Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,805 results · page 21 of 57
May 30, 2025Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision.CVE-2025-48381 · Other software · cvat-ai · reported by GitHubMedium 5.3
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels, and the IDs of all jobs and quality reports on the CVAT instance. In addition, if the instance contains many resources of a particular type, retrieving this information may tie up system resources, denying access to legitimate users. This issue has been patched in version 2.38.0.
- Product
- cvat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application.CVE-2025-4009 · Other software · Evertz · reported by research@onekey.comCritical 9.3
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). CVE-2025-4009 covers the command injection in feature-transfer-import.php CVE-2025-10364 covers the command injection in feature-transfer-export.php Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others.
- Product
- 3080ipx-10G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025WP YouTube Video Optimizer: Stored Cross-Site ScriptingCVE-2025-4217 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP YouTube Video Optimizer
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP YouTube Video Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 19, 2025WordPress Video Robot - The Ultimate Video Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.
- Product
- WordPress Video Robot - The Ultimate Video Importer
- Affected
- up to 1.20.0
- What to do
- Affects up to 1.20.0. Update WordPress Video Robot - The Ultimate Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Broadcast Live Video: Cross-Site Request Forgery (CSRF)CVE-2025-48255 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through <= 6.2.4.
- Product
- Broadcast Live Video
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update Broadcast Live Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Video Player & FullScreen Video Background: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47567 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Video Player & FullScreen Video Background universal-video-player-and-bg allows Blind SQL Injection.This issue affects Video Player & FullScreen Video Background: from n/a through <= 2.4.1.
- Product
- Video Player & FullScreen Video Background
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Video Player & FullScreen Video Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Multimedia Responsive Carousel with Image Video Audio Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31928 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Multimedia Responsive Carousel with Image Video Audio Support multimedia-carousel allows SQL Injection.This issue affects Multimedia Responsive Carousel with Image Video Audio Support: from n/a through <= 2.6.0.
- Product
- Multimedia Responsive Carousel with Image Video Audio Support
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Multimedia Responsive Carousel with Image Video Audio Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Simple Video Directory: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6809 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Simple Video Directory
- Fixed in
- 1.4.3
- What to do
- Update Simple Video Directory to 1.4.3 or newer.
May 15, 2025Offload Videos: Does not have CSRF check in placeCVE-2024-6719 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack
- Product
- Offload Videos
- Fixed in
- 1.0.1
- What to do
- Update Offload Videos to 1.0.1 or newer.
May 14, 2025motionEye is an online interface for the software motion, a video surveillance program with motion detection.CVE-2025-47782 · Other software · motioneye-project · reported by GitHubHigh 8.9
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.
- Product
- motioneye
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp.CVE-2025-43858 · Other software · Bluegrams · reported by GitHubCritical 9.2
YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting `yt-dlp` from a commands prompt running on Windows OS with the `UseWindowsEncodingWorkaround` value defined to true (default behavior). If a user is using built-in methods from the YoutubeDL.cs file, the value is true by default and a user cannot disable it from these methods. This issue has been patched in version 1.1.2.
- Product
- YoutubeDLSharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code vCVE-2025-25985 · Other software · Macro-video · reported by MITRELow 2.6
An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via the /mnt/mtd/mvconf/wifi.ini and /mnt/mtd/mvconf/user_info.ini components.
- Product
- V380e6 C1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code vCVE-2025-25984 · Other software · Macro-video · reported by MITREMedium 6.8
An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via UART component.
- Product
- V380e6 C1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive CVE-2025-25983 · Other software · Macro-video · reported by MITRELow 3.4
An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based sharing component.
- Product
- V380 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Related Videos for JW Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32516 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ilGhera Related Videos for JW Player related-videos-for-jw-player allows Reflected XSS.This issue affects Related Videos for JW Player: from n/a through <= 1.2.0.
- Product
- Related Videos for JW Player
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Related Videos for JW Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Paid Videochat Turnkey Site: Weak Password Recovery Mechanism for Forgotten PasswordCVE-2025-31380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Weak Password Recovery Mechanism for Forgotten Password vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Password Recovery Exploitation.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.11.
- Product
- Paid Videochat Turnkey Site
- Affected
- up to 7.3.11
- What to do
- Affects up to 7.3.11. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WooCommerce HTML5 Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27343 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilop WooCommerce HTML5 Video woocommerce-html5-video allows Reflected XSS.This issue affects WooCommerce HTML5 Video: from n/a through <= 1.7.10.
- Product
- WooCommerce HTML5 Video
- Affected
- up to 1.7.10
- What to do
- Affects up to 1.7.10. Update WooCommerce HTML5 Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WP Video Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27308 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmstactics WP Video Posts wp-video-posts allows Reflected XSS.This issue affects WP Video Posts: from n/a through <= 3.5.1.
- Product
- WP Video Posts
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update WP Video Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 14, 2025TS Poll – Survey, Versus Poll, Image Poll, Video Poll: SQL InjectionCVE-2025-3470 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the s parameter in all versions up to, and including, 2.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- TS Poll – Survey, Versus Poll, Image Poll, Video Poll
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update TS Poll – Survey, Versus Poll, Image Poll, Video Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmebroccoli.blogspot.complugins.trac.wordpress.org
Apr 11, 2025HTML5 Video Player with Playlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandeep Verma HTML5 Video Player with Playlist html5-video-player-with-playlist allows Reflected XSS.This issue affects HTML5 Video Player with Playlist: from n/a through <= 2.50.
- Product
- HTML5 Video Player with Playlist
- Affected
- up to 2.50
- What to do
- Affects up to 2.50. Update HTML5 Video Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Workbox Video from Vimeo & Youtube: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32534 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Workbox Workbox Video from Vimeo & Youtube workbox-video-from-vimeo-youtube-plugin allows Reflected XSS.This issue affects Workbox Video from Vimeo & Youtube: from n/a through <= 3.2.2.
- Product
- Workbox Video from Vimeo & Youtube
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Workbox Video from Vimeo & Youtube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2025Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.CVE-2024-45552 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Video Playlist For YouTube: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32183 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Galaxy Weblinks Video Playlist For YouTube video-playlist-for-youtube allows Stored XSS.This issue affects Video Playlist For YouTube: from n/a through <= 6.7.1.
- Product
- Video Playlist For YouTube
- Affected
- up to 6.7.1
- What to do
- Affects up to 6.7.1. Update Video Playlist For YouTube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Video & Photo Gallery for Ultimate Member: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32121 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows SQL Injection.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.3.
- Product
- Video & Photo Gallery for Ultimate Member
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Videos: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-31384 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Aviplugins Videos allows Reflected XSS.This issue affects Videos: from n/a through 1.0.5.
- Product
- Videos
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.CVE-2025-29647 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025WP Video Playlist: Missing AuthorizationCVE-2025-31581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Sandeep Kumar WP Video Playlist wp-video-playlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Video Playlist: from n/a through <= 1.1.2.
- Product
- WP Video Playlist
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Video Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025Video Url: Reflected Cross-Site ScriptingCVE-2025-3098 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Video Url
- Affected
- up to 1.0.0.3
- What to do
- Affects up to 1.0.0.3. Update Video Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 1, 2025Automatic Featured Images from Videos: Missing AuthorizationCVE-2025-31820 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.4.
- Product
- Automatic Featured Images from Videos
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Rio Video Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-31566 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in riosisgroup Rio Video Gallery rio-video-gallery allows Stored XSS.This issue affects Rio Video Gallery: from n/a through <= 2.3.6.
- Product
- Rio Video Gallery
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Rio Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025ULTIMATE VIDEO GALLERY: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22566 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb ULTIMATE VIDEO GALLERY ultimate-gallery allows Reflected XSS.This issue affects ULTIMATE VIDEO GALLERY: from n/a through <= 1.4.
- Product
- ULTIMATE VIDEO GALLERY
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update ULTIMATE VIDEO GALLERY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Video Embedder: Cross-Site Request Forgery (CSRF)CVE-2025-31458 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in forsgren Video Embedder video-embedder allows Stored XSS.This issue affects Video Embedder: from n/a through <= 1.7.1.
- Product
- Video Embedder
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Video Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Video & Photo Gallery for Ultimate Member: Server-Side Request Forgery (SSRF)CVE-2025-22672 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.2.
- Product
- Video & Photo Gallery for Ultimate Member
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Video Share VOD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26583 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Video Share VOD video-share-vod allows Reflected XSS.This issue affects Video Share VOD: from n/a through <= 2.7.9.
- Product
- Video Share VOD
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update Video Share VOD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 22, 2025Multi Video Box: Reflected Cross-Site ScriptingCVE-2025-2484 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'video_id' and 'group_id' parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Multi Video Box
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Multi Video Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2025A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack.CVE-2024-8966 · Other software · gradio-app · reported by security@huntr.devHigh 7.5
A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render Gradio inaccessible for extended periods, disrupting services and causing significant downtime.
- Product
- gradio-app/gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025A vulnerability regarding out-of-bounds read is found in the video interface.CVE-2024-11131 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.2.0-0525 may be affected: BC500, CC400W and TC500.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2025On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream.CVE-2025-30111 · Other software · reported by MITREHigh 7.5
On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained access through other means, to list and download recorded videos, as well as access live video streams without proper authentication.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comiroad-dashcam.nl
Mar 11, 2025Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.CVE-2025-24988 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.CVE-2025-24987 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.CVE-2025-24055 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2025Ultimate Video Player WordPress & WooCommerce: Directory TraversalCVE-2024-10804 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate Video Player WordPress & WooCommerce Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 10.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Ultimate Video Player WordPress & WooCommerce
- Affected
- up to 10.0
- What to do
- Affects up to 10.0. Update Ultimate Video Player WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 6, 2025In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: Fix an error check in npcm_video_ece_init() When function of_find_device_bCVE-2024-58082 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: media: nuvoton: Fix an error check in npcm_video_ece_init() When function of_find_device_by_node() fails, it returns NULL instead of an error code. So the corresponding error check logic should be modified to check whether the return value is NULL and set the error code to be returned as -ENODEV.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 6, 2025In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device fCVE-2024-58079 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device. If we unbind the driver from the usb interface, the cleanup functions are never called. In our case, the IRQ is never disabled. If an IRQ is triggered, it will try to access memory sections that are already free, causing an OOPS. We cannot use the function devm_request_threaded_irq here. The devm_* clean functions may be called after the main structure is released by uvc_delete. Luckily this bug has small impact, as it is only affected by devices with gpio units and the user has to unbind the device, a disconnect will not trigger this error.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 6, 2025In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock during uvc_probe If uvc_probe() fails, it can end up callingCVE-2024-58059 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock during uvc_probe If uvc_probe() fails, it can end up calling uvc_status_unregister() before uvc_status_init() is called. Fix this by checking if dev->status is NULL or not in uvc_status_unregister().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 6, 2025Out-of-bounds read in applying binary of video content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.CVE-2025-20919 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Out-of-bounds read in applying binary of video content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.
- Product
- Samsung Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Mar 3, 2025Photo Video Store: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23478 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsaccount Photo Video Store photo-video-store allows Reflected XSS.This issue affects Photo Video Store: from n/a through <= 21.07.
- Product
- Photo Video Store
- Affected
- up to 21.07
- What to do
- Affects up to 21.07. Update Photo Video Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Information disclosure may occur due to improper permission and access controls to Video Analytics engine.CVE-2024-53011 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.9
Information disclosure may occur due to improper permission and access controls to Video Analytics engine.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: drm/ast: astdp: Fix timeout for enabling video signal The ASTDP transmitter sometimes takeCVE-2025-21747 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm/ast: astdp: Fix timeout for enabling video signal The ASTDP transmitter sometimes takes up to 1 second for enabling the video signal, while the timeout is only 200 msec. This results in a kernel error message. Increase the timeout to 1 second. An example of the error message is shown below. [ 697.084433] ------------[ cut here ]------------ [ 697.091115] ast 0000:02:00.0: [drm] drm_WARN_ON(!__ast_dp_wait_enable(ast, enabled)) [ 697.091233] WARNING: CPU: 1 PID: 160 at drivers/gpu/drm/ast/ast_dp.c:232 ast_dp_set_enable+0x123/0x140 [ast] [...] [ 697.272469] RIP: 0010:ast_dp_set_enable+0x123/0x140 [ast] [...] [ 697.415283] Call Trace: [ 697.420727] <TASK> [ 697.425908] ? show_trace_log_lvl+0x196/0x2c0 [ 697.433304] ? show_trace_log_lvl+0x196/0x2c0 [ 697.440693] ? drm_atomic_helper_commit_modeset_enables+0x30a/0x470 [ 697.450115] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.458059] ? __warn.cold+0xaf/0xca [ 697.464713] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.472633] ? report_bug+0x134/0x1d0 [ 697.479544] ? handle_bug+0x58/0x90 [ 697.486127] ? exc_invalid_op+0x13/0x40 [ 697.492975] ?
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a poinCVE-2024-58002 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.