Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,612 results · page 15 of 73
Aug 20, 2025During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control.CVE-2025-57789 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333Medium 5.3
During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.
- Product
- CommCell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.com
Aug 20, 2025A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials.CVE-2025-57788 · Other software · Commvault · reported by 050066fd-a2f9-4f32-ab5d-4c53f48bc333Medium 6.9
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.
- Product
- CommCell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.commvault.comlabs.watchtowr.com
Aug 18, 2025Affected is an unknown function of the component Login Page.CVE-2025-9108 · Other software · Portabilis · reported by VulDBLow 2.1
Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the attack remotely.
- Product
- i-Diario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2025The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerableCVE-2025-8878 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Affected
- up to 4.16.4
- What to do
- Affects up to 4.16.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 15, 2025Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects AuthenticatCVE-2025-8995 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.
- Product
- Authenticator Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025WooCommerce OTP Login With Phone Number, OTP Verification: Authentication bypassCVE-2025-8342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
- Product
- WooCommerce OTP Login With Phone Number, OTP Verification
- Affected
- up to 1.8.47
- What to do
- Affects up to 1.8.47. Update WooCommerce OTP Login With Phone Number, OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025Cloud SAML SSO - Single Sign On Login: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49264 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login cloud-sso-single-sign-on allows PHP Local File Inclusion.This issue affects Cloud SAML SSO - Single Sign On Login: from n/a through <= 1.0.18.
- Product
- Cloud SAML SSO - Single Sign On Login
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Cloud SAML SSO - Single Sign On Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2025In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.CVE-2025-51451 · Other software · Totolink · reported by MITRECritical 9.8
In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
- Product
- Ex1200t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comtotolink.net
Aug 13, 2025In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.CVE-2025-51452 · Other software · Totolink · reported by MITRECritical 9.8
In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comtotolink.net
Aug 13, 2025Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms.CVE-2025-52392 · Other software · reported by MITREMedium 5.4
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbeafn28.gitbook.iogithub.com
Aug 8, 2025Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism.CVE-2012-10047 · Other software · Cyclope-Series · reported by VulnCheckCritical 10
Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context.
- Product
- Cyclope Employee Surveillance Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcyclope-series.com
Aug 7, 2025EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.CVE-2024-52680 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.
- Product
- Eyoucms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2025BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security: Sensitive Information ExposureCVE-2025-6722 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_* directory that automatically gets created and stores potentially sensitive files without any access restrictions. This makes it possible for unauthenticated attackers to extract sensitive data from various files like config.ini, debug.log, and more when directory listing is enabled on the server and the ~/wp-content/plugins/index.php file is missing or ignored.
- Product
- BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2025Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused.CVE-2025-6015 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.7
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limitingCVE-2025-50850 · Other software · Cs-cart · reported by MITREHigh 8.6
An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks.
- Product
- Cs-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2025the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameterCVE-2025-8319 · Network & remote access · Barracuda · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611Medium 6.1
the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter
- Product
- Barracuda Message Archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugcrowd.combugcrowd.com
Jul 29, 2025An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.CVE-2025-28171 · Other software · Grandstream · reported by MITREMedium 6.5
An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.
- Product
- Ucm6510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integrationCVE-2025-54529 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.7
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840.CVE-2025-27724 · Other software · MedDream · reported by talos-cna@cisco.comCritical 9.3
A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. A specially crafted .php file can lead to elevated capabilities. An attacker can upload a malicious file to trigger this vulnerability.
- Product
- MedDream PACS Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 26, 2025Melapress Login Security: Authentication BypassCVE-2025-6895 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.
- Product
- Melapress Login Security
- Affected
- 2.1.0 to 2.1.1
- What to do
- Affects 2.1.0 to 2.1.1. Update Melapress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2025HCL IEM is affected by a concurrent login vulnerability.CVE-2025-0251 · Other software · HCL Software · reported by psirt@hcl.comLow 2.6
HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credentials, which may introduce security risks.
- Product
- IEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Jul 24, 2025A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff.CVE-2025-41420 · Other software · WWBN · reported by talos-cna@cisco.comCritical 9.6
A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 24, 2025A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8aCVE-2025-36548 · WordPress plugins & themes · reported by talos-cna@cisco.comHigh 8.3
A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jul 24, 2025Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Unauthenticated login token generationCVE-2025-6441 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and including, 4.03.32. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under certain circumstances, issuing authorization cookies which can lead to authentication bypass.
- Product
- Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
- Affected
- up to 4.03.32
- What to do
- Affects up to 4.03.32. Update Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2025A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and allCVE-2024-12310 · Other software · Imprivata · reported by vulnerability@ncsc.chHigh 7
A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and allows unauthorized access to the underlying Windows system through the already logged-in autologon account due to insufficient handling of keyboard shortcuts. This issue affects Imprivata Enterprise Access Management versions 5.3 through 24.2.
- Product
- Enterprise Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Orion Login with SMS: Authentication BypassCVE-2025-7692 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olws_handle_verify_phone() function not utilizing a strong enough OTP value, exposing the hash needed to generate the OTP value, and no restrictions on the number of attempts to submit the code. This makes it possible for unauthenticated attackers to log in as other users, including administrators, if they have access to their phone number.
- Product
- Orion Login with SMS
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Orion Login with SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 21, 2025Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 beforeCVE-2025-7393 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.
- Product
- Mail Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application.CVE-2025-6235 · Other software · Extreme Networks · reported by 1c053176-eef3-4d6a-ae0b-24728c86587bMedium 5.3
In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's browser under specific interaction conditions. Successful exploitation could lead to exposure of user data or unauthorized actions within the browser context.
- Product
- ExtremeControl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextreme-networks.my.site.com
Jul 18, 2025In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header.CVE-2025-52924 · Other software · One Identity · reported by MITREMedium 4
In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header.
- Product
- OneLogin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoneidentity.comonelogin.service-now.com
Jul 18, 2025LoginPress Pro: Authentication bypassCVE-2025-7444 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- Product
- LoginPress Pro
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordloginpress.prowordfence.com
Jul 16, 2025In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts.CVE-2024-9342 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 6.3
In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/security-guide.html#brute-force-attack-protection .
- Product
- Eclipse Glassfish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34.CVE-2025-34108 · Other software · Flexense · reported by VulnCheckHigh 8.6
A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted HTTP POST request to the /login endpoint with an overly long username parameter, causing a buffer overflow in the libspp.dll component. Successful exploitation allows arbitrary code execution with SYSTEM privileges.
- Product
- Disk Pulse Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.checkpoint.comraw.githubusercontent.com
Jul 10, 2025A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in tCVE-2025-45662 · Other software · Nnproject · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
- Product
- Mpgram Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrary web scripts or HTMCVE-2024-36697 · Other software · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SessionID parameter at query.asp.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authenticatioCVE-2025-37103 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication. Successful exploitation could allow a remote attacker to gain administrative access to the system.
- Product
- HPE Networking Instant On
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.CVE-2024-37657 · Other software · SIR · reported by MITREMedium 6.1
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.
- Product
- Gnuboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint.CVE-2025-45065 · Other software · reported by MITRECritical 9.8
employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.commedium.com
Jul 3, 2025DocCheck Login: Unauthorized post accessCVE-2025-6786 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirecting a user to login on a password protected post after the page has loaded. This makes it possible for unauthenticated attackers to read posts they should not have access to.
- Product
- DocCheck Login
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update DocCheck Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 3, 2025In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.CVE-2025-49618 · Websites & servers · Plesk · reported by MITREMedium 5.8
In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it CVE-2025-27456 · Other software · Endress+Hauser · reported by psirt@sick.deHigh 7.5
The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.
- Product
- Endress+Hauser MEAC300-FNADE4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existingCVE-2025-27451 · Other software · Endress+Hauser · reported by psirt@sick.deMedium 5.3
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
- Product
- Endress+Hauser MEAC300-FNADE4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2025Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband sysCVE-2025-24332 · Other software · Nokia · reported by b48c3b8f-639e-4c16-8725-497bc411dad0High 7.1
Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity boards using the internal bsoc SSH service, which is available only internally within the baseband and through the internal backplane between the boards. The bsoc SSH allows login from one board to another via the baseband internal backplane using an SSH private key present on the baseband system board. This bsoc SSH capability was previously considered an administrative functionality but has now been restricted to be available only to baseband root-privileged administrators. This restriction mitigates the possibility of misuse with lower-level privileges (e.g., from baseband software images). This mitigation is included starting from release 23R4-SR 3.0 MP and later
- Product
- Nokia Single RAN AirScale (Flexi Multiradio is not affected)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2025In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.CVE-2025-52925 · Other software · OneLogin · reported by MITREMedium 5
In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.
- Product
- Active Directory Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoneidentity.comonelogin.service-now.com
Jul 2, 2025WP Front-end login and register: Reflected Cross-Site ScriptingCVE-2024-11405 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Front-end login and register
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Front-end login and register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 1, 2025A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without CVE-2025-34064 · Other software · One Identity · reported by VulnCheckCritical 9
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.
- Product
- OneLogin Active Directory Connector (ADC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspecterops.iosupport.onelogin.com
Jul 1, 2025A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via theCVE-2025-34063 · Other software · One Identity · reported by VulnCheckCritical 10
A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment.
- Product
- OneLogin Active Directory Connector (ADC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspecterops.iosupport.onelogin.com
Jul 1, 2025An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint.CVE-2025-34062 · Other software · One Identity · reported by VulnCheckMedium 5.7
An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext response disclosing sensitive credentials. These may include an API key, AWS IAM access and secret keys, and a base64-encoded JWT signing key used in the tenant’s SSO IdP configuration.
- Product
- OneLogin Active Directory Connector (ADC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspecterops.iosupport.onelogin.com
Jul 1, 2025Custom Login And Signup Widget: Improper Control of Generation of Code ('Code Injection')CVE-2025-49029 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through <= 1.0.
- Product
- Custom Login And Signup Widget
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Custom Login And Signup Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 1, 2025An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available setCVE-2025-41648 · Other software · Pilz · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.
- Product
- IndustrialPI 4 with IndustrialPI webstatus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2023-44915 · Other software · reported by MITREHigh 7.1
A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.