Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

3,612 results · page 14 of 73

Oct 17, 2025A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.CVE-2025-56221 · Other software · Ascertia · reported by MITRECritical 9.8
A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack.
Product
Signinghub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 15, 2025External Login: Sensitive information exposureCVE-2025-11196 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The External Login plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.11.2 due to the 'exlog_test_connection' AJAX action lacking capability checks or nonce validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to query the configured external database and retrieve truncated usernames, email addresses, and password hashes via the diagnostic test results view.
Product
External Login
Affected
up to 1.11.2
What to do
Affects up to 1.11.2. Update External Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025External Login: SQL InjectionCVE-2025-11177 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database when a PostgreSQL or MSSQL database is configured as the external authentication database.
Product
External Login
Affected
up to 1.11.2
What to do
Affects up to 1.11.2. Update External Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2025YourMembership Single Sign On – YM SSO Login: Unauthorized access of dataCVE-2025-10648 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login.
Product
YourMembership Single Sign On – YM SSO Login
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update YourMembership Single Sign On – YM SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025WPBifröst – Instant Passwordless Temporary Login Links: Privilege EscalationCVE-2025-10299 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts and subsequently log in as those.
Product
WPBifröst – Instant Passwordless Temporary Login Links
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update WPBifröst – Instant Passwordless Temporary Login Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 15, 2025OwnID Passwordless Login: Authentication BypassCVE-2025-10294 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownid_shared_secret value is empty prior to authenticating a user via JWT. This makes it possible for unauthenticated attackers to log in as other users, including administrators, on instances where the plugin has not been fully configured yet.
Product
OwnID Passwordless Login
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update OwnID Passwordless Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 15, 2025Quick Social Login: Stored Cross-Site ScriptingCVE-2025-10140 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Quick Social Login
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Quick Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 14, 2025A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and acCVE-2025-41718 · Other software · Murrelektronik · reported by info@cert.vde.comHigh 7.5
A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.
Product
Firmware Impact67 Pro 54630
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record murrelektronik.csaf-tp.certvde.com
Oct 14, 2025An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.CVE-2025-41705 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 6.8
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
Product
QUINT4-UPS/24DC/24DC/5/EIP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record certvde.com seclists.org
Oct 11, 2025CM Registration – Tailored tool for seamless login and invitation-based registrations: Open RedirectCVE-2025-11167 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirect_url' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
CM Registration – Tailored tool for seamless login and invitation-based registrations
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update CM Registration – Tailored tool for seamless login and invitation-based registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2025Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects AuthenticatCVE-2025-8093 · Websites & servers · reported by mlhess@drupal.orgHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 10, 2025The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled websiCVE-2025-11190 · Other software · Synchroweb · reported by cret@cert.orgMedium 5.4
The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.
Product
Kiwire
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synchroweb.com kb.cert.org
Oct 10, 2025The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.CVE-2025-11189 · Other software · Synchroweb · reported by cret@cert.orgHigh 7.3
The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.
Product
Kiwire
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synchroweb.com kb.cert.org
Oct 9, 2025The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation.CVE-2025-60375 · Other software · reported by MITREHigh 7.3
The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and password parameters in the login request, an attacker can gain unauthorized access to user accounts, including administrative accounts, without providing valid credentials.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Oct 8, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: SQL InjectionCVE-2025-11204 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 6.0.6.2
What to do
Affects up to 6.0.6.2. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 6, 2025For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existingCVE-2025-58586 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
Product
Baggage Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com cisa.gov
Oct 6, 2025The application provides access to a login protected H2 database for caching purposes.CVE-2025-58583 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The application provides access to a login protected H2 database for caching purposes. The username is prefilled.
Product
Enterprise Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com cisa.gov
Oct 6, 2025If a user tries to login but the provided credentials are incorrect a log is created.CVE-2025-58582 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.
Product
Enterprise Analytics
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sick.com cisa.gov
Oct 3, 2025An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-coCVE-2025-56551 · Other software · Directadmin · reported by MITREHigh 8.2
An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafted GET request.
Product
Directadmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com i.imgur.com
Sep 30, 2025An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers to execute arbitraryCVE-2025-57254 · Other software · reported by MITREMedium 6.5
An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers to execute arbitrary SQL queries via the username and password POST parameters. The application fails to properly sanitize input before embedding it into SQL queries, leading to unauthorized access or potential data breaches. This can result in privilege escalation, account takeover, or exposure of sensitive medical data.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 30, 2025PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout.CVE-2025-8118 · Other software · Polska Akademia Dostępności · reported by cvd@cert.plMedium 6.9
PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability.
Product
PAD CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Sep 29, 2025Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user"CVE-2025-56764 · Other software · Trivisionsecurity · reported by MITREMedium 5.3
Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user" vs. "Wrong password"), allowing an attacker to enumerate valid usernames.
Product
Trivision Nc-227wf Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 26, 2025Theme My Login: Missing AuthorizationCVE-2025-60098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jeff Farthing Theme My Login theme-my-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theme My Login: from n/a through <= 7.1.12.
Product
Theme My Login
Affected
up to 7.1.12
What to do
Affects up to 7.1.12. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled.CVE-2025-1396 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Low 3.7
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which usernames exist in the system based on observable discrepancies in the application's responses. Exploitation of this vulnerability could aid in brute-force attacks, targeted phishing campaigns, or other social engineering techniques by confirming the validity of user identifiers within the system.
Product
WSO2 Identity Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.docs.wso2.com
Sep 22, 2025Custom Login URL: Missing AuthorizationCVE-2025-58969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through <= 1.0.2.
Product
Custom Login URL
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Custom Login URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025IP Based Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58960 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through <= 2.4.3.
Product
IP Based Login
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update IP Based Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Simple JWT Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58648 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Stored XSS.This issue affects Simple JWT Login: from n/a through <= 3.6.4.
Product
Simple JWT Login
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update Simple JWT Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Login-Logout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53467 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Login-Logout login-logout allows Stored XSS.This issue affects Login-Logout: from n/a through <= 3.8.
Product
Login-Logout
Affected
up to 3.8
What to do
Affects up to 3.8. Update Login-Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation.CVE-2025-57434 · Other software · Creacast · reported by MITREHigh 8.8
Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows.
Product
Creabox Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record creacast.com github.com
Sep 20, 2025Custom Login And Signup Widget: Cross-Site Request ForgeryCVE-2025-9887 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in the /frndzk_adminclsw.php file. This makes it possible for unauthenticated attackers to change the email and username settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Custom Login And Signup Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Login And Signup Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 16, 2025Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script.CVE-2025-34184 · Other software · Ilevia Srl. · reported by VulnCheckCritical 9.3
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or denial of service.
Product
EVE X1 Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstorm.news ilevia.com
Sep 16, 2025In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix a race condition between login_work and the login thread In case CVE-2022-50350 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix a race condition between login_work and the login thread In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_ready() callback will schedule the login_work and, at the same time, the negotiation may end without clearing the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are required to complete the login). The login has been completed but the login_work function will find the LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling itself; at this point, if the initiator drops the connection, the iscsit_conn structure will be freed, login_work will dereference a released socket structure and the kernel crashes. BUG: kernel NULL pointer dereference, address: 0000000000000230 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod] RIP: 0010:_raw_read_lock_bh+0x15/0x30 Call trace: iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod] process_one_work+0x1e8/0x3c0 Fix this bug by forcing login_work to stop afte
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Sep 16, 2025An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login functionCVE-2025-57119 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function
Product
Online Library Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 15, 2025Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx.CVE-2025-57104 · Other software · Zeon · reported by MITREMedium 5.4
Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx.
Product
Teampel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com teampel.com
Sep 15, 2025Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth loginCVE-2025-9084 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.1
Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com
Sep 14, 2025In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when anCVE-2025-59363 · Other software · One Identity · reported by MITREHigh 7.7
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),
Product
OneLogin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record onelogin.service-now.com
Sep 10, 2025It is possible to bypass the administrator login screen on SolaX Cloud.CVE-2025-36757 · Other software · SolaX Power · reported by csirt@divd.nlMedium 6.3
It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to bypass the login screen and gain limited access to the system.
Product
SolaX Cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record csirt.divd.nl csirt.divd.nl
Sep 10, 2025Heateor Login – Social Login: Stored Cross-Site ScriptingCVE-2025-9857 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Heateor Login – Social Login Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heateor_Facebook_Login' shortcode in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Heateor Login – Social Login
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Heateor Login – Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 8, 2025An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reCVE-2025-51586 · Websites & servers · Prestashop · reported by MITRELow 3.7
An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature.
Product
Prestashop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com maxime-morel.github.io
Sep 5, 2025UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for: Time-based SQL InjectionCVE-2025-10003 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘upload_file_remove’ function and 'htmlvar' parameter in all versions up to, and including, 1.2.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for
Affected
up to 1.2.44
What to do
Affects up to 1.2.44. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 5, 2025Ultimate AJAX Login: Cross-Site Request Forgery (CSRF)CVE-2025-58854 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Samer Bechara Ultimate AJAX Login ultimate-ajax-login allows Reflected XSS.This issue affects Ultimate AJAX Login: from n/a through <= 1.2.1.
Product
Ultimate AJAX Login
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Ultimate AJAX Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2025ImpactThe attacker can validate if a user exists by checking the time login returns.CVE-2025-9824 · Other software · Mautic · reported by security@mautic.orgMedium 5.9
ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not. Technical DetailsThe vulnerability was caused by different response times when: * A valid username was provided (password hashing occurred) * An invalid username was provided (no password hashing occurred) The fix introduces a TimingSafeFormLoginAuthenticator that performs a dummy password hash verification even for non-existent users, ensuring consistent timing. WorkaroundsNo workarounds are available. Users should upgrade to the patched version. References * https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account
Product
Mautic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 31, 2025Login with phone number: Missing AuthorizationCVE-2024-32832 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
Product
Login with phone number
Affected
up to 1.6.93
What to do
Affects up to 1.6.93. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input CVE-2025-51972 · Other software · Puneethreddyhc · reported by MITREMedium 6.5
A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
Product
Online Shopping System Advanced
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Aug 28, 2025QuickCMS sends password and login via GET Request.CVE-2025-54542 · Other software · OpenSolution · reported by cvd@cert.plMedium 6.9
QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Product
QuickCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl opensolution.org
Aug 27, 2025UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: Stored Cross-Site ScriptingCVE-2025-9344 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwp_profile' and 'uwp_profile_header' shortcodes in all versions up to, and including, 1.2.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Affected
up to 1.2.42
What to do
Affects up to 1.2.42. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 27, 2025The configuration file containing database logins and passwords is readable by any local user.CVE-2025-30063 · Other software · CGM · reported by cvd@cert.plCritical 9.4
The configuration file containing database logins and passwords is readable by any local user.
Product
CGM CLININET
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl
Aug 22, 2025The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php.CVE-2025-51092 · Other software · Vishnusivadas · reported by MITRECritical 9.8
The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and signUp() build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareData() function exists, it is insufficient to prevent SQL injection and does not sanitize the table name.
Product
Login-signup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abimelsbk.hashnode.dev
Aug 22, 2025A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283CVE-2025-55630 · Other software · Reolink · reported by MITREHigh 7.3
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 when entering the wrong username and password allows attackers to enumerate existing accounts.
Product
Smart 2k+ Plug-in Wi-fi Video Doorbell With Chime Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record relieved-knuckle-264.notion.site
Aug 20, 2025Simple Login Log: Deserialization of Untrusted DataCVE-2025-49438 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Max Chirkov Simple Login Log allows Object Injection. This issue affects Simple Login Log: from n/a through 1.1.3.
Product
Simple Login Log
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Simple Login Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.