Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
398 results · page 3 of 8
May 30, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERCVE-2025-0602 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pCVE-2024-41199 · Other software · Ocuco · reported by MITREHigh 7.2
An issue in Ocuco Innovation - JOBMANAGER.EXE v2.10.24.16 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packCVE-2024-41198 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - REPORTS.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP pacCVE-2024-41197 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCPCVE-2024-41196 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - REPORTSERVER.EXE v2.10.24.13 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgdrive.google.com
May 22, 2025An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafteCVE-2024-41195 · Other software · Ocuco · reported by MITRECritical 9.8
An issue in Ocuco Innovation - INNOVASERVICEINTF.EXE v2.10.24.17 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE componentCVE-2024-40462 · Other software · Ocuco · reported by MITREHigh 7.8
An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the SETTINGSVATIGATOR.EXE component
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE componentCVE-2024-40461 · Other software · Ocuco · reported by MITREHigh 7.8
An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the STOCKORDERENTRY.EXE component
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXECVE-2024-40460 · Other software · Ocuco · reported by MITREHigh 7.8
An issue in Ocuco Innovation v.2.10.24.51 allows a local attacker to escalate privileges via the JOBENTRY.EXE
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager functionCVE-2024-40459 · Other software · Ocuco · reported by MITREHigh 7.8
An issue in Ocuco Innovation APPMANAGER.EXE v.2.10.24.51 allows a local attacker to escalate privileges via the application manager function
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 22, 2025An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets.CVE-2024-40458 · Other software · Ocuco · reported by MITREHigh 7.8
An issue in Ocuco Innovation Tracking.exe v.2.10.24.51 allows a local attacker to escalate privileges via the modification of TCP packets.
- Product
- Innovation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgist.githubusercontent.com
May 19, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova WorkstationST on Windows (EGD Configuration Server moCVE-2025-3223 · Other software · GE Vernova · reported by GEPowerCVD@ge.comMedium 5.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GE Vernova WorkstationST on Windows (EGD Configuration Server modules) allows Path Traversal.This issue affects WorkstationST: WorkstationST V07.10.10C and earlier.
- Product
- WorkstationST
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario"CVE-2025-3575 · Other software · T-INNOVA · reported by cve-coordination@incibe.esHigh 8.7
Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint.
- Product
- Deporsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario"CVE-2025-3574 · Other software · T-INNOVA · reported by cve-coordination@incibe.esHigh 8.7
Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/obtenerFamiliaUsuario" endpoint.
- Product
- Deporsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Nova Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31819 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nova Blocks: from n/a through <= 2.1.8.
- Product
- Nova Blocks
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Nova Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025A vulnerability classified as critical has been found in Novastar CX40 up to 2.44.0.CVE-2025-3008 · Other software · Novastar · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in Novastar CX40 up to 2.44.0. Affected is the function system/popen of the file /usr/nova/bin/netconfig of the component NetFilter Utility. The manipulation leads to command injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CX40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025A vulnerability was found in Novastar CX40 up to 2.44.0.CVE-2025-3007 · Other software · Novastar · reported by VulDBMedium 5.1
A vulnerability was found in Novastar CX40 up to 2.44.0. It has been rated as critical. This issue affects the function getopt of the file /usr/nova/bin/netconfig of the component NetFilter Utility. The manipulation of the argument cmd/netmask/pipeout/nettask leads to stack-based buffer overflow. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CX40
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x throughCVE-2025-0833 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through ReCVE-2025-0832 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through ReleasCVE-2025-0829 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through ReleCVE-2025-0826 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x throughCVE-2025-0601 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows anCVE-2025-0600 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allowsCVE-2025-0599 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through ReleasCVE-2025-0598 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an CVE-2025-0596 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php.CVE-2025-2202 · Other software · Innovación y Cualificación · reported by cve-coordination@incibe.esMedium 6.9
Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email.
- Product
- ajax.php plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin.CVE-2025-2201 · Other software · Innovación y Cualificación · reported by cve-coordination@incibe.esMedium 6.9
Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain sensitive information about other users such as public IP addresses, messages with other users and more.
- Product
- IcProgreso plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025SQL injection vulnerability in the IcProgreso Innovación y Cualificación plugin.CVE-2025-2200 · Other software · Innovación y Cualificación · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in the IcProgreso Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query on the parameters user, id, idGroup, start_date and end_date in the endpoint /report/icprogreso/generar_blocks.php.
- Product
- IcProgreso plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2025SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php.CVE-2025-2199 · Other software · Innovación y Cualificación · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query in ‘searchActionsToUpdate’, ‘searchSpecialitiesPending’, ‘searchSpecialitiesLinked’, ‘searchUsersToUpdateProfile’, ‘training_action_data’, ‘showContinuingTrainingCourses’ and ‘showUsersToEdit’ in /local/administration/ajax.php.
- Product
- ajax.php plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privileges via placing a crCVE-2025-25598 · Other software · Inovalogic · reported by MITREHigh 8.8
Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privileges via placing a crafted executable into a scheduled task.
- Product
- Customer Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware.CVE-2025-27257 · Other software · GE Vernova · reported by prodsec@nozominetworks.comMedium 6.1
Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.
- Product
- N60 multilin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Mar 10, 2025Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH serverCVE-2025-27256 · Other software · GE Vernova · reported by prodsec@nozominetworks.comHigh 8.3
Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH server authentication. Since the client connection is not authenticated, an attacker may perform a man-in-the-middle attack on the network.
- Product
- EnerVista UR Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Mar 10, 2025Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation.CVE-2025-27255 · Other software · GE Vernova · reported by prodsec@nozominetworks.comHigh 8
Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcoded password retrievable by an attacker analyzing the application code.
- Product
- EnerVista UR Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Mar 10, 2025CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.CVE-2025-27254 · Other software · GE Vernova · reported by prodsec@nozominetworks.comHigh 8
CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.
- Product
- EnerVista UR Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Mar 10, 2025A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide inpCVE-2025-27253 · Other software · GE Vernova · reported by prodsec@nozominetworks.comMedium 6.1
A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide input that establishes a TCP connection through a port forwarding. The lack of the IP address and port validation may allow the attacker to bypass firewall rules or to send malicious traffic in the network.
- Product
- N60 multilin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Feb 24, 2025NovaCHRON Zeitsysteme GmbH & Co.CVE-2024-53544 · Other software · reported by MITRECritical 9.8
NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the smarttimeplus/MySQLConnection endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025NovaCHRON Zeitsysteme GmbH & Co.CVE-2024-53543 · Other software · reported by MITREMedium 5.4
NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smarttimeplus/MySQLConnection endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co.CVE-2024-53542 · Other software · reported by MITREMedium 6.5
Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025Out-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint CP228w 01.22.01 and earlier, DocuPrint CM225fw 01.10.01 and earlierCVE-2024-45320 · Other software · FUJIFILM Business Innovation Corp. · reported by vultures@jpcert.or.jpMedium 6.5
Out-of-bounds write vulnerability exists in DocuPrint CP225w 01.22.01 and earlier, DocuPrint CP228w 01.22.01 and earlier, DocuPrint CM225fw 01.10.01 and earlier, and DocuPrint CM228fw 01.10.01 and earlier. If an affected MFP processes a specially crafted printer job file, a denial-of-service (DoS) condition may occur.
- Product
- DocuPrint CP225w
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2025Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB veCVE-2021-46686 · Other software · Extra Innovation Inc. · reported by vultures@jpcert.or.jpCritical 9.8
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB ver.1.1.5 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker.
- Product
- acmailer CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025Cross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier.CVE-2023-49780 · Other software · Extra Innovation Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier. An arbitrary script may be executed on the web browser of the user who accessed the management page of the affected product.
- Product
- acmailer CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Shipping for Nova Poshta: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24612 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6.
- Product
- Shipping for Nova Poshta
- Affected
- up to 1.19.6
- What to do
- Affects up to 1.19.6. Update Shipping for Nova Poshta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2024A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical.CVE-2024-12782 · Other software · Fujifilm Business Innovation · reported by VulDBMedium 6.9
A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerability affects unknown code of the file /home/index.html#hashHome of the component Web Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains that "during technical verification it is not possible to reproduce any active actions like reboots which were mentioned in the original researcher disclosure."
- Product
- Apeos C3070
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to executeCVE-2024-12092 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCCVE-2024-12091 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to executeCVE-2024-12090 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCCVE-2024-12089 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
- Product
- ENOVIA Collaborative Industry Innovator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade functionCVE-2024-48453 · Other software · reported by MITRECritical 9.8
An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1.CVE-2024-11318 · Other software · Baratz Innovación · reported by cve-coordination@incibe.esHigh 7.5
An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifier on the "/cgi-bin/ocap/" endpoint.
- Product
- AbsysNet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.