported by MITREHigh 7.2
A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature.
Product
Vtiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record simonjuguna.com
May 21, 2025A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature.CVE-2025-45755 · Other software · Vtiger · reported by MITREMedium 6.1
A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped to the Service Name field. When the file is uploaded, the application improperly sanitizes user input, leading to persistent script execution.
Product
Vtiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record simonjuguna.com vtiger.com
May 21, 2025A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the ExtenCVE-2025-45752 · Other software · Seeddms · reported by MITREHigh 7.2
A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Extension Manager.
Product
Seeddms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record simonjuguna.com simonjuguna.com
May 20, 2025Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of filesCVE-2025-48017 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comCritical 9
Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files
Product
SEL-5056 Software-Defined Network Flow Controller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record selinc.com
May 19, 2025WordPress Video Robot - The Ultimate Video Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.
Product
WordPress Video Robot - The Ultimate Video Importer
Affected
up to 1.20.0
What to do
Affects up to 1.20.0. Update WordPress Video Robot - The Ultimate Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Import Social Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48256 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: from n/a through <= 1.8.5.
Product
Import Social Events
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Import Social Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 17, 2025CSV Mass Importer: Does not properly validate uploaded filesCVE-2025-4190 · WordPress plugins & themes · reported by WPScanHigh 7.2
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
CSV Mass Importer
Affected
up to 1.2
What to do
Affects up to 1.2. Update CSV Mass Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2025Import Export For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48144 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
Product
Import Export For WooCommerce
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Import Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025AffiliateImporterEb: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12733 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
AffiliateImporterEb
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update AffiliateImporterEb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025AffiliateImporterEb: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12732 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
AffiliateImporterEb
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update AffiliateImporterEb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2025Pixmeo OsiriX MD is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file and cause memory corrupCVE-2025-31946 · Other software · Pixmeo · reported by ics-cert@hq.dhs.govMedium 6.9
Pixmeo OsiriX MD is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file and cause memory corruption or a system crash.
Product
OsiriX MD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov osirix-viewer.com
Apr 30, 2025Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.CVE-2024-30146 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.1
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem.
Product
HCL Domino Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 30, 2025XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown.CVE-2025-46558 · Other software · xwiki-contrib · reported by GitHubCritical 9
XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting (XSS) through HTML. In particular, using Markdown syntax, it's possible for any user to embed Javascript code that will then be executed on the browser of any other user visiting either the document or the comment that contains it. In the instance that this code is executed by a user with admins or programming rights, this issue compromises the confidentiality, integrity and availability of the whole XWiki installation. This issue has been patched in version 8.9.
Product
syntax-markdown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 24, 2025Flickr Shortcode Importer: Deserialization of Untrusted DataCVE-2025-46481 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through <= 2.2.3.
Product
Flickr Shortcode Importer
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Flickr Shortcode Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.CVE-2024-30148 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.1
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.
Product
HCL Leap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcl-software.com
Apr 22, 2025WP Import Export Lite: Stored Cross-Site ScriptingCVE-2025-2839 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Import Export Lite
Affected
up to 3.9.27
What to do
Affects up to 3.9.27. Update WP Import Export Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 18, 2025In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can import proviCVE-2025-40364 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix io_req_prep_async with provided buffers io_req_prep_async() can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Apr 17, 2025An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function.CVE-2025-29457 · Other software · Mybb · reported by MITREHigh 7.6
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.
Product
Mybb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.mybb.com yuque.com
Apr 17, 2025Product Excel Import Export & Bulk Edit for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32674 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Excel Import Export & Bulk Edit for WooCommerce webd-woocommerce-product-excel-importer-bulk-edit allows Reflected XSS.This issue affects Product Excel Import Export & Bulk Edit for WooCommerce: from n/a through <= 4.7.
Product
Product Excel Import Export & Bulk Edit for WooCommerce
Affected
up to 4.7
What to do
Affects up to 4.7. Update Product Excel Import Export & Bulk Edit for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability.CVE-2025-1656 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Product
Revit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Apr 15, 2025A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability.CVE-2025-1275 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Product
Revit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Apr 15, 2025A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability.CVE-2025-1273 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Product
Revit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record autodesk.com autodesk.com
Apr 13, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3549 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 13, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3.CVE-2025-3548 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 11, 2025Subnet Solutions PowerSYSTEM Center's SMTPS notification service can be affected by importing an EC certificate with crafted F2m parameters, which can lead to eCVE-2025-31354 · Other software · Subnet Solutions · reported by ics-cert@hq.dhs.govMedium 5.3
Subnet Solutions PowerSYSTEM Center's SMTPS notification service can be affected by importing an EC certificate with crafted F2m parameters, which can lead to excessive CPU consumption during the evaluation of the curve parameters.
Product
PowerSYSTEM Center 2020
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Apr 11, 2025There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter.CVE-2025-3512 · Other software · Qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Medium 4.8
There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to QTextMarkdownImporter to trigger the overflow. This issue affects Qt from 6.8.0 to 6.8.4. Versions up to 6.6.0 are known to be unaffected, and the fix is in 6.8.4 and later.
Product
Qt
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codereview.qt-project.org openwall.com
Apr 9, 2025Ultra Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2025-32496 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web Shell to a Web Server.This issue affects Ultra Demo Importer: from n/a through <= 1.0.5.
Product
Ultra Demo Importer
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Ultra Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2025GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.CVE-2025-32460 · Other software · GraphicsMagick · reported by MITREMedium 4
GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call.
Product
GraphicsMagick
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foss.heptapod.net issues.oss-fuzz.com
Apr 3, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3196 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2Importer::InternReadFile in the library code/AssetLib/MD2/MD2Loader.cpp of the component Malformed File Handler. The manipulation of the argument Name leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 3, 2025A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-3160 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::SceneCombiner::AddNodeHashes of the file code/Common/SceneCombiner.cpp of the component File Handler. The manipulation leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as a0993658f40d8e13ff5823990c30b43c82a5daf0. It is recommended to apply a patch to fix this issue.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 3, 2025A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3159 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASE::Parser::ParseLV4MeshBonesVertices of the file code/AssetLib/ASE/ASEParser.cpp of the component ASE File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is e8a6286542924e628e02749c4f5ac4f91fdae71b. It is recommended to apply a patch to fix this issue.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 3, 2025A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3158 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file uploadsCVE-2025-2008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import_single_post_as_csv() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
Product
Import Export Suite for CSV and XML Datafeed
Affected
up to 7.19
What to do
Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2025Import Export Suite for CSV and XML Datafeed: Arbitrary file deletionCVE-2025-2007 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage() function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Please note this vulnerability was reintroduced in 7.20, and subsequently patched again in 7.20.1.
Product
Import Export Suite for CSV and XML Datafeed
Affected
up to 7.19
What to do
Affects up to 7.19. Update Import Export Suite for CSV and XML Datafeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 31, 2025A script imports issue was addressed with improved isolation.CVE-2025-24192 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A script imports issue was addressed with improved isolation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. Visiting a website may leak sensitive data.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Mar 31, 2025A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3016 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 31, 2025A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-3015 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: PHP Object InjectionCVE-2025-1913 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Server-Side Request ForgeryCVE-2025-1912 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Arbitrary file deletionCVE-2025-1911 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Directory TraversalCVE-2025-1769 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
Product
Product Import Export for WooCommerce – Import Export Product CSV Suite
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025WordPress Importer: PHP Object InjectionCVE-2024-13889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted input in the 'maybe_unserialize' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
WordPress Importer
Affected
up to 0.8.3
What to do
Affects up to 0.8.3. Update WordPress Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2757 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2025A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2756 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3.CVE-2025-2755 · Other software · Open Asset Import Library · reported by VulDBMedium 5.3
A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument src.entries leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Product
Assimp
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.