Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,272 results · page 19 of 66
Nov 6, 2025The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services.CVE-2025-12636 · Other software · Ubia · reported by ics-cert@hq.dhs.govHigh 7.1
The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of settings.
- Product
- Ubox Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2025Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet,CVE-2025-34501 · Other software · Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. · reported by VulnCheckHigh 7
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.
- Product
- Deck Mate 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordioactive.comvulncheck.com
Nov 3, 2025The privileged user could log in without sufficient credentials after enabling an application protocol.CVE-2025-48397 · Other software · Eaton · reported by CybersecurityCOE@eaton.comHigh 7.1
The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
- Product
- Eaton Brightlayer Software Suite (BLSS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes ovCVE-2025-34271 · Other software · Nagios · reported by VulnCheckHigh 8.7
Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.
- Product
- Log Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerabilCVE-2025-61121 · Other software · reported by MITREHigh 7.5
Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handling of cloud service credentials may allow attackers to obtain them and carry out unauthorized actions, such as sensitive information disclosure and abuse of cloud resources. Successful exploitation could result in privacy breaches and misuse of the platform infrastructure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2025A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of CVE-2025-64148 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- Product
- Jenkins Publish to Bitbucket Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjenkins.ioopenwall.com
Oct 28, 2025Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts, allowing attackers CVE-2025-60858 · Other software · reported by MITREHigh 7.5
Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts, allowing attackers to intercept or extract sensitive information.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybermaya.inreolink.com
Oct 28, 2025An unauthenticated user can connect to a publicly accessible database using arbitrary credentials.CVE-2025-9313 · Other software · Asseco Poland S.A. · reported by cvd@cert.plCritical 9.3
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5.
- Product
- mMedica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plmmedica.asseco.pl
Oct 28, 2025Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may allow an attacker within the local network to log in to the affecteCVE-2025-62777 · Other software · PLANEX COMMUNICATIONS INC. · reported by vultures@jpcert.or.jpHigh 8.7
Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may allow an attacker within the local network to log in to the affected device via Telnet and execute arbitrary commands.
- Product
- MZK-DP300N
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2025Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.CVE-2025-12218 · Other software · Azure Access Technology · reported by a0340c66-c385-4f8b-991b-3d05f6fd5220Critical 10
Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- Product
- BLU-IC2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025OpenBao's AWS Plugin generates AWS access credentials based on IAM policies.CVE-2025-59048 · Other software · openbao · reported by GitHubHigh 8.1
OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. This vulnerability has been patched in version 0.1.1 of the auth-aws plugin. A workaround for this issue involves guaranteeing that IAM role names are unique across all AWS accounts that could potentially interact with your OpenBao environment, and to audit for any duplicate IAM roles.
- Product
- openbao-plugins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising CVE-2025-62398 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 5.4
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 22, 2025TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.CVE-2025-56447 · Other software · reported by MITRECritical 9.8
TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 22, 2025Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK.CVE-2025-41110 · Other software · Ghost Robotics · reported by cve-coordination@incibe.esHigh 7
Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK. This vulnerability allows an attacker to connect to the robot's WiFi and view all its data, as it runs on ROS 2 without default authentication. In addition, the attacker can connect via SSH and gain full control of the robot, which could cause physical damage to the robot itself or its environment.
- Product
- Vision 60
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2025The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing attacCVE-2025-56801 · Other software · Reolink · reported by MITREMedium 5.1
The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier's position is that material is not hardcoded and is instead randomly generated on each installation of the application.
- Product
- Reolink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comshinycolumn.notion.site
Oct 21, 2025Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.CVE-2025-11625 · Other software · wolfSSL · reported by facts@wolfssl.comCritical 9.4
Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.
- Product
- wolfSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers.CVE-2025-6950 · Other software · Moxa · reported by psirt@moxa.comCritical 9.9
An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allows an unauthenticated attacker to forge valid tokens, thereby bypassing authentication controls and impersonating any user. Exploitation of this vulnerability can result in complete system compromise, enabling unauthorized access, data theft, and full administrative control over the affected device. While successful exploitation can severely impact the confidentiality, integrity, and availability of the affected device itself, there is no loss of confidentiality or integrity within any subsequent systems.
- Product
- EDR-G9010 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.CVE-2024-42192 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications.
- Product
- Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Oct 16, 2025Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26).CVE-2025-60639 · Other software · reported by MITREMedium 6.5
Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remoCVE-2025-34516 · Other software · Ilevia Srl. · reported by VulnCheckCritical 9.3
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.
- Product
- EVE X1 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordilevia.comvulncheck.com
Oct 16, 2025IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores user credentials in cCVE-2025-36002 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores user credentials in configuration files which can be read by a local user.
- Product
- Sterling B2B Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and acCVE-2025-41718 · Other software · Murrelektronik · reported by info@cert.vde.comHigh 7.5
A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.
- Product
- Firmware Impact67 Pro 54630
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmurrelektronik.csaf-tp.certvde.com
Oct 14, 2025An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.CVE-2025-41705 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 6.8
An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
- Product
- QUINT4-UPS/24DC/24DC/5/EIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comseclists.org
Oct 9, 2025The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation.CVE-2025-60375 · Other software · reported by MITREHigh 7.3
The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and password parameters in the login request, an attacker can gain unauthorized access to user accounts, including administrative accounts, without providing valid credentials.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'.CVE-2025-35054 · Other software · Newforma · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.
- Product
- Project Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Oct 8, 2025Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials CVE-2025-48464 · Other software · DuckDuckGo · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Medium 4.7
Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.
- Product
- DuckDuckGo Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtuxplorer.comcsa.gov.sg
Oct 7, 2025Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked.CVE-2025-37728 · Other software · Elastic · reported by security@elastic.coMedium 5.4
Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Oct 6, 2025The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials.CVE-2025-59450 · Other software · YoSmart · reported by MITREMedium 4.3
The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials.
- Product
- YoLink Smart Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbishopfox.combishopfox.com
Oct 6, 2025The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access.CVE-2025-9914 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025If a user tries to login but the provided credentials are incorrect a log is created.CVE-2025-58582 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.
- Product
- Enterprise Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Use of Hard-coded Credentials vulnerability in Logo Software Inc.CVE-2025-10609 · Other software · Logo Software Inc. · reported by iletisim@usom.gov.trMedium 5.9
Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects TigerWings ERP: from 01.01.00 before 3.03.00.
- Product
- TigerWings ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Oct 2, 2025Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production firmCVE-2025-59409 · Other software · Flocksafety · reported by MITREHigh 7.5
Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production firmware.
- Product
- License Plate Reader Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
Oct 2, 2025Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passwoCVE-2025-34210 · Other software · Vasion · reported by VulnCheckCritical 9.4
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passwords, MySQL root password, SaaS keys, Portainer admin password, etc.) in cleartext files that are world-readable. Any local user - or any process that can read the host filesystem - can retrieve all of these secrets in plain text, leading to credential theft and full compromise of the appliance. The vendor does not consider this to be a security vulnerability as this product "follows a shared responsibility model, where administrators are expected to configure persistent storage encryption."
- Product
- Print Virtual Appliance Host
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.printerlogic.comhelp.printerlogic.com
Oct 2, 2025Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd.CVE-2025-0642 · Other software · PosCube Hardware Software and Consulting Ltd. Co. · reported by iletisim@usom.gov.trMedium 6.3
Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allows Excavation, Authentication Bypass. This issue affects Assist: through 10.02.2025.
- Product
- Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 29, 2025The credentials required to access the device's web server are sent in base64 within the HTTP headers.CVE-2025-11155 · Other software · SATO · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Medium 6.8
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials.
- Product
- S86-ex 203dpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug shell exposed via TCVE-2025-57428 · Other software · reported by MITREMedium 6.5
Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug shell exposed via Telnet on Port 23 and execute hardware-level flash and register manipulation commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietaryCVE-2025-10880 · Other software · Dingtian · reported by ics-cert@hq.dhs.govHigh 8.7
All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietary "Dingtian Binary" protocol password by sending an unauthenticated GET request.
- Product
- DT-R002
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current usCVE-2025-10879 · Other software · Dingtian · reported by ics-cert@hq.dhs.govHigh 8.7
All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current user's username without authentication.
- Product
- DT-R002
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog.CVE-2025-10542 · Other software · iMonitor Software Inc. · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 9.8
iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM server and gain full control over monitored agents and data. This enables reading highly sensitive telemetry (including keylogger output) and issuing arbitrary actions to all connected clients.
- Product
- iMonitor EAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
Sep 22, 2025Helpie FAQ: Use of Hard-coded CredentialsCVE-2025-58659 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Use of Hard-coded Credentials vulnerability in Essekia Helpie FAQ helpie-faq allows Retrieve Embedded Sensitive Data.This issue affects Helpie FAQ: from n/a through <= 1.45.
- Product
- Helpie FAQ
- Affected
- up to 1.45
- What to do
- Affects up to 1.45. Update Helpie FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Estonian Shipping Methods for WooCommerce: Use of Hard-coded CredentialsCVE-2025-58656 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Use of Hard-coded Credentials vulnerability in Risto Niinemets Estonian Shipping Methods for WooCommerce estonian-shipping-methods-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Estonian Shipping Methods for WooCommerce: from n/a through <= 1.7.2.
- Product
- Estonian Shipping Methods for WooCommerce
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Estonian Shipping Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP Project Manager: Use of Hard-coded CredentialsCVE-2025-58269 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.
- Product
- WP Project Manager
- Affected
- up to 2.6.25
- What to do
- Affects up to 2.6.25. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation.CVE-2025-35042 · Other software · Airship AI · reported by 9119a7d8-5eab-497f-8521-727c672e3725Critical 9.3
Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account password are vulnerable to a remote attacker logging in and gaining the privileges of this account. Fixed in 10.2.35, 11.0.21, and 11.1.9.
- Product
- Acropolis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Sep 22, 2025Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials.CVE-2025-35041 · Other software · Airship AI · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 7.7
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.
- Product
- Acropolis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comcve.org
Sep 22, 2025Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary coCVE-2025-10009 · Other software · Invoice Ninja · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166High 8.6
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.
- Product
- Invoice Ninja 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025Hardcoded credentials in default configuration of PPress 0.0.9.CVE-2025-52159 · Other software · Yandaozi · reported by MITREHigh 8.8
Hardcoded credentials in default configuration of PPress 0.0.9.
- Product
- Ppress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credentiCVE-2025-34200 · Other software · Vasion · reported by VulnCheckHigh 8.6
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credentials in clear-text inside /etc/issue, and the file is world-readable by default. An attacker with local shell access can read /etc/issue to obtain the network account username and password. Using the network account an attacker can change network parameters via the appliance interface, enabling local misconfiguration, network disruption or further escalation depending on deployment.
- Product
- Print Virtual Appliance Host
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.printerlogic.comhelp.printerlogic.com
Sep 18, 2025H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials.CVE-2025-57295 · Other software · H3c · reported by MITREHigh 8
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.
- Product
- Magic Nx15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials.CVE-2025-47698 · Other software · Cognex · reported by ics-cert@hq.dhs.govHigh 8.6
An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present during the firmware upgrade procedure.
- Product
- In-Sight 2000 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means.CVE-2025-30519 · Other software · Dover Fueling Solutions · reported by ics-cert@hq.dhs.govCritical 9.3
Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gain administrative access to the system.
- Product
- ProGauge MagLink LX 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govdoverfuelingsolutions.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.