Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,080 results · page 27 of 142
May 26, 2025A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic.CVE-2025-5173 · Other software · HumanSignal · reported by VulDBMedium 4.8
A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- label-studio-ml-backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability, which was classified as critical, was found in Econtrata up to 20250516.CVE-2025-5172 · Other software · Econtrata · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valida. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Econtrata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5.CVE-2025-5171 · Other software · llisoft · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function this.fileService.download of the file com\llisoft\controller\OpenController.java. The manipulation of the argument url leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MTA Maita Training System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5.CVE-2025-5170 · Other software · llisoft · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShitiListRequestVo of the file com\llisoft\controller\admin\shiti\AdminShitiController.java. The manipulation of the argument stTypeIds leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MTA Maita Training System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3.CVE-2025-5169 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::InternReadFile_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic.CVE-2025-5165 · Other software · Open Asset Import Library · reported by VulDBMedium 4.8
A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic.CVE-2025-5164 · Other software · Perfree · reported by VulDBMedium 6.3
A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Perfreeblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0.CVE-2025-5163 · Other software · yangshare 技术杨工 · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in yangshare 技术杨工 warehouseManager 仓库管理系统 1.0. This affects an unknown part. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- warehouseManager 仓库管理系统
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513.CVE-2025-5162 · Other software · H3C · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown functionality of the file /safeEvent/importFile/. The manipulation of the argument logGeneralFile/logGeneralFile_2 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SecCenter SMP-E1114P02
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability classified as problematic was found in H3C SecCenter SMP-E1114P02 up to 20250513.CVE-2025-5161 · Other software · H3C · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this vulnerability is the function operationDailyOut of the file /safeEvent/download. The manipulation of the argument filename leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SecCenter SMP-E1114P02
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513.CVE-2025-5160 · Other software · H3C · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected is the function Download of the file /packetCaptureStrategy/download. The manipulation of the argument Name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SecCenter SMP-E1114P02
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability was found in H3C GR-5400AX up to 100R008 and classified as critical.CVE-2025-5156 · Other software · H3C · reported by VulDBHigh 8.7
A vulnerability was found in H3C GR-5400AX up to 100R008 and classified as critical. Affected by this issue is the function EditWlanMacList of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- GR-5400AX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical.CVE-2025-5155 · Other software · qianfox · reported by VulDBMedium 5.3
A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function batchCope of the file app/admin/controller/Article.php. The manipulation of the argument ids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FoxCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21.CVE-2025-5153 · Other software · Cmsmadesimple · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Design Manager Module. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability classified as critical was found in Chanjet CRM up to 20250510.CVE-2025-5152 · Other software · Chanjet · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Chanjet CRM up to 20250510. This vulnerability affects unknown code of the file /activity/newActivityedit.php?DontCheckLogin=1&id=null&ret=mod1. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4.CVE-2025-5151 · Other software · defog-ai · reported by VulDBMedium 4.8
A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function execute_analysis_code_safely of the file introspect/backend/tools/analysis_tools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is named 502. It is recommended to apply a patch to fix this issue. The code maintainer explains, that "[they] have added some workarounds to address this in #502, but will not be implementing a full fix. This is because this repo is meant to be run in a docker environment, which will significantly mitigate potential security risks. Having said that, we have added a SECURITY section in our README to make this clearer to users."
- Product
- introspect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability was found in Netcore NBR1005GPEV2, NBR200V2 and B6V2 up to 20250508 and classified as critical.CVE-2025-5147 · Other software · Netcore · reported by VulDBMedium 5.3
A vulnerability was found in Netcore NBR1005GPEV2, NBR200V2 and B6V2 up to 20250508 and classified as critical. This issue affects the function tools_ping of the file /usr/bin/network_tools. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- NBR1005GPEV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical.CVE-2025-5146 · Other software · Netcore · reported by VulDBMedium 5.3
A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical. This vulnerability affects the function passwd_set of the file /usr/bin/routerd of the component HTTP Header Handler. The manipulation of the argument pwd leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- NBR1005GPEV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 2025050CVE-2025-5145 · Other software · Netcore · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 20250508. This affects an unknown part of the file /www/cgi-bin/ of the component Query String Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- NBR1005GPEV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordanonymous.4open.sciencegithub.com
May 24, 2025A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2.CVE-2025-5140 · Other software · Seeyon · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2. This affects the function this.oursNetService.getData of the file com\ours\www\ehr\openPlatform1\open4ClientType\controller\ThirdMenuController.class. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Zhiyuan OA Web Application System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505.CVE-2025-5136 · Other software · Tmall · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. This affects an unknown part of the file /tmall/order/pay/ of the component Payment Identifier Handler. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Demo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505.CVE-2025-5135 · Other software · Tmall · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the file /tmall/admin/ of the component Product Details Page. The manipulation of the argument Product Name/Product Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Demo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability classified as problematic was found in Tmall Demo up to 20250505.CVE-2025-5134 · Other software · Tmall · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in Tmall Demo up to 20250505. Affected by this vulnerability is an unknown functionality of the component Buy Item Page. The manipulation of the argument Detailed Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Demo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability classified as problematic has been found in Tmall Demo up to 20250505.CVE-2025-5133 · Other software · Tmall · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Tmall Demo up to 20250505. Affected is an unknown function of the component Search Box. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Demo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical.CVE-2025-5129 · Other software · Sangfor · reported by VulDBHigh 7.3
A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknown functionality in the library MSASN1.dll. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 零信任访问控制系统 aTrust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
May 24, 2025A vulnerability, which was classified as critical, was found in ScriptAndTools Real-Estate-website-in-PHP 1.0.CVE-2025-5128 · Other software · ScriptAndTools · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in ScriptAndTools Real-Estate-website-in-PHP 1.0. Affected is an unknown function of the file /admin/ of the component Admin Login Panel. The manipulation of the argument Password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Real-Estate-website-in-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30.CVE-2025-5124 · Other software · Sony · reported by VulDBCritical 9.2
A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. It is recommended to change the configuration settings. The vendor was contacted early about this issue. They confirmed the existence but pointed out that they "have published the 'Hardening Guide' on the Web from July 2018 to January 2025 and have thoroughly informed customers of the recommendation to change their initial passwords".
- Product
- SNC-M1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical.CVE-2025-5119 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
- Product
- Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical.CVE-2025-5114 · Other software · easysoft · reported by VulDBMedium 5.3
A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The manipulation of the argument filePath leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- zentaopms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.CVE-2025-5112 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MGET Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.CVE-2025-5111 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component TYPE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.CVE-2025-5110 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0.CVE-2025-5109 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component STATUS Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability was found in TOZED ZLT W51 up to 1.4.2 and classified as critical.CVE-2025-5105 · Other software · TOZED · reported by VulDBMedium 6.9
A vulnerability was found in TOZED ZLT W51 up to 1.4.2 and classified as critical. Affected by this issue is some unknown functionality of the component Service Port 7777. The manipulation leads to improper clearing of heap memory before release. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ZLT W51
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9.CVE-2025-5080 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function webExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5076 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component SEND Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5075 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component DEBUG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.CVE-2025-5074 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component PROMPT Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.CVE-2025-5073 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. This issue affects some unknown processing of the component MKDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.CVE-2025-5053 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component MDIR Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.CVE-2025-5052 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component LS Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0.CVE-2025-5051 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component BINARY Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability classified as problematic was found in XiaoBingby TeaCMS 2.0.2.CVE-2025-5033 · Other software · XiaoBingby · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in XiaoBingby TeaCMS 2.0.2. Affected by this vulnerability is an unknown functionality of the file src/main/java/me/teacms/controller/admin/UserManageController/addUser. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical.CVE-2025-5029 · Other software · Kingdee · reported by VulDBMedium 5.3
A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical. Affected by this vulnerability is the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file fileUpload/deleteFileAction.jhtml of the component File Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- Cloud Galaxy Private Cloud BBC System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvip.kingdee.comvip.kingdee.com
May 21, 2025In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimeCVE-2025-4949 · Other software · Eclipse JGit · reported by emo@eclipse.orgMedium 6.8
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
- Product
- Eclipse JGit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.eclipse.orggitlab.eclipse.org
May 21, 2025A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702.CVE-2025-5013 · Other software · Hkcms · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hkcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0.CVE-2025-5011 · Other software · moonlightL · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html of the component Dynamic List Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- hexo-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0.CVE-2025-5010 · Other software · moonlightL · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the component Blog Backend. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- hexo-boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical.CVE-2025-4999 · Network & remote access · Linksys · reported by VulDBMedium 5.3
A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153FC of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of the argument supplicant_rnd_id_en leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FGW3000-AH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025A vulnerability has been found in H3C Magic R200G up to 100R002 and classified as problematic.CVE-2025-4998 · Other software · H3C · reported by VulDBHigh 7.1
A vulnerability has been found in H3C Magic R200G up to 100R002 and classified as problematic. Affected by this vulnerability is the function Edit_BasicSSID/Edit_BasicSSID_5G/SetAPWifiorLedInfoById/SetMobileAPInfoById/Asp_SetTimingtimeWifiAndLed/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList of the file /goform/aspForm of the component HTTP POST Request Handler. The manipulation of the argument param leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Magic R200G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.