Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,080 results · page 34 of 142
Apr 7, 2025A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114.CVE-2025-3400 · Other software · ESAFENET · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. This affects an unknown part of the file /client/UnChkMailApplication.jsp. The manipulation of the argument typename leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.6.3.154.205_20250114.CVE-2025-3399 · Other software · ESAFENET · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.6.3.154.205_20250114. Affected by this issue is some unknown functionality of the file /pubinfo/updateNotice.jsp. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as critical was found in lenve VBlog up to 1.0.0.CVE-2025-3398 · Other software · lenve · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- VBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
Apr 7, 2025A vulnerability classified as problematic has been found in YzmCMS 7.1.CVE-2025-3397 · Other software · Yzmcms · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic.CVE-2025-3392 · Other software · hailey888 · reported by VulDBMedium 5.1
A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gson/oasys/controller/mail/MailController.java of the component Backend. The manipulation of the argument MailNumberId leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic.CVE-2025-3391 · Other software · hailey888 · reported by VulDBMedium 5.1
A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress of the file cn/gson/oass/controller/address/AddrController. java of the component Backend. The manipulation of the argument outtype leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01.CVE-2025-3390 · Other software · hailey888 · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file cn/gson/oass/controller/daymanager/DaymanageController.java of the component Backend. The manipulation of the argument scheduleList leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01.CVE-2025-3389 · Other software · hailey888 · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the file cn/gson/oasys/controller/inform/InformManageController.java of the component Backend. The manipulation of the argument menu leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01.CVE-2025-3388 · Other software · hailey888 · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/gson/oasys/controller/login/LoginsController.java of the component Frontend. The manipulation of the argument Username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- oa_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as problematic has been found in renrenio renren-security up to 5.4.0.CVE-2025-3387 · Other software · renrenio · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in renrenio renren-security up to 5.4.0. This affects an unknown part of the component JSON Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- renren-security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025ts-asn1-der is a collection of utility classes to encode ASN.1 data following DER rule.CVE-2025-32029 · Other software · ApelegHQ · reported by GitHubMedium 6.9
ts-asn1-der is a collection of utility classes to encode ASN.1 data following DER rule. Incorrect number DER encoding can lead to denial on service for absolute values in the range 2**31 -- 2**32 - 1. The arithmetic in the numBitLen didn't take into account that values in this range could result in a negative result upon applying the >> operator, leading to an infinite loop. The issue is patched in version 1.0.4. If upgrading is not an option, the issue can be mitigated by validating inputs to Asn1Integer to ensure that they are not smaller than -2**31 + 1 and no larger than 2**31 - 1.
- Product
- ts-asn1-der
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability has been found in joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 and classified as critical.CVE-2025-3382 · Other software · joey-zhou · reported by VulDBMedium 5.3
A vulnerability has been found in joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 and classified as critical. This vulnerability affects the function update of the file /api/user/update. The manipulation of the argument state leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- xiaozhi-esp32-server-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu 4.2.0.CVE-2025-3381 · Other software · zhangyanbo2007 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu 4.2.0. This affects an unknown part of the file WebIMController.java of the component File Upload. The manipulation of the argument ID leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- youkefu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7.CVE-2025-3380 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. Affected by this issue is some unknown functionality of the component FEAT Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as critical was found in PCMan FTP Server 2.0.7.CVE-2025-3379 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. Affected by this vulnerability is an unknown functionality of the component EPSV Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7.CVE-2025-3378 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component EPRT Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-3374 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component CCC Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-3373 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component SITE CHMOD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7.CVE-2025-3372 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component MKDIR Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7.CVE-2025-3371 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component DELETE Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7.CVE-2025-3349 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SYST Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical.CVE-2025-3343 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/reservation_update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical.CVE-2025-3342 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/payment_save.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3341 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0. This affects an unknown part of the file /admin/reservation_view.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3340 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/combo_update.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3339 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user_update.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability classified as critical has been found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3338 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/user_save.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical.CVE-2025-3334 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability was found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/category_save.php. The manipulation of the argument Category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical.CVE-2025-3333 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/menu_update.php. The manipulation of the argument menu leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3332 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in codeprojects Online Restaurant Management System 1.0. Affected is an unknown function of the file /admin/menu_save.php. The manipulation of the argument menu leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3331 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. This issue affects some unknown processing of the file /payment_save.php. The manipulation of the argument mode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0.CVE-2025-3330 · Other software · codeprojects · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. This vulnerability affects unknown code of the file /reservation_save.php. The manipulation of the argument first leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Online Restaurant Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8.CVE-2025-3329 · Other software · Consumer · reported by VulDBLow 2.3
A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- Comanda Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic.CVE-2025-3327 · Other software · iteaj · reported by VulDBMedium 5.1
A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- iboot 物联网网关
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic.CVE-2025-3326 · Other software · iteaj · reported by VulDBMedium 5.1
A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- iboot 物联网网关
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3.CVE-2025-3325 · Other software · iteaj · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- iboot 物联网网关
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0.CVE-2025-3318 · Other software · Kenj_Frog 肯尼基蛙 · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Kenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 1.0. Affected by this vulnerability is the function page of the file src/main/java/com/controller/ShangpinleixingController.java. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- company-financial-management 公司财务管理系统
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2025A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f.CVE-2025-3317 · Other software · fumiao · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f. Affected is an unknown function of the file opencms-dev/src/main/webapp/view/admin/document/dataPage.jsp. The manipulation of the argument path leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- opencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical.CVE-2025-3268 · Other software · qinguoyi · reported by VulDBMedium 6.9
A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_conn.cpp. The manipulation of the argument m_url_real leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- TinyWebServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
Apr 4, 2025A vulnerability, which was classified as critical, was found in qinguoyi TinyWebServer up to 1.0.CVE-2025-3267 · Other software · qinguoyi · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in qinguoyi TinyWebServer up to 1.0. This affects an unknown part of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- TinyWebServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
Apr 4, 2025A vulnerability, which was classified as critical, has been found in qinguoyi TinyWebServer up to 1.0.CVE-2025-3266 · Other software · qinguoyi · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in qinguoyi TinyWebServer up to 1.0. Affected by this issue is some unknown functionality of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- TinyWebServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagnificent-dill-351.notion.sitevuldb.com
Apr 4, 2025A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11.CVE-2025-3259 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- RX3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsixth-action-50e.notion.sitevuldb.com
Apr 4, 2025A vulnerability classified as problematic has been found in xujiangfei admintwo 1.0.CVE-2025-3257 · Other software · xujiangfei · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- admintwo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic.CVE-2025-3253 · Other software · xujiangfei · reported by VulDBMedium 5.1
A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic. This issue affects some unknown processing of the file /ztree/insertTree. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- admintwo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic.CVE-2025-3252 · Other software · xujiangfei · reported by VulDBMedium 5.1
A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic. This vulnerability affects unknown code of the file /resource/add. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- admintwo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0.CVE-2025-3251 · Other software · xujiangfei · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation of the argument motto leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- admintwo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7.CVE-2025-3250 · Other software · elunez · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000.CVE-2025-3249 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A6000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0.CVE-2025-3241 · Other software · zhangyanbo2007 · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of the component XML Document Handler. The manipulation of the argument routercontent leads to xml external entity reference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- youkefu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic.CVE-2025-3214 · Other software · JFinal · reported by VulDBMedium 5.3
A vulnerability has been found in JFinal CMS up to 5.2.4 and classified as problematic. Affected by this vulnerability is the function engine.getTemplate of the file /readTemplate. The manipulation of the argument template leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains that this is not a bug but a feature.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.