Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,079 results · page 14 of 142
Aug 10, 2025A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic.CVE-2025-8814 · Other software · atjiu · reported by VulDBLow 2.1
A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function setCookie of the file src/main/java/co/yiiu/pybbs/util/CookieUtil.java. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 8aa2bb1aef3346e49aec6358edf5e47ce905ae7b. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic.CVE-2025-8813 · Other software · atjiu · reported by VulDBLow 2
A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src/main/java/co/yiiu/pybbs/controller/front/IndexController.java. The manipulation of the argument referer leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as edb14ff13e9e05394960ba46c3d31d844ff2deac. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0.CVE-2025-8812 · Other software · atjiu · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the component Admin Panel. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
- Product
- pybbs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability classified as critical was found in Tenda AC20 16.03.08.05.CVE-2025-8810 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda AC20 16.03.08.05. Affected by this vulnerability is the function strcpy of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical.CVE-2025-8797 · Other software · LitmusChaos · reported by VulDBLow 2.1
A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStorage Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Litmus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic.CVE-2025-8796 · Other software · LitmusChaos · reported by VulDBLow 2.1
A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic. This vulnerability affects unknown code of the file /auth/delete_project/ of the component Delete Request Handler. The manipulation of the argument projectID leads to missing authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Litmus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0.CVE-2025-8795 · Other software · LitmusChaos · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0. This affects an unknown part of the file /auth/login. The manipulation of the argument projectID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Litmus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0.CVE-2025-8794 · Other software · LitmusChaos · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0. Affected by this issue is some unknown functionality of the component LocalStorage Handler. The manipulation of the argument projectID leads to authorization bypass. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Litmus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability classified as problematic was found in LitmusChaos Litmus up to 3.19.0.CVE-2025-8793 · Other software · LitmusChaos · reported by VulDBLow 2.1
A vulnerability classified as problematic was found in LitmusChaos Litmus up to 3.19.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument projectID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Litmus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2025A vulnerability classified as problematic has been found in LitmusChaos Litmus up to 3.19.0.CVE-2025-8792 · Other software · LitmusChaos · reported by VulDBLow 2.1
A vulnerability classified as problematic has been found in LitmusChaos Litmus up to 3.19.0. Affected is an unknown function. The manipulation leads to client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Litmus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability was found in Portabilis i-Diario up to 1.5.0 and classified as problematic.CVE-2025-8788 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability was found in Portabilis i-Diario up to 1.5.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /planos-de-aula-por-areas-de-conhecimento/ of the component Informações adicionais. The manipulation of the argument Parecer/Conteúdos/Objetivos leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Diario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9.CVE-2025-8785 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. This issue affects some unknown processing of the file /intranet/educar_usuario_lst.php. The manipulation of the argument nm_pessoa/matricula/matricula_interna leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability classified as problematic was found in Portabilis i-Educar up to 2.9.CVE-2025-8784 · Other software · Portabilis · reported by VulDBLow 2
A vulnerability classified as problematic was found in Portabilis i-Educar up to 2.9. This vulnerability affects unknown code of the file /intranet/funcionario_vinculo_cad.php of the component Cadastrar Vínculo Page. The manipulation of the argument nome leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical.CVE-2025-8775 · Other software · Qiyuesuo · reported by VulDBLow 2.1
A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of the file /api/code/upload of the component Scheduled Task Handler. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Eelectronic Signature Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability has been found in riscv-boom SonicBOOM up to 2.2.3 and classified as problematic.CVE-2025-8774 · Other software · riscv-boom · reported by VulDBLow 1.1
A vulnerability has been found in riscv-boom SonicBOOM up to 2.2.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component L1 Data Cache Handler. The manipulation leads to observable timing discrepancy. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SonicBOOM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability, which was classified as critical, was found in Dinstar Monitoring Platform 甘肃省危险品库监控平台 1.0.CVE-2025-8773 · Other software · Dinstar · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Dinstar Monitoring Platform 甘肃省危险品库监控平台 1.0. Affected is an unknown function of the file /itc/$%7BappPath%7D/login_getPasswordErrorNum.action. The manipulation of the argument userBean.loginName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Monitoring Platform 甘肃省危险品库监控平台
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability, which was classified as problematic, has been found in Vinades NukeViet up to 4.5.06.CVE-2025-8772 · Other software · Vinades · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in Vinades NukeViet up to 4.5.06. This issue affects some unknown processing of the file /admin/index.php?language=en&nv=upload of the component Module Handler. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NukeViet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability classified as problematic was found in Datacom DM955 5GT 1200 825.8010.00.CVE-2025-8765 · Other software · Datacom · reported by VulDBLow 2
A vulnerability classified as problematic was found in Datacom DM955 5GT 1200 825.8010.00. Affected by this vulnerability is an unknown functionality of the component Wireless Basic Settings. The manipulation of the argument SSID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DM955 5GT 1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0.CVE-2025-8764 · Other software · linlinjava · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- litemall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability was found in TRENDnet TV-IP110WN 1.2.2 and classified as problematic.CVE-2025-8757 · Other software · TRENDnet · reported by VulDBMedium 6.4
A vulnerability was found in TRENDnet TV-IP110WN 1.2.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /server/boa.conf of the component Embedded Boa Web Server. The manipulation leads to least privilege violation. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- TV-IP110WN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical.CVE-2025-8756 · Other software · TDuckCloud · reported by VulDBLow 2.1
A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of the file /manage/ of the component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- tduck-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic.CVE-2025-8755 · Other software · macrozheng · reported by VulDBMedium 5.5
A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController.java of the component com.macro.mall.portal.controller. The manipulation of the argument orderId leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0.CVE-2025-8753 · Other software · linlinjava · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0. Affected by this issue is the function delete of the file /admin/storage/delete of the component File Handler. The manipulation of the argument key leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- litemall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic.CVE-2025-8750 · Other software · macrozheng · reported by VulDBLow 1.9
A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic. Affected by this vulnerability is the function Upload of the file /minio/upload of the component Add Product Page. The manipulation of the argument File leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2025A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6.CVE-2025-8746 · Other software · GNU · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6. Affected is the function __strstr_sse2. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. This issue was initially reported to the tcpreplay project, but the code maintainer explains, that this "bug appears to be in libopts which is an external library." This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- libopts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 9, 2025A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android.CVE-2025-8745 · Other software · Weee · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.ricepo.app. The manipulation leads to improper export of android application components. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RICEPO App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability classified as critical was found in CesiumLab Web up to 4.0.CVE-2025-8744 · Other software · CesiumLab · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in CesiumLab Web up to 4.0. This vulnerability affects unknown code of the file /lodmodels/. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1.CVE-2025-8743 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. This affects an unknown part of the file /data_source_edit.shtm of the component Virtual Data Source Property Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic.CVE-2025-8739 · Other software · zhenfeng13 · reported by VulDBLow 2.1
A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/save. The manipulation of the argument tagName leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- My-Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic.CVE-2025-8738 · Other software · zlt2000 · reported by VulDBMedium 5.5
A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /actuator of the component Spring Actuator Interface. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- microservices-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability, which was classified as problematic, was found in zlt2000 microservices-platform up to 6.0.0.CVE-2025-8737 · Other software · zlt2000 · reported by VulDBLow 2
A vulnerability, which was classified as problematic, was found in zlt2000 microservices-platform up to 6.0.0. This affects the function onLogoutSuccess of the file src/main/java/com/central/oauth/handler/OauthLogoutSuccessHandler.java. The manipulation of the argument redirect_url leads to open redirect. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- microservices-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8.CVE-2025-8736 · Other software · GNU · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the component Lexer. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
- Product
- cflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comlists.gnu.org
Aug 8, 2025A vulnerability classified as problematic was found in GNU cflow up to 1.8.CVE-2025-8735 · Other software · GNU · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the component Lexer. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- cflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comlists.gnu.org
Aug 8, 2025A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical.CVE-2025-8730 · Other software · Belkin · reported by VulDBHigh 8.9
A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to hard-coded credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F9K1009
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical.CVE-2025-8729 · Other software · MigoXLab · reported by VulDBLow 2.1
A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function process_cert_files of the file backend/service/upload_service.py. The manipulation of the argument task_id leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is f1b00597e293d09452aabd4fa57f3185207350e8. It is recommended to apply a patch to fix this issue.
- Product
- LMeterX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025A vulnerability has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0 and classified as critical.CVE-2025-8706 · Other software · Wanzhou · reported by VulDBLow 2.1
A vulnerability has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /CommonSolution/CreateFunctionLog of the component Energy Overview Module. The manipulation of the argument MM_MenID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- WOES Intelligent Optimization Energy Saving System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025A vulnerability, which was classified as critical, was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0.CVE-2025-8705 · Other software · Wanzhou · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. Affected is an unknown function of the file /WEAS_HomePage/GetTargetConfig of the component Energy Overview Module. The manipulation of the argument BP_ProID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- WOES Intelligent Optimization Energy Saving System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025A vulnerability, which was classified as critical, has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0.CVE-2025-8704 · Other software · Wanzhou · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This issue affects some unknown processing of the file /WEAS_AlarmResult/GetAlarmResultProcessList of the component Analysis Conclusion Query Module. The manipulation of the argument resultId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- WOES Intelligent Optimization Energy Saving System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025A vulnerability classified as critical was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0.CVE-2025-8703 · Other software · Wanzhou · reported by VulDBLow 2.1
A vulnerability classified as critical was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This vulnerability affects unknown code of the file /WEAS_HomePage/GetAreaTrendChartData of the component Environmental Real-Time Data Module. The manipulation of the argument energyId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- WOES Intelligent Optimization Energy Saving System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0.CVE-2025-8702 · Other software · Wanzhou · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This affects an unknown part of the file /CommonSolution/GetVariableByOneIDNew of the component Historical Data Query Module. The manipulation of the argument ObjectID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- WOES Intelligent Optimization Energy Saving System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical.CVE-2025-8697 · Other software · reported by VulDBLow 2.1
A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPSessionManager/MCPTool/MCPToolkit. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php.CVE-2023-41523 · Other software · Student Attendance Management System Project · reported by MITREHigh 8.8
Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 7, 2025Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmNameCVE-2023-41520 · Other software · Student Attendance Management System Project · reported by MITREHigh 8.8
Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmName parameters.
- Product
- Student Attendance Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 6, 2025A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2.CVE-2025-8667 · Other software · SkyworkAI · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2. Affected is the function from_code/from_dict/from_mcp of the file src/tools/tools.py. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DeepResearchAgent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5.CVE-2025-8665 · Other software · agno-agi · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the library libs/agno/agno/tools/mcp.py of the component Model Context Protocol Handler. The manipulation of the argument command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- agno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF.CVE-2025-54869 · Other software · Setasign · reported by GitHubMedium 6
FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that uses FPDI to process user-supplied PDF files is at risk, causing a Denial of Service (DoS) vulnerability. An attacker can upload a small, malicious PDF file that will cause the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained service unavailability. This issue is fixed in version 2.6.3.
- Product
- FPDI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability, which was classified as problematic, was found in libav up to 12.3.CVE-2025-8586 · Other software · Libav · reported by VulDBLow 1.9
A vulnerability, which was classified as problematic, was found in libav up to 12.3. This affects the function ff_seek_frame_binary of the file /libavformat/utils.c of the component MPEG File Parser. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The bug was initially reported by the researcher to the wrong project. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Libav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comtrac.ffmpeg.org
Aug 5, 2025The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks.CVE-2025-51857 · Other software · reported by MITREMedium 6.1
The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 5, 2025A vulnerability, which was classified as critical, has been found in libav up to 12.3.CVE-2025-8585 · Other software · Libav · reported by VulDBLow 1.9
A vulnerability, which was classified as critical, has been found in libav up to 12.3. Affected by this issue is the function main of the file /avtools/avconv.c of the component DSS File Demuxer. The manipulation leads to double free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The bug was initially reported by the researcher to the wrong project. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Libav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comtrac.ffmpeg.org
Aug 5, 2025A vulnerability classified as problematic was found in libav up to 12.3.CVE-2025-8584 · Other software · Libav · reported by VulDBLow 1.9
A vulnerability classified as problematic was found in libav up to 12.3. Affected by this vulnerability is the function av_buffer_unref of the file libavutil/buffer.c of the component AVI File Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The bug was initially reported by the researcher to the wrong project. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Libav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comtrac.ffmpeg.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.