Vulnerability database

2,817 results · page 22 of 57

• Aug 12, 2025Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a neCVE-2025-49759 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  Product

  Microsoft SQL Server 2016 Service Pack 3 (GDR)

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordmsrc.microsoft.com

• Aug 12, 2025Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a neCVE-2025-49758 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  Product

  Microsoft SQL Server 2016 Service Pack 3 (GDR)

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordmsrc.microsoft.com

• Aug 12, 2025Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a neCVE-2025-47954 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  Product

  Microsoft SQL Server 2022 (CU 20)

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordmsrc.microsoft.com

• Aug 12, 2025UiCore Elements – Free Elementor widgets and templates: Arbitrary File ReadCVE-2025-6253 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

  Product

  UiCore Elements – Free Elementor widgets and templates

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update UiCore Elements – Free Elementor widgets and templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Aug 11, 2025SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements.CVE-2025-42941 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5

  SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary for certain configurations, the attacker does not need the administrative privileges to execute the attack. This could result in unintended manipulation of user sessions or exposure of sensitive information. The issue impacts the confidentiality and integrity of the system, but the availability remains unaffected.

  Product

  SAP Fiori (Launchpad)

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordme.sap.comurl.sap

• Aug 4, 2025Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.CVE-2025-36604 · Other software · Dell · reported by security_alert@emc.comHigh 7.3

  Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

  Product

  Unity

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recorddell.comgithub.com

• Jul 31, 2025Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file.CVE-2025-54752 · Other software · Alfasado Inc. · reported by vultures@jpcert.or.jpMedium 4.8

  Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.

  Product

  PowerCMS

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordjvn.jppowercms.jp

• Jul 28, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection.CVE-2025-6918 · Other software · Ncvav · reported by iletisim@usom.gov.trCritical 9.8

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025.

  Product

  Virtual PBX Software

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr

• Jul 24, 2025ElementsKit Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-3614 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  ElementsKit Elementor Addons and Templates

  Affected

  up to 3.5.2

  What to do

  Affects up to 3.5.2. Update ElementsKit Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 24, 2025Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command InjCVE-2025-7404 · Other software · Calibre Web · reported by help@fluidattacks.comMedium 5.9

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command Injection.This issue affects Calibre Web: 0.6.24 (Nicolette); Autocaliweb: from 0.7.0 before 0.7.1.

  Product

  Calibre Web

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordfluidattacks.comgithub.com

• Jul 24, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection.CVE-2025-4784 · Other software · Moderec · reported by iletisim@usom.gov.trCritical 9.8

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection. This issue affects Tourtella: before 26.05.2025.

  Product

  Tourtella

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr

• Jul 24, 2025Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMGCVE-2025-5243 · Other software · SMG Software · reported by iletisim@usom.gov.trCritical 10

  Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information Portal: before 13.06.2025.

  Product

  Information Portal

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr

• Jul 24, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL InjCVE-2025-4822 · Other software · Bayraktar Solar Energies · reported by iletisim@usom.gov.trCritical 9.8

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL Injection. This issue affects ScadaWatt Otopilot: before 27.05.2025.

  Product

  ScadaWatt Otopilot

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr

• Jul 23, 2025Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router ManagerCVE-2024-53286 · Network & remote access · Synology · reported by security@synology.comHigh 7.2

  Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to execute arbitrary code via unspecified vectors.

  Product

  Synology Router Manager (SRM)

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordsynology.com

• Jul 22, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolantis Information Technologies Agentis allows SQL InjecCVE-2025-4285 · Other software · Rolantis Information Technologies · reported by iletisim@usom.gov.trCritical 10

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolantis Information Technologies Agentis allows SQL Injection. This issue affects Agentis: before 4.32.

  Product

  Agentis

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr

• Jul 22, 2025WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI.CVE-2025-53472 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 8.6

  WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to WebGUI.

  Product

  WRC-BE36QS-B

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordjvn.jpelecom.co.jp

• Jul 21, 2025A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content.CVE-2025-41681 · Other software · MB connect line · reported by info@cert.vde.comMedium 4.8

  A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content.

  Product

  mbNET.mini

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordcertvde.comseclists.org

• Jul 21, 2025A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statemCVE-2025-41678 · Other software · MB connect line · reported by info@cert.vde.comMedium 6.5

  A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement.

  Product

  mbNET.mini

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordcertvde.comseclists.org

• Jul 16, 2025Pakke Envíos: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52819 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pakkemx Pakke Envíos pakke allows SQL Injection.This issue affects Pakke Envíos: from n/a through <= 1.0.2.

  Product

  Pakke Envíos

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Pakke Envíos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52714 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQL Injection.This issue affects Traveler: from n/a through < 3.2.2.

  Product

  Traveler

  What to do

  Update Traveler to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025ProfileGrid: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49876 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.

  Product

  ProfileGrid

  Affected

  up to 5.9.5.2

  What to do

  Affects up to 5.9.5.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Funnel Builder by FunnelKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49034 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.10.2.

  Product

  Funnel Builder by FunnelKit

  Affected

  up to 3.10.2

  What to do

  Affects up to 3.10.2. Update Funnel Builder by FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47645 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.

  Product

  ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WPGYM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32574 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows SQL Injection. This issue affects WPGYM: from n/a through 65.0.

  Product

  WPGYM

  Affected

  up to 65.0

  What to do

  Affects up to 65.0. Update WPGYM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025Torod: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30936 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Torod Company for Information Technology Torod torod allows SQL Injection.This issue affects Torod: from n/a through <= 2.1.

  Product

  Torod

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Torod to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WP Pipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28982 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection. This issue affects WP Pipes: from n/a through 1.4.3.

  Product

  WP Pipes

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025URL Shortener: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28959 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows SQL Injection.This issue affects URL Shortener: from n/a through <= 3.0.7.

  Product

  URL Shortener

  Affected

  up to 3.0.7

  What to do

  Affects up to 3.0.7. Update URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025WP-BusinessDirectory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24759 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Blind SQL Injection.This issue affects WP-BusinessDirectory: from n/a through <= 3.1.4.

  Product

  WP-BusinessDirectory

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025SMTP for Amazon SES: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54043 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for Amazon SES smtp-amazon-ses allows SQL Injection.This issue affects SMTP for Amazon SES: from n/a through <= 1.9.

  Product

  SMTP for Amazon SES

  Affected

  up to 1.9

  What to do

  Affects up to 1.9. Update SMTP for Amazon SES to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025GymBase Theme Classes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-54026 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuanticaLabs GymBase Theme Classes gymbase_classes allows SQL Injection.This issue affects GymBase Theme Classes: from n/a through <= 1.4.

  Product

  GymBase Theme Classes

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update GymBase Theme Classes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53982 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.

  Product

  JetElements For Elementor

  Affected

  up to 2.7.7

  What to do

  Affects up to 2.7.7. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025SMTP for SendGrid – YaySMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48301 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for SendGrid – YaySMTP smtp-sendgrid allows SQL Injection.This issue affects SMTP for SendGrid – YaySMTP: from n/a through <= 1.5.

  Product

  SMTP for SendGrid – YaySMTP

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update SMTP for SendGrid – YaySMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025YayExtra: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48299 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayExtra yayextra allows SQL Injection.This issue affects YayExtra: from n/a through <= 1.5.5.

  Product

  YayExtra

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update YayExtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 16, 2025YaySMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48161 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP smtp-sendinblue allows SQL Injection.This issue affects YaySMTP: from n/a through <= 1.3.

  Product

  YaySMTP

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update YaySMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 11, 2025An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS and Junos OSCVE-2025-52988 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.4

  An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a high privileged, local attacker to escalated their privileges to root. When a user provides specifically crafted arguments to the 'request system logout' command, these will be executed as root on the shell, which can completely compromise the device. This issue affects: Junos OS:  * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S8, * 22.2 versions before 22.2R3-S6, * 22.3 versions before 22.3R3-S3, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S1, * 23.4 versions before 23.4R1-S2, 23.4R2; Junos OS Evolved: * all versions before 22.4R3-S6-EVO, * 23.2-EVO versions before 23.2R2-S1-EVO, * 23.4-EVO versions before 23.4R1-S2-EVO, 23.4R2-EVO.

  Product

  Junos OS

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordsupportportal.juniper.net

• Jul 11, 2025A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remotCVE-2025-50121 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.5

  A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP is disabled by default.

  Product

  EcoStruxure™ IT Data Center Expert

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recorddownload.schneider-electric.comseclists.org

• Jul 8, 2025ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjecCVE-2025-49537 · Websites & servers · Adobe · reported by AdobeHigh 7.9

  ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.

  Product

  ColdFusion

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordhelpx.adobe.com

• Jul 8, 2025Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to executeCVE-2025-47178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8

  Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network.

  Product

  Microsoft Configuration Manager

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordmsrc.microsoft.com

• Jul 8, 2025An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 througCVE-2025-24474 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 2.7

  An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiManager Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiAnalyzer 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; and FortiAnalyzer Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an authenticated attacker with high privilege to extract database information via crafted requests.

  Product

  FortiManager

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordfortiguard.fortinet.com

• Jul 8, 2025Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.CVE-2025-21446 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5

  Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

  Product

  Snapdragon

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recorddocs.qualcomm.com

• Jul 7, 2025A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command ('OCVE-2025-3705 · Other software · Frauscher · reported by info@cert.vde.comMedium 6.8

  A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') when loading a config file from a USB drive.

  Product

  FDS102

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordcertvde.com

• Jul 7, 2025A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS CCVE-2025-3626 · Other software · Frauscher · reported by info@cert.vde.comCritical 9.1

  A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') while uploading a config file via webUI.

  Product

  FDS102

  What to do

  Apply the vendor’s update. The NVD record links to the advisory.

  Full record and what to do →NVD recordcertvde.com

• Jul 4, 2025LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52833 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS lms allows SQL Injection.This issue affects LMS: from n/a through <= 9.2.

  Product

  LMS

  Affected

  up to 9.2

  What to do

  Affects up to 9.2. Update LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025NGG Smart Image Search: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52832 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows SQL Injection.This issue affects NGG Smart Image Search: from n/a through <= 3.4.1.

  Product

  NGG Smart Image Search

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update NGG Smart Image Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Video List Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52831 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows SQL Injection.This issue affects Video List Manager: from n/a through <= 1.7.

  Product

  Video List Manager

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025bSecure – Your Universal Checkout: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52830 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bSecure – Your Universal Checkout bSecure – Your Universal Checkout bsecure allows Blind SQL Injection.This issue affects bSecure – Your Universal Checkout: from n/a through <= 1.7.9.

  Product

  bSecure – Your Universal Checkout

  Affected

  up to 1.7.9

  What to do

  Affects up to 1.7.9. Update bSecure – Your Universal Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Paid Member Subscriptions: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49870 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows SQL Injection.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.1.

  Product

  Paid Member Subscriptions

  Affected

  up to 2.15.1

  What to do

  Affects up to 2.15.1. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Simple Link Directory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32297 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows SQL Injection.This issue affects Simple Link Directory: from n/a through < 14.8.1.

  Product

  Simple Link Directory

  What to do

  Update Simple Link Directory to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Click & Pledge Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28983 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.

  Product

  Click & Pledge Connect

  What to do

  Update Click & Pledge Connect to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jul 4, 2025Printcart Web to Print Product Designer for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24780 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.0.

  Product

  Printcart Web to Print Product Designer for WooCommerce

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.