Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,080 results · page 29 of 142
May 16, 2025In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described iCVE-2025-37890 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 16, 2025A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0.CVE-2025-4769 · Other software · CBEWIN · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0. This vulnerability affects unknown code of the file ATService.exe. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult.
- Product
- Anytxt Searcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0.CVE-2025-4768 · Other software · feng_ha_ha · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. This affects the function uploadPicture of the file PictureServiceImpl.java. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
- Product
- ssm-erp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic.CVE-2025-4753 · Network & remote access · D-Link · reported by VulDBMedium 6.9
A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the file /login.data. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-7003GV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic.CVE-2025-4752 · Network & remote access · D-Link · reported by VulDBMedium 6.9
A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /install_base.data. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-7003GV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125).CVE-2025-4751 · Network & remote access · D-Link · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.data. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-7003GV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125).CVE-2025-4750 · Network & remote access · D-Link · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of the file /H5/get_version.data of the component Configuration Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-7003GV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A vulnerability classified as critical was found in D-Link DI-7003GV2 24.04.18D1 R(68125).CVE-2025-4749 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This vulnerability affects the function sub_4983B0 of the file /H5/backup.asp?opt=reset of the component Factory Reset Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-7003GV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical.CVE-2025-4747 · Other software · Bohua · reported by VulDBMedium 5.3
A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ip_status.php. The manipulation of the argument subnet leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- NetDragon Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856.CVE-2025-4742 · Other software · XU-YIJIE · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of the file grpo_vanilla.py. The manipulation leads to deserialization. Local access is required to approach this attack. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- grpo-flat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4733 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4732 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4731 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type/ip_subnet leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability was found in Meteor up to 3.2.1 and classified as problematic.CVE-2025-4727 · Other software · Meteor · reported by VulDBMedium 6.3
A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedata_server.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.2 is able to address this issue. The identifier of the patch is f7ea6817b90952baaea9baace2a3b4366fee6a63. It is recommended to upgrade the affected component.
- Product
- Meteor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Clasify Classified Listing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12725 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Clasify Classified Listing
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Clasify Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421.CVE-2025-4701 · Other software · VITA-MLLM · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in VITA-MLLM Freeze-Omni up to 20250421. This issue affects the function torch.load of the file models/utils.py. The manipulation of the argument path leads to deserialization. It is possible to launch the attack on the local host.
- Product
- Freeze-Omni
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic.CVE-2025-4552 · Other software · Continew · reported by VulDBMedium 5.3
A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/system/user/1/password. The manipulation leads to unverified password change. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Continew Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0.CVE-2025-4551 · Other software · Continew · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Continew Admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical.CVE-2025-4544 · Network & remote access · D-Link · reported by VulDBHigh 7.5
A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of the component jhttpd. The manipulation of the argument def_max/def_time/def_tcp_max/def_tcp_time/def_udp_max/def_udp_time/def_icmp_max leads to stack-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as critical, was found in LyLme Spage 2.1.CVE-2025-4543 · Other software · LyLme · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in LyLme Spage 2.1. This affects an unknown part of the file lylme_spage/blob/master/admin/ajax_link.php. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2.CVE-2025-4542 · Other software · Freeebird · reported by VulDBLow 2.3
A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functionality of the file /src/main/java/cn/mafangui/hotel/tool/SessionInterceptor.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- Hotel 酒店管理系统 API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as critical has been found in LmxCMS 1.41.CVE-2025-4541 · Other software · Lmxcms · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in LmxCMS 1.41. Affected is the function manageZt of the file c\admin\ZtAction.class.php of the component POST Request Handler. The manipulation of the argument sortid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic.CVE-2025-4537 · Other software · yangzongzhuan · reported by VulDBLow 2.3
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the file ruoyi-ui/jsencrypt.js and ruoyi-ui/login.vue of the component Password Handler. The manipulation leads to cleartext storage of sensitive information in a cookie. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- RuoYi-Vue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
May 11, 2025A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical.CVE-2025-4536 · Other software · Gosuncn Technology Group · reported by VulDBMedium 6.9
A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmgr/user/listByPage. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Audio-Visual Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0.CVE-2025-4535 · Other software · Gosuncn Technology Group · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unknown function of the file /config/config.properties of the component Configuration File Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Audio-Visual Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A.CVE-2025-4534 · Other software · SunGrow · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A. This issue affects some unknown processing. The manipulation leads to weak password requirements. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Logger1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0.CVE-2025-4533 · Other software · Jeecg · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819.CVE-2025-4532 · Other software · Shanghai Bairui Information Technology · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SunloginClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows.CVE-2025-4525 · Other software · Discord · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Discord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 10, 2025A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2.CVE-2025-4515 · Other software · Zylon · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The manipulation of the argument allow_origins leads to permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PrivateGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 10, 2025A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E.CVE-2025-4514 · Other software · Zhengzhou Jiuhua Electronic Technology · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. Affected by this issue is some unknown functionality of the file /javascript.php. The manipulation of the argument Value leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- mayicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle.CVE-2025-4513 · Other software · Catalyst · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Affected by this vulnerability is an unknown functionality of the file /auth/userkey/logout.php of the component Logout. The manipulation of the argument return leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- User Key Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7.CVE-2025-4512 · Other software · Inetum · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7. Affected is an unknown function of the file /astre/iodasweb/app.jsp. The manipulation of the argument action leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- IODAS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latestCVE-2025-1752 · Other software · run-llama · reported by security@huntr.devHigh 7.5
A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.
- Product
- run-llama/llama_index
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic.CVE-2025-4495 · Other software · JAdmin-JAVA · reported by VulDBMedium 5.1
A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /memoAjax/save. The manipulation of the argument ID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- JAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0.CVE-2025-4494 · Other software · JAdmin-JAVA · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java of the component Admin Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- JAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0.CVE-2025-4482 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0. Affected by this vulnerability is an unknown functionality of the file /change_pass/forgot_password_sql.php. The manipulation of the argument Pat_BloodGroup1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Student Project Allocation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4462 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4461 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4460 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0.CVE-2025-4457 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Car Rental Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0.CVE-2025-4456 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Car Rental Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical.CVE-2025-4452 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this issue is the function formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical.CVE-2025-4451 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this vulnerability is the function formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04.CVE-2025-4450 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04. Affected is the function formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04.CVE-2025-4449 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04. This issue affects the function formEasySetupWizard3. The manipulation of the argument wan_connected leads to buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04.CVE-2025-4448 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical.CVE-2025-4446 · Other software · H3C · reported by VulDBHigh 8.6
A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical. This vulnerability affects the function Edit_List_SSID of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack needs to be approached within the local network.
- Product
- GR-5400AX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01.CVE-2025-4445 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical.CVE-2025-4440 · Other software · H3C · reported by VulDBHigh 8.6
A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical. Affected by this issue is the function EnableIpv6 of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
- Product
- GR-1800AX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.