Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,827 results · page 39 of 137
May 28, 2025A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.0.CVE-2025-5295 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.0. This vulnerability affects unknown code of the component PORT Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2025A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4CVE-2025-22252 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.
- Product
- FortiProxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
May 27, 2025IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.CVE-2025-25025 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- Product
- Security Guardium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1.CVE-2025-5247 · Other software · Gowabby · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1. This issue affects the function LoadUrl of the file \view\url.go. The manipulation of the argument r leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- HFish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025A vulnerability classified as critical has been found in GNU Binutils up to 2.44.CVE-2025-5245 · Other software · GNU · reported by VulDBMedium 4.8
A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
May 27, 2025Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauCVE-2025-41651 · Other software · Weidmueller · reported by info@cert.vde.comCritical 9.8
Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise.
- Product
- IE-SW-VL05M-5TX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability was found in FreeFloat FTP Server 1.0.0 and classified as critical.CVE-2025-5220 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the component GET Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability has been found in FreeFloat FTP Server 1.0.0 and classified as critical.CVE-2025-5219 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability has been found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component ASCII Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.0.CVE-2025-5218 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.0. Affected is an unknown function of the component LITERAL Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.0.CVE-2025-5217 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.0. This issue affects some unknown processing of the component RMDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability classified as critical has been found in D-Link DCS-5020L 1.01_B2.CVE-2025-5215 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DCS-5020L 1.01_B2. This affects the function websReadEvent of the file /rame/ptdc.cgi. The manipulation of the argument Authorization leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DCS-5020L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability classified as critical was found in Pixelimity 1.0.CVE-2025-5206 · Other software · Pixelimity · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in Pixelimity 1.0. Affected by this vulnerability is an unknown functionality of the file /install/index.php of the component Installation. The manipulation of the argument site_description leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pixelimity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical.CVE-2025-5196 · Other software · Wing · reported by VulDBHigh 7.5
A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Lua Admin Console. The manipulation leads to execution with unnecessary privileges. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 7.4.4 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[W]e do not consider it as a security vulnerability, because the system admin in WingFTP has full permissions [...], but you can suggest the user run WingFTP service as Normal User rather than SYSTEM/Root, it will be safer."
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical.CVE-2025-5182 · Other software · Summer Pearl Group · reported by VulDBMedium 5.3
A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unknown code of the component Listing Handler. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Vacation Rental Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsummerpearlgroup.gr
May 26, 2025A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16.CVE-2025-5180 · Other software · Wondershare · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the library CRYPTBASE.dll of the file NFWCHK.exe of the component Installer. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Filmora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 26, 2025A vulnerability classified as critical has been found in Realce Tecnologia Queue Ticket Kiosk up to 20250517.CVE-2025-5178 · Other software · Realce Tecnologia · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected is an unknown function of the file /adm/ajax.php of the component Image File Handler. The manipulation of the argument files[] leads to unrestricted upload. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Queue Ticket Kiosk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability, which was classified as critical, was found in Econtrata up to 20250516.CVE-2025-5172 · Other software · Econtrata · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valida. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Econtrata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5.CVE-2025-5171 · Other software · llisoft · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in llisoft MTA Maita Training System 4.5. This issue affects the function this.fileService.download of the file com\llisoft\controller\OpenController.java. The manipulation of the argument url leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MTA Maita Training System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5.CVE-2025-5170 · Other software · llisoft · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in llisoft MTA Maita Training System 4.5. This vulnerability affects the function AdminShitiListRequestVo of the file com\llisoft\controller\admin\shiti\AdminShitiController.java. The manipulation of the argument stTypeIds leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MTA Maita Training System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513.CVE-2025-5162 · Other software · H3C · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in H3C SecCenter SMP-E1114P02 up to 20250513. Affected by this issue is some unknown functionality of the file /safeEvent/importFile/. The manipulation of the argument logGeneralFile/logGeneralFile_2 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SecCenter SMP-E1114P02
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability was found in H3C GR-5400AX up to 100R008 and classified as critical.CVE-2025-5156 · Other software · H3C · reported by VulDBHigh 8.7
A vulnerability was found in H3C GR-5400AX up to 100R008 and classified as critical. Affected by this issue is the function EditWlanMacList of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- GR-5400AX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical.CVE-2025-5155 · Other software · qianfox · reported by VulDBMedium 5.3
A vulnerability has been found in qianfox FoxCMS 1.2.5 and classified as critical. Affected by this vulnerability is the function batchCope of the file app/admin/controller/Article.php. The manipulation of the argument ids leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- FoxCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability classified as critical was found in Chanjet CRM up to 20250510.CVE-2025-5152 · Other software · Chanjet · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Chanjet CRM up to 20250510. This vulnerability affects unknown code of the file /activity/newActivityedit.php?DontCheckLogin=1&id=null&ret=mod1. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4.CVE-2025-5151 · Other software · defog-ai · reported by VulDBMedium 4.8
A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function execute_analysis_code_safely of the file introspect/backend/tools/analysis_tools.py. The manipulation of the argument code leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is named 502. It is recommended to apply a patch to fix this issue. The code maintainer explains, that "[they] have added some workarounds to address this in #502, but will not be implementing a full fix. This is because this repo is meant to be run in a docker environment, which will significantly mitigate potential security risks. Having said that, we have added a SECURITY section in our README to make this clearer to users."
- Product
- introspect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability was found in Netcore NBR1005GPEV2, NBR200V2 and B6V2 up to 20250508 and classified as critical.CVE-2025-5147 · Other software · Netcore · reported by VulDBMedium 5.3
A vulnerability was found in Netcore NBR1005GPEV2, NBR200V2 and B6V2 up to 20250508 and classified as critical. This issue affects the function tools_ping of the file /usr/bin/network_tools. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- NBR1005GPEV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical.CVE-2025-5146 · Other software · Netcore · reported by VulDBMedium 5.3
A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical. This vulnerability affects the function passwd_set of the file /usr/bin/routerd of the component HTTP Header Handler. The manipulation of the argument pwd leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- NBR1005GPEV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 2025050CVE-2025-5145 · Other software · Netcore · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 20250508. This affects an unknown part of the file /www/cgi-bin/ of the component Query String Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- NBR1005GPEV2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordanonymous.4open.sciencegithub.com
May 24, 2025A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2.CVE-2025-5140 · Other software · Seeyon · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Seeyon Zhiyuan OA Web Application System up to 8.1 SP2. This affects the function this.oursNetService.getData of the file com\ours\www\ehr\openPlatform1\open4ClientType\controller\ThirdMenuController.class. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Zhiyuan OA Web Application System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical.CVE-2025-5129 · Other software · Sangfor · reported by VulDBHigh 7.3
A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknown functionality in the library MSASN1.dll. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 零信任访问控制系统 aTrust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
May 24, 2025A vulnerability, which was classified as critical, was found in ScriptAndTools Real-Estate-website-in-PHP 1.0.CVE-2025-5128 · Other software · ScriptAndTools · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in ScriptAndTools Real-Estate-website-in-PHP 1.0. Affected is an unknown function of the file /admin/ of the component Admin Login Panel. The manipulation of the argument Password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Real-Estate-website-in-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30.CVE-2025-5124 · Other software · Sony · reported by VulDBCritical 9.2
A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. It is recommended to change the configuration settings. The vendor was contacted early about this issue. They confirmed the existence but pointed out that they "have published the 'Hardening Guide' on the Web from July 2018 to January 2025 and have thoroughly informed customers of the recommendation to change their initial passwords".
- Product
- SNC-M1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical.CVE-2025-5119 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
- Product
- Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-43860 · Other software · openemr · reported by GitHubHigh 7.6
OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation and editing privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the (1) Text Box fields of Address, Address Line 2, Postal Code and City fields and (2) Drop Down menu options of Address Use, State and Country of the Additional Addresses section of the Contact tab in Patient Demographics. The injected script can execute in two scenarios: (1) dynamically during form input, and (2) when the form data is later loaded for editing. Version 7.0.3.4 contains a patch for the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-32967 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. A logging oversight in versions prior to 7.0.3.4 allows password change events to go unrecorded on the client-side log viewer, preventing administrators from auditing critical actions. This weakens traceability and opens the system to undetectable misuse by insiders or attackers. Version 7.0.3.4 contains a patch for the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2025-32794 · Other software · openemr · reported by GitHubHigh 7.6
OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the First and Last Name fields during patient registration. This code is later executed when viewing the patient's encounter under Orders → Procedure Orders. Version 7.0.3.4 contains a patch for the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical.CVE-2025-5114 · Other software · easysoft · reported by VulDBMedium 5.3
A vulnerability has been found in easysoft zentaopms 21.5_20250307 and classified as critical. This vulnerability affects the function Edit of the file /index.php?m=editor&f=edit&filePath=cGhhcjovLy9ldGMvcGFzc3dk&action=edit of the component Committer. The manipulation of the argument filePath leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- zentaopms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.CVE-2025-5112 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MGET Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.CVE-2025-5111 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component TYPE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.CVE-2025-5110 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in FreeFloat FTP Server 1.0. Affected by this vulnerability is an unknown functionality of the component VERBOSE Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0.CVE-2025-5109 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component STATUS Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability was found in TOZED ZLT W51 up to 1.4.2 and classified as critical.CVE-2025-5105 · Other software · TOZED · reported by VulDBMedium 6.9
A vulnerability was found in TOZED ZLT W51 up to 1.4.2 and classified as critical. Affected by this issue is some unknown functionality of the component Service Port 7777. The manipulation leads to improper clearing of heap memory before release. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ZLT W51
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configuCVE-2025-2506 · Other software · EnterpriseDB · reported by 20be33e2-bf35-4d13-8fad-18bd2f3e3659Medium 5.3
When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglogical command to obtain read access to replicated tables. When pglogical runs it should verify it is running on a replication connection but does not perform this check. This vulnerability was introduced in the pglogical 3.x codebase, which is proprietary to EDB. The same code base has been integrated into BDR/PGD 4 and 5. To exploit the vulnerability the attacker needs at least CONNECT permissions to a database configured for replication and must understand a number of pglogical3/BDR specific commands and be able to decode the binary protocol.
- Product
- pglogical
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9.CVE-2025-5080 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function webExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FH451
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5076 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component SEND Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical.CVE-2025-5075 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component DEBUG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File CVE-2025-3944 · Other software · Tridium · reported by psirt@honeywell.comHigh 7.2
Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
- Product
- Niagara Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.niagara-community.comhoneywell.com
May 22, 2025Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows alloCVE-2025-3936 · Other software · Tridium · reported by psirt@honeywell.comMedium 6.5
Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
- Product
- Niagara Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.niagara-community.comhoneywell.com
May 22, 2025A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.CVE-2025-5074 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component PROMPT Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.CVE-2025-5073 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. This issue affects some unknown processing of the component MKDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.CVE-2025-5053 · Other software · FreeFloat · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component MDIR Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.