Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
391 results · page 3 of 8
Oct 28, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-62802 · Other software · dnnsoftware · reported by GitHubMedium 4.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025Alloy Core libraries at the root of the Rust Ethereum ecosystem.CVE-2025-62370 · Other software · alloy-rs · reported by GitHubHigh 7.5
Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. The vulnerability was patched by adding a check to ensure the element is not empty before accessing its first element; an error is returned if it is empty. The fix is included in version v1.4.1 and backported to v0.8.26.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet.CVE-2025-59448 · Other software · YoSmart · reported by MITREMedium 4.7
Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with the traffic to control affected devices. This affects YoLink Hub 0382, YoLink Mobile Application 1.40.41, and YoLink MQTT Broker. NOTE: The vendor states that the vulnerability described (related to insecure transmission) only impacts the legacy mobile application logic, not the Hub hardware or firmware. The Hub functions solely as a pass-through (transparent gateway) for LoRa wireless data and does not inspect or process the application layer data.
- Product
- YoLink ecosystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbishopfox.combishopfox.com
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59821 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59548 · Other software · dnnsoftware · reported by GitHubMedium 5.9
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to javascript injection, affecting any unsuspecting user clicking such link. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59547 · Other software · dnnsoftware · reported by GitHubMedium 5.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient sanitization for filenames allowing probing network endpoints. A specially crafted request can be made to upload a file with Unicode characters, which would be translated into a path that could expose resources in the internal network of the hosted site. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59546 · Other software · dnnsoftware · reported by GitHubLow 2.4
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59545 · Other software · dnnsoftware · reported by GitHubCritical 9
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59539 · Other software · dnnsoftware · reported by GitHubMedium 6.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-59535 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files.CVE-2025-37131 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.9
A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS).CVE-2025-37125 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.5
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
- Product
- HPE Aruba Networking EdgeConnect SD-WAN Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted requesCVE-2025-8449 · Other software · Schnieder Electric · reported by cybersecurity@se.comMedium 4.1
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
- Product
- EcoStruxure Building Operation Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when CVE-2025-8448 · Other software · Schneider Eelctric · reported by cybersecurity@se.comLow 1
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.
- Product
- EcoStruxure Building Operation Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive fiCVE-2025-54927 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.9
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an autheCVE-2025-54926 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.2
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the applicatCVE-2025-54925 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially craftCVE-2025-54924 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Aug 20, 2025CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated useCVE-2025-54923 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.7
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.
- Product
- EcoStruxure™ Power Monitoring Expert (PME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jul 11, 2025A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticaCVE-2025-6788 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.3
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML diagrams.
- Product
- EcoStruxure™ Power Monitoring Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jul 11, 2025A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via theCVE-2025-50125 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.3
A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server is accessed via the network with knowledge of hidden URLs and manipulation of host request header.
- Product
- EcoStruxure™ IT Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comseclists.org
Jul 11, 2025A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account viaCVE-2025-50124 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.2
A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script.
- Product
- EcoStruxure™ IT Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comseclists.org
Jul 11, 2025A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account whenCVE-2025-50123 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.2
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input.
- Product
- EcoStruxure™ IT Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comseclists.org
Jul 11, 2025A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with CVE-2025-50122 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.9
A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with access to installation or upgrade artifacts.
- Product
- EcoStruxure™ IT Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comseclists.org
Jul 11, 2025A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remotCVE-2025-50121 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.5
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause unauthenticated remote code execution when a malicious folder is created over the web interface HTTP when enabled. HTTP is disabled by default.
- Product
- EcoStruxure™ IT Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comseclists.org
Jul 11, 2025A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external enCVE-2025-6438 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.9
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external entities injection resulting in unauthorized file access when the server is accessed via the network using an application account.
- Product
- EcoStruxure™ IT Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comseclists.org
Jun 20, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-52488 · Other software · dnnsoftware · reported by GitHubHigh 8.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted series of malicious interaction to potentially expose NTLM hashes to a third party SMB server. This issue has been patched in version 10.0.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-52487 · Other software · dnnsoftware · reported by GitHubHigh 8.8
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 7.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request or proxy to be created that could bypass the design of DNN Login IP Filters allowing login attempts from IP Addresses not in the allow list. This issue has been patched in version 10.0.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-52486 · Other software · dnnsoftware · reported by GitHubMedium 6.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been patched in version 10.0.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-52485 · Other software · dnnsoftware · reported by GitHubMedium 5.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-48378 · Other software · dnnsoftware · reported by GitHubMedium 6.1
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, uploaded SVG files could contain scripts and if rendered inline those scripts could run allowing XSS attacks. Version 9.13.9 fixes the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-48377 · Other software · dnnsoftware · reported by GitHubMedium 6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a specially crafted URL may be constructed which can inject an XSS payload that is triggered by using some module actions. Version 9.13.9 fixes the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-48376 · Other software · dnnsoftware · reported by GitHubLow 3.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (Host) could craft a request to use an external url for a site export to then be imported. Version 9.13.9 fixes the issue.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially execute arbitrary cCVE-2025-3916 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.6
CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially execute arbitrary code while the end user opens a malicious project file (SSD file) provided by the attacker.
- Product
- EcoStruxure™ Power Build Rapsody software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Apr 9, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32374 · Other software · dnnsoftware · reported by GitHubMedium 5.9
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32373 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32372 · Other software · dnnsoftware · reported by GitHubMedium 6.5
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32371 · Other software · dnnsoftware · reported by GitHubMedium 4.3
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that the information is legitimate. This vulnerability is fixed in 9.13.4.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32036 · Other software · dnnsoftware · reported by GitHubMedium 4.2
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate the captcha image shows the least complexity of the desired image. For this reason, the created image can be easily read by OCR tools, and the intruder can send automatic requests by building a robot and using this tool. This vulnerability is fixed in 9.13.8.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.CVE-2025-32035 · Other software · dnnsoftware · reported by GitHubLow 2.6
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2.
- Product
- Dnn.Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server isCVE-2025-2002 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4
CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device.
- Product
- EcoStruxure Panel Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Mar 12, 2025CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a systemCVE-2025-1960 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interface.
- Product
- WebHMI – Deployed with EcoStruxure Power Automation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Mar 12, 2025CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physicalCVE-2025-0813 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to reboot the workstation and interrupt the normal boot process.
- Product
- EcoStruxure Power Automation System User Interface (EPAS-UI) - Secured Versions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Feb 13, 2025CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing cliCVE-2025-0327 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.5
CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing client request) that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the executable path of the windows services. To be exploited, services need to be restarted.
- Product
- EcoStruxure Process Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jan 28, 2025CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folderCVE-2024-8401 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.4
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.
- Product
- EcoStruxure Power Monitoring Expert (PME) 2021
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jan 17, 2025CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to exploit these issues tCVE-2024-11139 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.6
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to exploit these issues to potentially execute arbitrary code when opening a malicious project file.
- Product
- EcoStruxure™ Power Build Rapsody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jan 14, 2025Umbraco.Forms is a web form framework written for the nuget ecosystem.CVE-2025-23041 · Other software · umbraco · reported by GitHubMedium 5.8
Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- Umbraco.Forms.Issues
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux.CVE-2024-50338 · Other software · git-ecosystem · reported by GitHubHigh 7.4
Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format `key=value`. Git's documentation restricts the use of the NUL (`\0`) character and newlines to form part of the keys or values. When Git reads from standard input, it considers both LF and CRLF as newline characters for the credential protocol by virtue of calling `strbuf_getline` that calls to `strbuf_getdelim_strip_crlf`. Git also validates that a newline is not present in the value by checking for the presence of the line-feed character (LF, `\n`), and errors if this is the case. This captures both LF and CRLF-type newlines. Git Credential Manager uses the .NET standard library `StreamReader` class to read the standard input stream line-by-line and parse the `key=value` credential protocol format. The implementation of the `ReadLineAsync` method considers LF, CRLF, and CR as valid line endings. This is means that .NET considers a single CR as a valid newline character, whereas Git does not. This mismatch of newline treatment betw
- Product
- git-credential-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.CVE-2025-22984 · Other software · Thecosy · reported by MITREHigh 7.5
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
- Product
- Icecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.CVE-2025-22983 · Other software · Thecosy · reported by MITREHigh 7.5
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
- Product
- Icecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.