Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,939 results · page 18 of 119
Nov 18, 2025Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to maCVE-2025-63828 · Other software · Backdropcms · reported by MITREMedium 6.1
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.
- Product
- Backdrop CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.CVE-2025-56527 · Other software · Cinnamon · reported by MITREHigh 7.5
Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.
- Product
- Kotaemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password CVE-2025-55796 · Other software · Openml · reported by MITREHigh 7.5
The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted as "%d %H:%M:%S" without incorporating any user-specific data or cryptographic randomness. This predictability allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirmation, password resets, and email change approvals, potentially leading to account takeover.
- Product
- Openml Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2025The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validatCVE-2025-63800 · Other software · Opensourcepos · reported by MITREHigh 7.5
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts.
- Product
- Open Source Point Of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus pCVE-2025-31649 · Other software · Broadcom · reported by talos-cna@cisco.comHigh 8.7
A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call to trigger this vulnerability.
- Product
- BCM5820X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comdell.com
Nov 14, 2025General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attaCVE-2025-55034 · Other software · General Industrial Controls · reported by ics-cert@hq.dhs.govHigh 8.8
General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.
- Product
- Lynx+ Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2025Vodafone H500s devices running firmware v3.5.10 (hardware model Sercomm VFH500) expose the WiFi access point password via an unauthenticated HTTP endpoint.CVE-2022-4985 · Other software · Vodacom · reported by VulnCheckHigh 8.7
Vodafone H500s devices running firmware v3.5.10 (hardware model Sercomm VFH500) expose the WiFi access point password via an unauthenticated HTTP endpoint. By sending a crafted GET request to /data/activation.json with specific headers and cookies, a remote attacker can retrieve a JSON document that contains the wifi_password field. This allows an unauthenticated attacker to obtain the WiFi credentials and gain unauthorized access to the wireless network, compromising confidentiality of network traffic and attached systems.
- Product
- Vodafone H500s
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comhelp.vodacom.co.za
Nov 14, 2025Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulneCVE-2025-8855 · Other software · Optimus Software · reported by iletisim@usom.gov.trHigh 8.1
Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71.
- Product
- Brokerage Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 14, 2025Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hCVE-2025-11794 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.9
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSIDCVE-2025-63353 · Other software · Fiberhome · reported by MITRECritical 9.8
A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction.
- Product
- Hg6145f1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the CVE-2025-63666 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC15 v15.03.05.18_multi) issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to access protected resources.
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.CVE-2025-6571 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 6
A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025A vulnerability was identified in the password generation algorithm when accessing the debug-interface.CVE-2025-41731 · Other software · Jumo · reported by info@cert.vde.comHigh 7.4
A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.
- Product
- variTRON300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjumo.csaf-tp.certvde.com
Nov 9, 2025EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the CVE-2025-12866 · Other software · Hundred Plus · reported by twcert@cert.org.twCritical 9.3
EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.
- Product
- EIP Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 7, 2025Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'.CVE-2025-46413 · Other software · BUFFALO INC. · reported by vultures@jpcert.or.jpMedium 5.3
Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacker.
- Product
- WSR-1800AX4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting CVE-2025-12808 · Other software · Devolutions · reported by security@devolutions.netMedium 6.5
Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure. This issue affects the following versions : * Devolutions Server 2025.3.2.0 through 2025.3.5.0 * Devolutions Server 2025.2.15.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (containing a publicly CVE-2025-59392 · Other software · Elspec-ltd · reported by MITREMedium 6.8
On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (containing a publicly documented reset string) into a USB port.
- Product
- G5dfr Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelspec-ltd.comelspec-ltd.com
Nov 5, 2025Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control ofCVE-2025-46364 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control of system.
- Product
- CloudLin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell CVE-2025-45379 · Other software · Dell · reported by security_alert@emc.comHigh 8.4
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system.CVE-2025-30479 · Other software · Dell · reported by security_alert@emc.comHigh 8.4
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Ace User Management: Does not properly validate that a password reset token is associated with the user who requested itCVE-2025-6027 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.
- Product
- Ace User Management
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Ace User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2025The Survision LPR Camera system does not enforce password protection by default.CVE-2025-12108 · Other software · Survision · reported by ics-cert@hq.dhs.govCritical 9.3
The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately without a login prompt or credentials check.
- Product
- License Plate Recognition Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to auCVE-2024-13998 · Other software · Nagios · reported by VulnCheckMedium 6
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter.CVE-2025-63443 · Other software · School Management System PHP Project · reported by MITREMedium 5.4
School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter.
- Product
- School Management System PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change.CVE-2025-63563 · Other software · Summerpearlgroup · reported by MITREMedium 6.5
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.
- Product
- Vacation Rental Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the sub_426EF8 function.CVE-2025-63466 · Other software · Totolink · reported by MITREHigh 7.5
Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the sub_426EF8 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- Lr350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12552 · Other software · Azure Access Technology · reported by a0340c66-c385-4f8b-991b-3d05f6fd5220Medium 6.9
Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- Product
- BLU-IC2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is CVE-2025-62232 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue.
- Product
- Apache APISIX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 30, 2025Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field duriCVE-2025-34270 · Other software · Nagios · reported by VulnCheckMedium 6.9
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.nagios.comnagios.com
Oct 30, 2025Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed.CVE-2024-13996 · Other software · Nagios · reported by VulnCheckCritical 9.2
Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password.CVE-2025-63423 · Other software · reported by MITREHigh 7.5
Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.CVE-2025-62257 · Other software · Liferay · reported by security@liferay.comMedium 6.3
Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user’s password even if account lockout is enabled via brute force attack.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)CVE-2025-54548 · Other software · Arista Networks · reported by psirt@arista.comMedium 4.3
On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)
- Product
- DANZ Monitoring Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025MLflow Weak Password Requirements Authentication Bypass Vulnerability.CVE-2025-11200 · Other software · MLflow · reported by zdi-disclosures@trendmicro.comCritical 9.8
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
- Product
- MLflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Oct 29, 2025A stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1.0.0P220507 via the password field.CVE-2024-45162 · Other software · reported by MITRECritical 9.8
A stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1.0.0P220507 via the password field.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblu-castle.comgruppotim.it
Oct 27, 2025Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12364 · Other software · Azure Access Technology · reported by a0340c66-c385-4f8b-991b-3d05f6fd5220Critical 10
Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- Product
- BLU-IC2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12363 · Other software · Azure Access Technology · reported by a0340c66-c385-4f8b-991b-3d05f6fd5220Critical 10
Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- Product
- BLU-IC2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php.CVE-2025-61247 · Other software · reported by MITREHigh 8.2
indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2025Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12285 · Other software · Azure Access Technology · reported by a0340c66-c385-4f8b-991b-3d05f6fd5220Critical 10
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- Product
- BLU-IC2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2025Password Policy Manager | Password Manager: Unauthorized modification of dataCVE-2025-11255 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log out the site's connection to miniorange.
- Product
- Password Policy Manager | Password Manager
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Password Policy Manager | Password Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025Password Protected: Authorization bypassCVE-2025-11244 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the "Use transients" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the "Use transients" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers.
- Product
- Password Protected
- Affected
- up to 2.7.11
- What to do
- Affects up to 2.7.11. Update Password Protected to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Oct 24, 2025Microweber CMS 2.0 has Weak Password Requirements.CVE-2025-60954 · Other software · Microweber · reported by MITREHigh 8.3
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 24, 2025An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and CVE-2025-46185 · Other software · reported by MITREMedium 6.2
An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and usernames.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19.CVE-2025-61977 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 7.3
A weak password recovery mechanism for forgotten password vulnerability was discovered in Productivity Suite software version v4.4.1.19. The vulnerability allows an attacker to decrypt an encrypted project by answering just one recovery question.
- Product
- Productivity Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.automationdirect.com
Oct 23, 2025A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning CVE-2025-61136 · Other software · reported by MITREHigh 7.1
A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.github.com
Oct 23, 2025A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning anCVE-2025-61132 · Other software · reported by MITREHigh 7.1
A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.github.com
Oct 23, 2025Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attackCVE-2025-62399 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 7.5
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 22, 2025Password only login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48093 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through <= 0.2.
- Product
- Password only login
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Password only login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.CVE-2025-62775 · Other software · Mercku · reported by MITREHigh 8
Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.
- Product
- M6a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.nullvoid.meseclists.org
Oct 22, 2025Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks.CVE-2025-62771 · Other software · Mercku · reported by MITREHigh 7.5
Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks.
- Product
- M6a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.nullvoid.meseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.