Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,805 results · page 23 of 37
Oct 14, 2025VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise.CVE-2018-25117 · Other software · Vesta · reported by VulnCheckCritical 9.3
VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018.
- Product
- Control Panel (CP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vestacp.comforum.vestacp.com
Oct 14, 2025An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 through 7.6.1, 7.5.0 thrCVE-2024-48891 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 through 7.6.1, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an attacker who has already obtained a non-login low privileged shell access (via another hypothetical vulnerability) to perform a local privilege escalation via crafted commands.
- Product
- FortiSOAR on-premise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Oct 14, 2025A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised procesCVE-2025-11710 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 14, 2025A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures.CVE-2025-11709 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 10, 2025The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding datCVE-2025-11188 · Other software · Synchroweb · reported by cret@cert.orgHigh 7.3
The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding database.
- Product
- Kiwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynchroweb.comkb.cert.org
Sep 22, 2025An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations.CVE-2025-9494 · Other software · Viessmann · reported by productsecurity@carrier.comHigh 8.5
An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.
- Product
- Vitogate 300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025Axios is a promise based HTTP client for the browser and Node.js.CVE-2025-58754 · Other software · axios · reported by GitHubHigh 7.5
Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.
- Product
- axios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables areCVE-2025-42916 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality.
- Product
- SAP S/4HANA (Private Cloud or On-Premise)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Insufficient bounds checking in AMD TEE (Trusted Execution Environment) could allow an attacker with a compromised userspace to invoke a command with malformed CVE-2021-26383 · Other software · AMD · reported by psirt@amd.comHigh 7.9
Insufficient bounds checking in AMD TEE (Trusted Execution Environment) could allow an attacker with a compromised userspace to invoke a command with malformed arguments leading to out of bounds memory access, potentially resulting in loss of integrity or availability.
- Product
- AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures).CVE-2025-58359 · Other software · ZcashFoundation · reported by GitHubMedium 6
ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers (i.e. the threshold) with the refresh share functionality (frost_core::keys::refresh module) was not made clear to users. Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing the shares with a smaller threshold, it would still be possible to sign with the original threshold, potentially causing a security loss to the participant's shares. This issue is fixed in version 2.2.0.
- Product
- frost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwCVE-2025-53118 · Other software · Securden · reported by cve@rapid7.comCritical 9.8
An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.
- Product
- Unified PAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025An attacker could exploit this vulnerability by uploading arbitrary files via a specific service, which could lead to system compromise.CVE-2025-24489 · Other software · INFINITT Healthcare · reported by ics-cert@hq.dhs.govMedium 5.3
An attacker could exploit this vulnerability by uploading arbitrary files via a specific service, which could lead to system compromise.
- Product
- INFINITT PACS System Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated useCVE-2025-54923 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.7
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 12, 2025Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over CVE-2025-53728 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft Dynamics 365 (on-premises) version 9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to CVE-2025-49745 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Dynamics 365 (on-premises) version 9.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC.CVE-2025-42957 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
- Product
- SAP S/4HANA (Private Cloud or On-Premise)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute comCVE-2025-54987 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comCritical 9.4
A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is essentially the same as CVE-2025-54948 but targets a different CPU architecture.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.com
Jul 22, 2025Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets.CVE-2025-7371 · Other software · Okta · reported by psirt@okta.comMedium 6.8
Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions.
- Product
- Okta On-Premises Provisioning Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2025A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted ifrCVE-2025-51591 · Other software · reported by MITRELow 3.7
A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option or ‘pandoc-server’ can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and inseCVE-2025-49853 · Other software · ControlID · reported by ics-cert@hq.dhs.govCritical 9.3
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries.
- Product
- iDSecure On-premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated atCVE-2025-49852 · Other software · ControlID · reported by ics-cert@hq.dhs.govHigh 8.7
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.
- Product
- iDSecure On-premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass auCVE-2025-49851 · Other software · ControlID · reported by ics-cert@hq.dhs.govHigh 8.7
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product.
- Product
- iDSecure On-premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain paraCVE-2025-30679 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 17, 2025A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain paraCVE-2025-30678 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Jun 12, 2025pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.CVE-2025-29744 · Other software · Vitaly-t · reported by MITREMedium 5.4
pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.
- Product
- Pg-promise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsonarsource.com
Jun 5, 2025IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise useCVE-2024-22330 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
- Product
- Security Verify Governance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised.CVE-2024-13945 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.4
Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issuCVE-2024-51553 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS SeCVE-2024-51552 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.1
Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis isCVE-2024-48848 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NCVE-2024-13958 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 4.6
Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.CVE-2024-13957 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS CVE-2024-13956 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.8
SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NCVE-2024-13953 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.9
Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issuCVE-2024-13952 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.7
Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue aCVE-2024-13950 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.9
Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis isCVE-2024-13949 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.9
Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-EnterpCVE-2024-13947 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.1
Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03;CVE-2025-30173 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6
File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: througCVE-2025-30172 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.9
Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised.CVE-2025-30171 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.3
System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised.CVE-2025-30169 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6
File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issueCVE-2025-2409 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.9
File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised.CVE-2024-9639 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.5
Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised.CVE-2024-13931 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.5
Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised.CVE-2024-13929 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.5
Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromiseCVE-2024-13928 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7.5
SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account.CVE-2025-45472 · Other software · Lumigo · reported by MITREHigh 8.8
Insecure permissions in autodeploy-layer v1.2.0 allows attackers to escalate privileges and compromise the customer cloud account.
- Product
- Autodeploy-layer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account.CVE-2025-45468 · Other software · Devsapp · reported by MITREHigh 8.8
Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account.
- Product
- Fc-stable-diffusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account.CVE-2025-45471 · Other software · Lumigo · reported by MITREHigh 8.8
Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account.
- Product
- Measure-cold-start
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.