Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,738 results · page 39 of 95
Jul 1, 2025Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (con_mgr components) allows Resource Leak Exposure.CVE-2025-49489 · Other software · ASR · reported by 68630edc-a58c-4cbd-9b01-0e130455c8aeMedium 5.4
Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (con_mgr components) allows Resource Leak Exposure. This vulnerability is associated with program files con_mgr/dialer_task.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
- Product
- Falcon_Linux、Kestrel、Lapwing_Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak Exposure.This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.CVE-2025-5072 · Other software · ASR · reported by 68630edc-a58c-4cbd-9b01-0e130455c8aeMedium 5.4
Resource leak vulnerability in ASR180x、ASR190x in con_mgr allows Resource Leak Exposure.This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.
- Product
- Falcon_Linux、Kestrel、Lapwing_Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific porCVE-2025-5310 · Other software · Dover Fueling Solutions · reported by ics-cert@hq.dhs.govCritical 9.3
Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution.
- Product
- ProGauge MagLink LX 4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordociocisa.sharepoint.comcisa.gov
Jun 27, 2025Audio Editor & Recorder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-53211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Retrieve Embedded Sensitive Data.This issue affects Audio Editor & Recorder: from n/a through <= 2.2.3.
- Product
- Audio Editor & Recorder
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Audio Editor & Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2025Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remotCVE-2025-6561 · Other software · Hunt Electronic · reported by twcert@cert.org.twCritical 9.8
Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials.
- Product
- HBF-09KD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 26, 2025A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract senCVE-2025-3773 · Other software · Trellix · reported by trellixpsirt@trellix.comNone
A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract sensitive information stored in a registry backup folder.
- Product
- System Information Reporter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability.CVE-2025-5823 · Other software · Autel · reported by zdi-disclosures@trendmicro.comMedium 6.5
Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.
- Product
- Autel MaxiCharger AC Wallbox Commercial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly accesCVE-2025-6560 · Network & remote access · Sapido · reported by twcert@cert.org.twCritical 9.3
Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. The affected models are out of support; replacing the device is recommended.
- Product
- BR071n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 23, 2025Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable produCVE-2025-48463 · Other software · Advantech · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4Low 3.1
Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable product uses unencrypted HTTP communication, potentially leading to unauthorised access or data tampering.
- Product
- Advantech Wireless Sensing and Equipment (WISE)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without prCVE-2025-34039 · Other software · Yonyou Co., Ltd. · reported by VulnCheckCritical 10
A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This can be exploited to run system commands and ultimately gain full control over the target server. The issue is rooted in a third-party JAR component bundled with the application, and the servlet is accessible without authentication on vulnerable installations. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
- Product
- UFIDA NC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comcnblogs.com
Jun 23, 2025In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissionsCVE-2025-52878 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025ProfileGrid: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-52719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Retrieve Embedded Sensitive Data.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
- Product
- ProfileGrid
- Affected
- up to 5.9.5.2
- What to do
- Affects up to 5.9.5.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains a missing authorization vulnerability in the NFS export.CVE-2024-53298 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.1, contains a missing authorization vulnerability in the NFS export. An unauthenticated attacker with remote access could potentially exploit this vulnerability leading to unauthorized filesystem access. The attacker may be able to read, modify, and delete arbitrary files. This vulnerability is considered critical as it can be leveraged to fully compromise the system. Dell recommends customers to upgrade at the earliest opportunity.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose inCVE-2025-49715 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
- Product
- Dynamics 365 FastTrack Implementation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2025The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most CVE-2025-24288 · Other software · Versa · reported by support@hackerone.comCritical 9.8
The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends the following security controls: 1) Change default passwords to complex passwords 2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character 3) Passwords must be changed at least every 90 days 4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password. 5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps.
- Product
- Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-portal.versa-networks.comsupport.versa-networks.com
Jun 18, 2025D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials.CVE-2025-45784 · Other software · Dlink · reported by MITRECritical 9.8
D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially leading to unauthorized access to device functions or user accounts. This vulnerability exists due to insecure storage of sensitive information in the firmware binary.
- Product
- Dph-400se Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2025handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library.CVE-2025-49597 · Other software · handcraftedinthealps · reported by GitHubLow 3.9
handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.
- Product
- goodby-csv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025REST API | Custom API Generator For Cross Platform And Import Export In WP: Privilege EscalationCVE-2025-5288 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
- Product
- REST API | Custom API Generator For Cross Platform And Import Export In WP
- Affected
- 1.0.0 to 2.0.3
- What to do
- Affects 1.0.0 to 2.0.3. Update REST API | Custom API Generator For Cross Platform And Import Export In WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 11, 2025The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is runnCVE-2025-26383 · Other software · Johnson Controls · reported by productsecurity@jci.comMedium 6.3
The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized data from the Windows PC that ICU is running on.
- Product
- iSTAR Configuration Utility (ICU)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Jun 11, 2025A password is exposed locally.CVE-2025-35941 · Other software · mySCADA · reported by vulnreport@tenable.comMedium 5.5
A password is exposed locally.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an Information Exposure vulnerability that could result in a SecuriCVE-2025-43579 · Email & office · Adobe · reported by AdobeMedium 5.5
Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.
- Product
- Acrobat Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability.CVE-2025-36575 · Other software · Dell · reported by security_alert@emc.comHigh 7.5
Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally.CVE-2025-47969 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally.
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortCVE-2025-25250 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.3
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.
- Product
- FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comcert-portal.siemens.com
Jun 10, 2025A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users.CVE-2025-37100 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.7
A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploitation could allow an attacker to iteratively navigate through the filesystem and ultimately download protected system files containing sensitive information.
- Product
- HPE Aruba Networking Private 5G Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data.CVE-2025-43701 · Other software · Salesforce · reported by security@salesforce.comHigh 7.5
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254.
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.CVE-2025-43700 · Other software · Salesforce · reported by security@salesforce.comHigh 7.5
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025.
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data.CVE-2025-43697 · Other software · Salesforce · reported by security@salesforce.comHigh 7.5
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025
- Product
- OmniStudio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption.CVE-2025-26468 · Other software · CyberData · reported by ics-cert@hq.dhs.govHigh 8.7
CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption.
- Product
- 011209 SIP Emergency Intercom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.CVE-2025-49653 · Other software · Lablup · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.
- Product
- BackendAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025elfsight Contact Form widget: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31045 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows Retrieve Embedded Sensitive Data.This issue affects elfsight Contact Form widget: from n/a through <= 2.3.1.
- Product
- elfsight Contact Form widget
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update elfsight Contact Form widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to accCVE-2025-5893 · Other software · Honding Technology · reported by twcert@cert.org.twCritical 9.3
Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials.
- Product
- Smart Parking Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 6, 2025WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability.CVE-2025-5748 · Other software · WOLFBOX · reported by zdi-disclosures@trendmicro.comHigh 8
WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Tuya communications module software. The issue results from the exposure of a method allowing the upload of crafted software images to the module. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26349.
- Product
- Level 2 EV Charger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025Foxit eSign for: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-49419 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Foxit eSign for WordPress: from n/a through <= 2.0.3.
- Product
- Foxit eSign for
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Foxit eSign for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Market Exporter: Cross-Site Request Forgery (CSRF)CVE-2025-49269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Anton Vanyukov Market Exporter market-exporter allows Cross Site Request Forgery.This issue affects Market Exporter: from n/a through <= 2.0.22.
- Product
- Market Exporter
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025KI Live Video Conferences: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-23969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Retrieve Embedded Sensitive Data.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
- Product
- KI Live Video Conferences
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Simple History: Sensitive data exposureCVE-2025-5760 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.
- Product
- Simple History
- What to do
- Update Simple History to the newest version.
Jun 5, 2025Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.CVE-2025-47966 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.
- Product
- Power Automate for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2025Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable.CVE-2025-20991 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper export of Android application components in Bluetooth prior to SMR Jun-2025 Release 1 allows local attackers to make devices discoverable.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jun 2, 2025WordPress Comments Import & Export: Unauthorized modification of dataCVE-2025-3919 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page. The vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4
- Product
- WordPress Comments Import & Export
- Affected
- up to 2.4.3
- Fixed in
- 2.4.3
- What to do
- Update WordPress Comments Import & Export to 2.4.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2025The Diviotec professional series exposes a web interface.CVE-2025-5113 · Other software · Diviotec · reported by research@onekey.comHigh 8.6
The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used.
- Product
- nbr222p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators.CVE-2025-4010 · Other software · Netcomm · reported by research@onekey.comHigh 8.6
The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable to arbitrary command injection and use insecure hardcoded passwords. Remote authenticated attackers can gain arbitrary code execution with elevated privileges.
- Product
- NTC 6200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.CVE-2018-25111 · Other software · django-helpdesk Project · reported by MITREMedium 5.1
django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.
- Product
- django-helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025WooCommerce Orders & Customers Exporter: Insertion of Sensitive Information Into Sent DataCVE-2025-48331 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.0.
- Product
- WooCommerce Orders & Customers Exporter
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2025Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated useCVE-2025-5334 · Other software · Devolutions · reported by security@devolutions.netHigh 7.5
Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users. This issue affects the following versions : * Remote Desktop Manager Windows 2025.1.34.0 and earlier * Remote Desktop Manager macOS 2025.1.16.3 and earlier * Remote Desktop Manager Android 2025.1.3.3 and earlier * Remote Desktop Manager iOS 2025.1.6.0 and earlier
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityCVE-2025-48928 · Other software · TeleMessage · reported by MITREExploitedMedium 4
TeleMessage TM SGNL contains an exposure of core dump file to an unauthorized control sphere Vulnerability. This vulnerability is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be included in this dump.
- Product
- TM SGNL
- On CISA’s list since
- Jul 1, 2025 (federal fix deadline Jul 22, 2025)
- What to do
- Attackers are using this now. Install TeleMessage’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogwired.comcisa.gov
May 28, 2025A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindowCVE-2025-24473 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 3.7
A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindows 7.0.13 through 7.0.14 may allow an unauthorized remote attacker to view application information via navigation to a hosted webpage, if Windows is configured to accept incoming connections to port 8053 (non-default setup)
- Product
- FortiClientWindows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
May 27, 2025Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation.CVE-2025-2236 · Other software · OpenText · reported by security@opentext.comLow 2.1
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation. The vulnerability could reveal sensitive information while managing and configuring of the external services. This issue affects Advanced Authentication versions before 6.5.
- Product
- Advanced Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.CVE-2025-36527 · Other software · ManageEngine · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.3
Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.
- Product
- ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised.CVE-2024-13945 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 8.4
Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.