Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,611 results · page 20 of 73
Oct 6, 2025The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access.CVE-2025-9914 · Other software · SICK AG · reported by psirt@sick.deMedium 4.3
The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.
- Product
- Baggage Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025The application provides access to a login protected H2 database for caching purposes.CVE-2025-58583 · Other software · SICK AG · reported by psirt@sick.deMedium 5.3
The application provides access to a login protected H2 database for caching purposes. The username is prefilled.
- Product
- Enterprise Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Redis is an open source, in-memory database that persists on disk.CVE-2025-49844 · Other software · redis · reported by GitHubCritical 9.9
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Redis is an open source, in-memory database that persists on disk.CVE-2025-46819 · Other software · redis · reported by GitHubMedium 6.3
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Redis is an open source, in-memory database that persists on disk.CVE-2025-46818 · Other software · redis · reported by GitHubMedium 6
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Redis is an open source, in-memory database that persists on disk.CVE-2025-46817 · Other software · redis · reported by GitHubHigh 7
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passwoCVE-2025-34210 · Other software · Vasion · reported by VulnCheckCritical 9.4
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passwords, MySQL root password, SaaS keys, Portainer admin password, etc.) in cleartext files that are world-readable. Any local user - or any process that can read the host filesystem - can retrieve all of these secrets in plain text, leading to credential theft and full compromise of the appliance. The vendor does not consider this to be a security vulnerability as this product "follows a shared responsibility model, where administrators are expected to configure persistent storage encryption."
- Product
- Print Virtual Appliance Host
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.printerlogic.comhelp.printerlogic.com
Oct 1, 2025Custom Searchable Data Entry System: Unauthenticated database wipingCVE-2020-36852 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazale_sds_delete_entries_table_row() function. This makes it possible for unauthenticated attackers to completely wipe database tables such as wp_users.
- Product
- Custom Searchable Data Entry System
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Custom Searchable Data Entry System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Sep 26, 2025A flaw was found in the live query subscription mechanism of the database engine.CVE-2025-11060 · Other software · Red Hat · reported by Red HatMedium 5.7
A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.
- Product
- OpenShift Service Mesh 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Sep 25, 2025This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including uCVE-2025-59816 · Other software · Zenitel · reported by cert@ncsc.nlHigh 7.3
This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue.
- Product
- ICX500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zenitel.comwiki.zenitel.com
Sep 25, 2025Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, anCVE-2025-34227 · Other software · Nagios · reported by VulnCheckHigh 8.6
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the fileCVE-2025-10360 · Other software · Perforce · reported by security@puppet.comMedium 6.9
In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled the Infra Assistant feature. The key is used for encrypting one particular bit of data in the Infra Assistant database: the API key for their AI provider account. This has been fixed in Puppet Enterprise version 2025.6, and release notes for 2025.6 have remediation steps for users of affected versions who can't update to the latest version.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially CVE-2025-41715 · Other software · WAGO · reported by info@cert.vde.comCritical 9.8
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
- Product
- Device Sphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025Participants Database: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58008 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3.
- Product
- Participants Database
- Affected
- up to 2.7.6.3
- What to do
- Affects up to 2.7.6.3. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2025CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.CVE-2025-55910 · Other software · Cmseasy · reported by MITREMedium 6.3
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
- Product
- Cmseasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate securCVE-2025-59333 · Other software · executeautomation · reported by GitHubHigh 8.1
The mcp-database-server (MCP Server) 1.1.0 and earlier, as distributed via the npm package @executeautomation/database-server, fails to implement adequate security controls to properly enforce a "read-only" mode. This vulnerability affects only the npm distribution; other distributions are not impacted. As a result, the server is susceptible to abuse and attacks on affected database systems such as PostgreSQL, and potentially others that expose elevated functionalities. These attacks may lead to denial of service and other unexpected behaviors.
- Product
- mcp-database-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025The extension "Form to Database" is susceptible to Cross-Site Scripting.CVE-2025-10316 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aLow 2.3
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
- Product
- Extension "Form to Database" (form_to_database)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2025Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and deleteCVE-2025-10452 · Other software · Gotac · reported by twcert@cert.org.twCritical 9.3
Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents with high-level privileges.
- Product
- Statistical Database System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 9, 2025DuckDB is an analytical in-process SQL database management system.CVE-2025-59037 · Other software · duckdb · reported by GitHubHigh 8.6
DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions `@duckdb/node-api@1.3.3`, `@duckdb/node-bindings@1.3.3`, `duckdb@1.3.3`, and `@duckdb/duckdb-wasm@1.29.2` were affected. DuckDB immediately deprecated the specific versions, engaged npm support to delete the affected verions, and re-released the node packages with higher version numbers (1.3.4/1.30.0). Users may upgrade to versions 1.3.4, 1.30.0, or a higher version to protect themselves. As a workaround, they may also downgrade to 1.3.2 or 1.29.1.
- Product
- duckdb-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025An open database issue exists in the affected product and version.CVE-2025-9364 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an attacker on the intranet accessing sensitive data and potential alteration of data.
- Product
- FactoryTalk® Analytics™ LogixAI®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 8, 2025Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables areCVE-2025-42929 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database.
- Product
- SAP Landscape Transformation Replication Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables areCVE-2025-42916 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality.
- Product
- SAP S/4HANA (Private Cloud or On-Premise)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database.CVE-2025-58450 · Other software · prest · reported by GitHubCritical 9.3
pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a patch to mitigate such attempts.
- Product
- prest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Database to Excel: Cross-Site Request Forgery (CSRF)CVE-2025-58844 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Subhash Kumar Database to Excel database-to-excel allows Stored XSS.This issue affects Database to Excel: from n/a through <= 1.0.
- Product
- Database to Excel
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Database to Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.CVE-2025-0280 · Other software · HCL Software · reported by psirt@hcl.comHigh 7.5
A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
- Product
- Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 29, 2025TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.CVE-2025-8861 · Other software · Changing · reported by twcert@cert.org.twCritical 9.3
TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents.
- Product
- TSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 27, 2025The configuration file containing database logins and passwords is readable by any local user.CVE-2025-30063 · Other software · CGM · reported by cvd@cert.plCritical 9.4
The configuration file containing database logins and passwords is readable by any local user.
- Product
- CGM CLININET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or toCVE-2025-29992 · Other software · Mahara · reported by MITREHigh 7.5
Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy.
- Product
- Mahara
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php.CVE-2025-51092 · Other software · Vishnusivadas · reported by MITRECritical 9.8
The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and signUp() build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareData() function exists, it is insufficient to prevent SQL injection and does not sanitize the table name.
- Product
- Login-signup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabimelsbk.hashnode.dev
Aug 22, 2025Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbCVE-2025-50858 · Other software · Ehcp · reported by MITREMedium 6.1
Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter.
- Product
- Easy Hosting Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsehcp.net
Aug 22, 2025WebITR developed by Uniong has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contenCVE-2025-9255 · Other software · Uniong · reported by twcert@cert.org.twHigh 8.7
WebITR developed by Uniong has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
- Product
- WebITR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 21, 2025SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipulate database contentCVE-2025-50860 · Other software · Ehcp · reported by MITREMedium 5.4
SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter.
- Product
- Easy Hosting Control Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsehcp.net
Aug 20, 2025Directus is a real-time API and App dashboard for managing SQL database content.CVE-2025-55746 · Other software · directus · reported by GitHubCritical 9.3
Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
- Product
- directus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025aiven-db-migrate is an Aiven database migration tool.CVE-2025-55283 · Other software · aiven · reported by GitHubCritical 9.1
aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows elevation to superuser inside PostgreSQL databases during a migration from an untrusted source server. The vulnerability stems from psql executing commands embedded in a dump from the source server. This vulnerability is fixed in 1.0.7.
- Product
- aiven-db-migrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025aiven-db-migrate is an Aiven database migration tool.CVE-2025-55282 · Other software · aiven · reported by GitHubCritical 9.1
aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser inside PostgreSQL databases during a migration from an untrusted source server. By exploiting a lack of search_path restriction, an attacker can override pg_catalog and execute untrusted operators as a superuser. This vulnerability is fixed in 1.0.7.
- Product
- aiven-db-migrate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025Firebird is a relational database.CVE-2025-54989 · Other software · FirebirdSQL · reported by GitHubMedium 5.3
Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.
- Product
- firebird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025Firebird is a relational database.CVE-2025-24975 · Other software · FirebirdSQL · reported by GitHubHigh 7.1
Firebird is a relational database. Prior to snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609, Firebird is vulnerable if ExtConnPoolSize is not set equal to 0. If connections stored in ExtConnPool are not verified for presence and suitability of the CryptCallback interface is used when created versus what is available could result in a segfault in the server process. Encrypted databases, accessed by execute statement on external, may be accessed later by an attachment missing a key to that database. In a case when execute statement are chained, segfault may happen. Additionally, the segfault may affect unencrypted databases. This issue has been patched in snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609 and point releases 4.0.6 and 5.0.2. A workaround for this issue involves setting ExtConnPoolSize equal to 0 in firebird.conf.
- Product
- firebird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025WP-Database-Optimizer-Tools: Cross-Site Request Forgery (CSRF)CVE-2025-53219 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pl4g4 WP-Database-Optimizer-Tools wp-database-optimizer-tools allows Cross Site Request Forgery.This issue affects WP-Database-Optimizer-Tools: from n/a through <= 0.2.
- Product
- WP-Database-Optimizer-Tools
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update WP-Database-Optimizer-Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2025Active Record connects classes to relational database tables.CVE-2025-55193 · Other software · rails · reported by GitHubLow 2.7
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature.CVE-2012-10059 · Other software · Dolibarr Project · reported by VulnCheckCritical 9.4
Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.
- Product
- ERP/CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comseclists.org
Aug 13, 2025Database for Contact Form 7, WPforms, Elementor forms: PHP Object InjectionCVE-2025-7384 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
- Product
- Database for Contact Form 7, WPforms, Elementor forms
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 12, 2025Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database.CVE-2025-55165 · Other software · gelbphoenix · reported by GitHubHigh 8.2
Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.
- Product
- autocaliweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key.CVE-2025-26398 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.6
SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.
- Product
- Database Performance Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Aug 11, 2025Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the correspondinCVE-2025-42951 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result , it has a high impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP Business One (SLD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs.CVE-2025-48709 · Other software · BMC · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 4.8
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.
- Product
- Control-M/Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2025Cancelling a query (e.g.CVE-2025-47907 · Other software · Go standard library · reported by security@golang.orgHigh 7
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
- Product
- database/sql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request.CVE-2025-51532 · Other software · Sagedpw · reported by MITREHigh 7.5
Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The vendor has stated that the issue is fixed in 2025_06_000, released in June 2025.
- Product
- Sage DPW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec4you-pentest.comsec4you-pentest.com
Aug 5, 2025A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/.CVE-2025-51541 · Other software · Shopware · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_schema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript. This vulnerability can be exploited via a Cross-Site Request Forgery (CSRF) attack due to the absence of CSRF protections on the POST request. An unauthenticated remote attacker can craft a malicious web page that, when visited by a victim, stores the payload persistently in the installation configuration. As a result, the payload executes whenever any user subsequently accesses the vulnerable installation page, leading to persistent client-side code execution.
- Product
- Shopware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comdax-tokaido.com
Aug 4, 2025ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases.CVE-2025-54119 · Other software · ADOdb · reported by GitHubCritical 10
ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. In versions 5.22.9 and below, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database and calls the metaColumns(), metaForeignKeys() or metaIndexes() methods with a crafted table name. This is fixed in version 5.22.10. To workaround this issue, only pass controlled data to metaColumns(), metaForeignKeys() and metaIndexes() method's $table parameter.
- Product
- ADOdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 20251Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server.CVE-2025-54424 · Other software · 1Panel-dev · reported by GitHubHigh 8.1
1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate verification during certificate validation, leading to unauthorized interface access. Due to the presence of numerous command execution or high-privilege interfaces in 1Panel, this results in Remote Code Execution (RCE). This is fixed in version 2.0.6. The CVE has been translated from Simplified Chinese using GitHub Copilot.
- Product
- 1Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.