Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,376 results · page 124 of 348
Apr 7, 2025A vulnerability was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3344 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/assign_save.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical.CVE-2025-3343 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/reservation_update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical.CVE-2025-3342 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/payment_save.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3341 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0. This affects an unknown part of the file /admin/reservation_view.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3340 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/combo_update.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3339 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user_update.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as critical has been found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3338 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/user_save.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3337 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/member_update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3336 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/member_save.php. The manipulation of the argument last leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3335 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/category_update.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical.CVE-2025-3334 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/category_save.php. The manipulation of the argument Category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Vulnerability of improper resource management in the memory management module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-58113 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of improper resource management in the memory management module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical.CVE-2025-3333 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/menu_update.php. The manipulation of the argument menu leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3332 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/menu_save.php. The manipulation of the argument menu leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3331 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. This issue affects some unknown processing of the file /payment_save.php. The manipulation of the argument mode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3330 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. This vulnerability affects unknown code of the file /reservation_save.php. The manipulation of the argument first leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0.CVE-2025-3318 · Other software · Kenj_Frog 肯尼基蛙 · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- company-financial-management 公司财务管理系统
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability was found in Project Worlds Online Lawyer Management System 1.0.CVE-2025-3176 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability was found in Project Worlds Online Lawyer Management System 1.0. It has been classified as critical. This affects an unknown part of the file /single_lawyer.php. The manipulation of the argument u_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Lawyer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability was found in Project Worlds Online Lawyer Management System 1.0 and classified as critical.CVE-2025-3175 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability was found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /save_user_edit_profile.php. The manipulation of the argument first_Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Lawyer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability has been found in Project Worlds Online Lawyer Management System 1.0 and classified as critical.CVE-2025-3174 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability has been found in Project Worlds Online Lawyer Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /searchLawyer.php. The manipulation of the argument experience leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Lawyer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability, which was classified as critical, was found in Project Worlds Online Lawyer Management System 1.0.CVE-2025-3173 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Project Worlds Online Lawyer Management System 1.0. Affected is an unknown function of the file /save_booking.php. The manipulation of the argument lawyer_id/description leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Lawyer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0.CVE-2025-3172 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Project Worlds Online Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyer_booking.php. The manipulation of the argument unblock_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Lawyer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability classified as critical was found in Project Worlds Online Lawyer Management System 1.0.CVE-2025-3171 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Project Worlds Online Lawyer Management System 1.0. This vulnerability affects unknown code of the file /approve_lawyer.php. The manipulation of the argument unblock_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Lawyer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability classified as critical has been found in Project Worlds Online Lawyer Management System 1.0.CVE-2025-3170 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in Project Worlds Online Lawyer Management System 1.0. This affects an unknown part of the file /admin_user.php. The manipulation of the argument block_id/unblock_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Lawyer Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability was found in itning Student Homework Management System up to 1.2.7.CVE-2025-3150 · Other software · itning · reported by VulDBMedium 5.3
A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected.
- Product
- Student Homework Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability was found in itning Student Homework Management System up to 1.2.7.CVE-2025-3149 · Other software · itning · reported by VulDBMedium 4.8
A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an unknown function of the file /shw_war/fileupload of the component Edit Job Page. The manipulation of the argument Course leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Student Homework Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability was found in codeprojects Product Management System 1.0 and classified as problematic.CVE-2025-3148 · Other software · codeprojects · reported by VulDBMedium 4.8
A vulnerability was found in codeprojects Product Management System 1.0 and classified as problematic. This issue affects some unknown processing of the component Login. The manipulation of the argument Str1 leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Product Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025A vulnerability classified as critical was found in fcba_zzm ics-park Smart Park Management System 2.1.CVE-2025-3135 · Other software · fcba_zzm · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in fcba_zzm ics-park Smart Park Management System 2.1. This vulnerability affects unknown code of the file /api/system/dept/update. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- ics-park Smart Park Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authentCVE-2025-20203 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious code into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials. {{value}} ["%7b%7bvalue%7d%7d"])}]]
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 2, 2025A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unautheCVE-2025-20120 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco Prime Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Apr 1, 2025Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability.CVE-2025-29982 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability.CVE-2025-29981 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability.CVE-2025-27694 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabCVE-2025-27693 · Other software · Dell · reported by security_alert@emc.comMedium 4.9
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability.CVE-2025-27692 · Other software · Dell · reported by security_alert@emc.comMedium 4.7
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote execution
- Product
- Wyse Management Suite Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31564 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Blind SQL Injection.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.2.6.
- Product
- Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.CVE-2025-3096 · Other software · SourceCodester · reported by cve@rapid7.comCritical 9.3
Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.
- Product
- Clinic's Patient Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.orgsourcecodester.com
Apr 1, 2025CodeZips Gym Management System v1.0 is vulnerable to SQL injection in the name parameter within /dashboard/admin/deleteroutine.php.CVE-2025-29208 · Other software · Codezips · reported by MITREMedium 6.5
CodeZips Gym Management System v1.0 is vulnerable to SQL injection in the name parameter within /dashboard/admin/deleteroutine.php.
- Product
- GYM Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized aCVE-2025-28132 · Other software · Nagios · reported by MITREMedium 4.6
A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. This occurs due to insufficient session expiration, where session tokens remain valid beyond logout, allowing an attacker to impersonate users and perform actions on their behalf.
- Product
- Nagios Network Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-31121 · Other software · openemr · reported by GitHubHigh 7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. This vulnerability is fixed in 7.0.3.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025An authentication issue was addressed with improved state management.CVE-2025-31194 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A Shortcut may run with admin privileges without authentication.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-31191 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, watchOS 11.4. An app may be able to access sensitive user data.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-30469 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.4
This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4. A person with physical access to an iOS device may be able to access photos from the lock screen.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-30441 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.
- Product
- Xcode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Mar 31, 2025A logic issue was addressed with improved state management.CVE-2025-30432 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.4
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A malicious app may be able to attempt passcode entries on a locked device and thereby cause escalating time delays after 4 failures.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-30430 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Password autofill may fill in passwords after failing authentication.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-30428 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.4
This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6. Photos in the Hidden Photos Album may be viewed without authentication.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025A use-after-free issue was addressed with improved memory management.CVE-2025-30427 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-30425 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, watchOS 11.4. A malicious website may be able to track users in Safari private browsing mode.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Mar 31, 2025This issue was addressed through improved state management.CVE-2025-24232 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access arbitrary files.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.