Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,829 results · page 41 of 137
May 11, 2025A vulnerability, which was classified as critical, was found in LyLme Spage 2.1.CVE-2025-4543 · Other software · LyLme · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in LyLme Spage 2.1. This affects an unknown part of the file lylme_spage/blob/master/admin/ajax_link.php. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Spage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as critical has been found in LmxCMS 1.41.CVE-2025-4541 · Other software · Lmxcms · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in LmxCMS 1.41. Affected is the function manageZt of the file c\admin\ZtAction.class.php of the component POST Request Handler. The manipulation of the argument sortid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lmxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical.CVE-2025-4536 · Other software · Gosuncn Technology Group · reported by VulDBMedium 6.9
A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmgr/user/listByPage. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Audio-Visual Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819.CVE-2025-4532 · Other software · Shanghai Bairui Information Technology · reported by VulDBHigh 7.3
A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- SunloginClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows.CVE-2025-4525 · Other software · Discord · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Discord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 10, 2025A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E.CVE-2025-4514 · Other software · Zhengzhou Jiuhua Electronic Technology · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. Affected by this issue is some unknown functionality of the file /javascript.php. The manipulation of the argument Value leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- mayicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0.CVE-2025-4494 · Other software · JAdmin-JAVA · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedLoginController.java of the component Admin Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- JAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0.CVE-2025-4482 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Project Worlds Student Project Allocation System 1.0. Affected by this vulnerability is an unknown functionality of the file /change_pass/forgot_password_sql.php. The manipulation of the argument Pat_BloodGroup1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Student Project Allocation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access.CVE-2025-28201 · Other software · Govicture · reported by MITREMedium 6.8
An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access.
- Product
- Rx1800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4462 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0.CVE-2025-4457 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Project Worlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Car Rental Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0.CVE-2025-4456 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in Project Worlds Car Rental Project 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Car Rental Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical.CVE-2025-4452 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this issue is the function formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical.CVE-2025-4451 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-619L 2.04B04 and classified as critical. Affected by this vulnerability is the function formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04.CVE-2025-4450 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.04B04. Affected is the function formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04.CVE-2025-4449 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.04B04. This issue affects the function formEasySetupWizard3. The manipulation of the argument wan_connected leads to buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04.CVE-2025-4448 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-619L 2.04B04. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-619L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical.CVE-2025-4446 · Other software · H3C · reported by VulDBHigh 8.6
A vulnerability has been found in H3C GR-5400AX up to 100R008 and classified as critical. This vulnerability affects the function Edit_List_SSID of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack needs to be approached within the local network.
- Product
- GR-5400AX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01.CVE-2025-4445 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01. Affected is the function wake_on_lan. The manipulation of the argument mac leads to command injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-605L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical.CVE-2025-4440 · Other software · H3C · reported by VulDBHigh 8.6
A vulnerability was found in H3C GR-1800AX up to 100R008 and classified as critical. Affected by this issue is the function EnableIpv6 of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
- Product
- GR-1800AX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision systCVE-2025-0505 · Other software · Arista Networks · reported by psirt@arista.comCritical 10
On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for devices under management. Note that CloudVision as-a-Service is not affected.
- Product
- CloudVision Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025Improper authentication in Secure Folder prior to version 1.8.12.0 in Android 13, and 1.9.21.00 in Android 14 allows physical attackers to reset the lock type oCVE-2025-20973 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.4
Improper authentication in Secure Folder prior to version 1.8.12.0 in Android 13, and 1.9.21.00 in Android 14 allows physical attackers to reset the lock type of Secure Folder.
- Product
- Secure Folder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 7, 2025Improper export of android application components in Settings in Galaxy Watch prior to SMR May-2025 Release 1 allows physical attackers to access developer settCVE-2025-20956 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.3
Improper export of android application components in Settings in Galaxy Watch prior to SMR May-2025 Release 1 allows physical attackers to access developer settings.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
May 6, 2025A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06.CVE-2025-4368 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06. Affected is the function formGetRouterStatus of the file /goform/MtuSetMacWan. The manipulation of the argument shareSpeed leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02 and classified as critical.CVE-2025-4354 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02 and classified as critical. Affected by this issue is the function check_dws_cookie of the file /storage. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DAP-1520
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424.CVE-2025-4353 · Other software · Brilliance · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424. Affected is an unknown function of the file /paraframework/queryTsDictionaryType.htm. The manipulation of the argument dictCn1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Golden Link Secondary System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424.CVE-2025-4352 · Other software · Brilliance · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424. This issue affects some unknown processing of the file /reprotframework/tcEntrFlowSelect.htm. The manipulation of the argument custTradeId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Golden Link Secondary System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability classified as critical was found in D-Link DIR-600L up to 2.07B01.CVE-2025-4350 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in D-Link DIR-600L up to 2.07B01. This vulnerability affects the function wake_on_lan. The manipulation of the argument host leads to command injection. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01.CVE-2025-4349 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument host leads to command injection. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability was found in D-Link DIR-600L up to 2.07B01 and classified as critical.CVE-2025-4345 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DIR-600L up to 2.07B01 and classified as critical. This issue affects the function formSetLog. The manipulation of the argument host leads to buffer overflow. The attack may be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, was found in D-Link DIR-600L up to 2.07B01.CVE-2025-4344 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in D-Link DIR-600L up to 2.07B01. This affects the function formLogin. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability has been found in D-Link DIR-600L up to 2.07B01 and classified as critical.CVE-2025-4343 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-600L up to 2.07B01 and classified as critical. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability, which was classified as critical, has been found in D-Link DIR-600L up to 2.07B01.CVE-2025-4342 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in D-Link DIR-600L up to 2.07B01. Affected by this issue is the function formEasySetupWizard3. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-600L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01.CVE-2025-4341 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01. Affected by this vulnerability is the function sub_16570 of the file /htdocs/ssdpcgi of the component Request Header Handler. The manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-880L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025Memory corruption during concurrent access to server info object due to unprotected critical field.CVE-2024-45562 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.6
Memory corruption during concurrent access to server info object due to unprotected critical field.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03.CVE-2025-4340 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-890L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical.CVE-2025-4305 · Other software · kefaming · reported by VulDBMedium 5.3
A vulnerability has been found in kefaming mayi up to 1.3.9 and classified as critical. This vulnerability affects the function Upload of the file app/tools/controller/File.php. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- mayi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6.CVE-2025-4291 · Other software · Ideacms · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ideacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7.CVE-2025-4290 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SMNT Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability classified as critical was found in PCMan FTP Server 2.0.7.CVE-2025-4289 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7.CVE-2025-4288 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RNFR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails CVE-2025-2545 · Other software · Best Practical Solutions · reported by cve-coordination@incibe.esLow 2.3
Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.
- Product
- Request Tracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe.esdocs.bestpractical.com
May 5, 2025A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical.CVE-2025-4269 · Other software · TOTOLINK · reported by VulDBMedium 6.9
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A720R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical.CVE-2025-4268 · Other software · TOTOLINK · reported by VulDBMedium 6.9
A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input RebootSystem leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A720R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability has been found in newbee-mall 1.0 and classified as critical.CVE-2025-4259 · Other software · Newbee-mall Project · reported by VulDBMedium 5.3
A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- Newbee-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0.CVE-2025-4258 · Other software · zhangyanbo2007 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master\src\main\java\com\ukefu\webim\web\handler\resource\MediaController.java. The manipulation of the argument imgFile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- youkefu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7.CVE-2025-4255 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-4251 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component RMDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-4237 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical.CVE-2025-4236 · Other software · PCMan · reported by VulDBMedium 6.9
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component MDIR Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.