Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,827 results · page 31 of 137
Jul 18, 2025A vulnerability, which was classified as critical, was found in Tenda FH451 1.0.0.9.CVE-2025-7796 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in Tenda FH451 1.0.0.9. This affects the function fromPptpUserAdd of the file /goform/PPTPDClient. The manipulation of the argument Username leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9.CVE-2025-7795 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. Affected by this issue is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability classified as critical was found in Tenda FH451 1.0.0.9.CVE-2025-7794 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9.CVE-2025-7793 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary. The manipulation of the argument webSiteId leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical.CVE-2025-7788 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1.CVE-2025-7787 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025Vertical scroll image slideshow gallery: Stored Cross-Site ScriptingCVE-2025-5752 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Vertical scroll image slideshow gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Vertical scroll image slideshow gallery
- Affected
- up to 11.1
- What to do
- Affects up to 11.1. Update Vertical scroll image slideshow gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 17, 2025A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1.CVE-2025-7762 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing of the file /menu_nat_more.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015.CVE-2025-7758 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9.CVE-2025-7747 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. The manipulation of the argument PPW leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Icinga DB Web provides a graphical interface for Icinga monitoring.CVE-2025-53840 · Other software · Icinga · reported by GitHubLow 2.4
Icinga DB Web provides a graphical interface for Icinga monitoring. Starting in version 1.2.0 and prior to version 1.2.2, users with access to Icinga Dependency Views, are allowed to see hosts and services that they weren't meant to on the dependency map. However, the name of an object will not be revealed nor does this grant access to a host's or service's detail view. Please note that this only affects the restrictions `filter/hosts` and `filter/services`. `filter/objects` is not affected by this and restricts objects as it is supposed to. Version 1.2.2 applies these restrictions properly. As a workaround, one may downgrade to version 1.1.3.
- Product
- icingadb-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Electrician - Electrical Service: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31055 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vergatheme Electrician - Electrical Service WordPress electrician allows Reflected XSS.This issue affects Electrician - Electrical Service WordPress: from n/a through <= 1.0.
- Product
- Electrician - Electrical Service
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Electrician - Electrical Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Medical Prescription Attachment Plugin for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-29009 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce medical-prescription-attachment-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Medical Prescription Attachment Plugin for WooCommerce: from n/a through <= 1.2.3.
- Product
- Medical Prescription Attachment Plugin for WooCommerce
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Medical Prescription Attachment Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 15, 2025Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).CVE-2025-53031 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.8, 8.0.8.5, 8.0.8.6, 8.1.1.4 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- Oracle Financial Services Analytical Applications Infrastructure
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2025-30739 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.2.11-12.2.13. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. While the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data as well as unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N).
- Product
- Oracle CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical.CVE-2025-7627 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue is the function fileUpload of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical.CVE-2025-7626 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this vulnerability is the function onlinePreview of the file /onlinePreview. The manipulation of the argument url leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd.CVE-2025-7625 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the function Download of the file /download. The manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, has been found in gmg137 snap7-rs up to 1.142.1.CVE-2025-7616 · Other software · gmg137 · reported by VulDBLow 2
A vulnerability, which was classified as critical, has been found in gmg137 snap7-rs up to 1.142.1. Affected by this issue is the function pthread_cond_destroy of the component Public API. The manipulation leads to memory corruption. The exploit has been disclosed to the public and may be used.
- Product
- snap7-rs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748.CVE-2025-7615 · Other software · TOTOLINK · reported by VulDBLow 2.1
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748.CVE-2025-7614 · Other software · TOTOLINK · reported by VulDBLow 2.1
A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- T6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical.CVE-2025-7602 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /arp_sys.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical was found in Tenda AX1803 1.0.0.1.CVE-2025-7598 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda AX1803 1.0.0.1. Affected by this vulnerability is the function formSetWifiMacFilterCfg of the file /goform/setWifiFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AX1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical has been found in Tenda AX1803 1.0.0.1.CVE-2025-7597 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda AX1803 1.0.0.1. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AX1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files.CVE-2024-26292 · Other software · Avid · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 7.1
An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
- Product
- Avid NEXIS E-series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraeph123.github.ioresources.avid.com
Jul 14, 2025A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical.CVE-2025-7576 · Other software · Teledyne · reported by VulDBMedium 5.5
A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical. Affected by this issue is some unknown functionality of the file /priv/production/production.html of the component Production Tools. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FLIR FB-Series O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical.CVE-2025-7575 · Other software · Zavy86 · reported by VulDBMedium 5.1
A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function image_drop_upload_ajax/image_delete_ajax of the file submit.php. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 1.0.78 is able to address this issue. The identifier of the patch is 98ea9ee4a2052c4327f89d2f7688cc1b5749450d. It is recommended to upgrade the affected component.
- Product
- WikiDocs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702.CVE-2025-7574 · Other software · LB-LINK · reported by VulDBHigh 8.9
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore of the file /cgi-bin/lighttpd.cgi of the component Web Interface. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC1900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 2025CVE-2025-7573 · Other software · LB-LINK · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This issue affects the function bs_GetManPwd in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC1900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702.CVE-2025-7572 · Other software · LB-LINK · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulnerability affects the function bs_GetHostInfo in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC1900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability classified as critical has been found in UTT HiPER 840G up to 3.1.1-190328.CVE-2025-7571 · Other software · UTT · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in UTT HiPER 840G up to 3.1.1-190328. This affects an unknown part of the file /goform/aspApBasicConfigUrcp. The manipulation of the argument Username leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- HiPER 840G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability has been found in jshERP up to 3.5 and classified as critical.CVE-2025-7566 · Other software · Jishenghua · reported by VulDBLow 2
A vulnerability has been found in jshERP up to 3.5 and classified as critical. This vulnerability affects the function exportExcelByParam of the file /src/main/java/com/jsh/erp/controller/SystemConfigController.java. The manipulation of the argument Title leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jsherp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22.CVE-2025-7565 · Other software · LB-LINK · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22.CVE-2025-7564 · Other software · LB-LINK · reported by VulDBHigh 7.1
A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22. Affected by this issue is some unknown functionality of the file /etc/shadow. The manipulation with the input root:blinkadmin leads to hard-coded credentials. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- BL-AC3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.CVE-2025-25180 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215.CVE-2025-7553 · Network & remote access · D-Link · reported by VulDBLow 2
A vulnerability classified as critical has been found in D-Link DIR-818LW up to 20191215. This affects an unknown part of the component System Time Page. The manipulation of the argument NTP Server leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-818LW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability was found in Tenda FH1201 1.2.0.14(408) and classified as critical.CVE-2025-7549 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was found in Tenda FH1201 1.2.0.14(408) and classified as critical. This issue affects the function frmL7ProtForm of the file /goform/L7Prot. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability has been found in Tenda FH1201 1.2.0.14(408) and classified as critical.CVE-2025-7548 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda FH1201 1.2.0.14(408) and classified as critical. This vulnerability affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical.CVE-2025-7532 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. This vulnerability affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408).CVE-2025-7531 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, was found in Tenda FH1202 1.2.0.14(408). This affects the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408).CVE-2025-7530 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function fromPptpUserAdd of the file /goform/PPTPDClient. The manipulation of the argument Username leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408).CVE-2025-7529 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda FH1202 1.2.0.14(408). Affected by this vulnerability is the function fromNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2025A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408).CVE-2025-7528 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda FH1202 1.2.0.14(408). Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability classified as critical was found in Tenda FH451 1.0.0.9.CVE-2025-7506 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatlimit of the file /goform/Natlimit of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9.CVE-2025-7505 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function frmL7ProtForm of the file /goform/L7Prot of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability has been found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical.CVE-2025-7488 · Other software · JoeyBling · reported by VulDBLow 2.1
A vulnerability has been found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical. This vulnerability affects the function Download of the file /file/download. The manipulation of the argument Name leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- SpringBoot_MyBatisPlus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26.CVE-2025-7487 · Other software · JoeyBling · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26. This affects the function SysFileController of the file /file/upload. The manipulation of the argument portraitFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- SpringBoot_MyBatisPlus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability has been found in Tenda FH1201 1.2.0.14 and classified as critical.CVE-2025-7468 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability has been found in Tenda FH1201 1.2.0.14 and classified as critical. This vulnerability affects the function fromSafeUrlFilter of the file /goform/fromSafeUrlFilter of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Jul 12, 2025A vulnerability, which was classified as critical, has been found in 1000projects ABC Courier Management 1.0.CVE-2025-7466 · Other software · 1000projects · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in 1000projects ABC Courier Management 1.0. Affected by this issue is some unknown functionality of the file /add_dealerrequest.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- ABC Courier Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2025A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14.CVE-2025-7465 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/fromRouteStatic of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH1201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcandle-throne-f75.notion.sitevuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.