Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 45 of 93
Oct 21, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-62597 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.9
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2025Taguette is an open source qualitative research tool.CVE-2025-62528 · Other software · remram44 · reported by GitHubMedium 5.4
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0.
- Product
- taguette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2025Taguette is an open source qualitative research tool.CVE-2025-62527 · Other software · remram44 · reported by GitHubHigh 7.1
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.
- Product
- taguette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2025ClipBucket v5 is an open source video sharing platform.CVE-2025-62429 · Other software · MacWarrior · reported by GitHubHigh 7.2
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tags and executed. Proper sanitization is not performed, and by injecting malicious code an attacker can execute arbitrary PHP code. This allows an attacker to achieve RCE. This issue has been resolved in version 5.5.2 #147.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025LobeChat is an open source chat application platform.CVE-2025-62505 · Other software · lobehub · reported by GitHubLow 3
LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service passes the user URLs to Crawler.crawl and the naive implementation performs a server-side fetch of each supplied URL without validating or restricting internal network addresses (such as localhost, 127.0.0.1, private IP ranges, or cloud instance metadata endpoints). This allows an attacker with a valid user token (or in development mode using a bypass header) to make the server disclose responses from internal HTTP services, potentially exposing internal API data or cloud metadata credentials. Version 1.136.2 fixes the issue. Update to version 1.136.2. No known workarounds exist.
- Product
- lobe-chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025ClipBucket v5 is an open source video sharing platform.CVE-2025-62430 · Other software · MacWarrior · reported by GitHubMedium 5.4
ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos accept user supplied values without adequate sanitization. For photos the Photo Title and Photo Tags fields accept user supplied values without adequate sanitization. A regular user who can edit a video or photo can inject script (for example by supplying a value such as a closing delimiter followed by a script element). The injected script executes when any user, including an unauthenticated visitor or an administrator, views the affected video or photo page. Although cookies are set with the HttpOnly attribute and cannot be read directly, the injected script can issue fetch requests to endpoints such as admin_area pages and exfiltrate their contents or trigger unintended actions. Version 5.5.2 build #146 and later contain a fix. Update to build 5.5.2 #146 or later. No known workarounds exist.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025DataEase is an open source data visualization and analytics platform.CVE-2025-62422 · Other software · dataease · reported by GitHubHigh 8.7
DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in version 2.10.14. No known workarounds exist.
- Product
- dataease
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025ImageMagick is an open source software suite for displaying, converting, and editing raster image files.CVE-2025-62171 · Other software · ImageMagick · reported by GitHubMedium 5.9
ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025OpenBao is an open source identity-based secrets management system.CVE-2025-59043 · Other software · openbao · reported by GitHubHigh 7.5
OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.
- Product
- openbao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Envoy is an open source edge and service proxy.CVE-2025-62504 · Other software · envoyproxy · reported by GitHubMedium 6.5
Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025ClipBucket V5 provides open source video hosting with PHP.CVE-2025-62423 · Other software · MacWarrior · reported by GitHubMedium 6.7
ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “/admin_area/login_as_user.php” file. Exploiting this vulnerability requires access privileges to the Admin Area.
- Product
- clipbucket-v5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62418 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62417 · Other software · bagisto · reported by GitHubHigh 7.1
Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field (e.g., product name) that contains a formula which may be evaluated by a victim’s spreadsheet application — potentially leading to data exfiltration and remote command execution (via older Excel exploits / OLE/cmd constructs or Excel macros). This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62416 · Other software · bagisto · reported by GitHubMedium 5.1
Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62415 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Bagisto is an open source laravel eCommerce platform.CVE-2025-62414 · Other software · bagisto · reported by GitHubMedium 6.9
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.
- Product
- bagisto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Envoy is a cloud-native, open source edge and service proxy.CVE-2025-62409 · Other software · envoyproxy · reported by GitHubMedium 6.6
Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Icinga 2 is an open source monitoring system.CVE-2025-61909 · Other software · Icinga · reported by GitHubMedium 4
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, the safe-reload script (also used during systemctl reload icinga2) and logrotate configuration shipped with Icinga 2 read the PID of the main Icinga 2 process from a PID file writable by the daemon user, but send the signal as the root user. This can allow the Icinga user to send signals to processes it would otherwise not permitted to. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- Product
- icinga2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Icinga 2 is an open source monitoring system.CVE-2025-61908 · Other software · Icinga · reported by GitHubHigh 7.1
Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null, dereferencing results in a segmentation fault. This can be used by any API user with access to an API endpoint that allows specifying a filter expression to crash the Icinga 2 daemon. A fix is included in the following Icinga 2 versions: 2.15.1, 2.14.7, and 2.13.13.
- Product
- icinga2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Icinga 2 is an open source monitoring system.CVE-2025-61907 · Other software · Icinga · reported by GitHubHigh 7.1
Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.
- Product
- icinga2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Strapi is an open source headless content management system.CVE-2025-53092 · Other software · strapi · reported by GitHubMedium 6.5
Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.
- Product
- strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Strapi is an open source headless CMS.CVE-2025-25298 · Other software · strapi · reported by GitHubMedium 6.3
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.
- Product
- strapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025OpenSearch Data Prepper as an open source data collector for observability data.CVE-2025-62371 · Other software · opensearch-project · reported by GitHubHigh 7.4
OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provided. Prior to this fix, the OpenSearch sink and source plugins would automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path was explicitly configured. This behavior bypasses SSL certificate validation, potentially allowing attackers to intercept and modify data in transit through man-in-the-middle attacks. The vulnerability affects connections to OpenSearch when the cert parameter is not explicitly provided. This issue has been patched in version 2.12.2. As a workaround, users can add the cert parameter to their OpenSearch sink or source configuration with the path to the cluster's CA certificate.
- Product
- data-prepper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025FreePBX is an open source GUI for managing Asterisk.CVE-2025-59429 · Other software · FreePBX · reported by GitHubHigh 8.5
FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and is available by default on version 16 via any bound IP address at port 8088. By default on version 17, the binding is only to localhost IP, making it significantly less vulnerable. The vulnerability can be exploited by unauthenticated attackers to obtain cookies from logged-in users, allowing them to hijack a session of an administrative user. The theft of admin session cookies allows attackers to gain control over the FreePBX admin interface, enabling them to access sensitive data, modify system configurations, create backdoor accounts, and cause service disruption. This issue has been patched in version 16.0.68.39 for FreePBX 16 and version 17.0.18.38 for FreePBX 17.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Home Assistant is open source home automation software that puts local control and privacy first.CVE-2025-62172 · Other software · home-assistant · reported by GitHubHigh 8.5
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript code into an energy entity's name field, which is then executed when any user hovers over data points in the energy dashboard graph tooltips. The vulnerability exists because entity names containing HTML are not properly sanitized before being rendered in graph tooltips. This could allow an attacker with authentication to execute arbitrary JavaScript in the context of other users' sessions. Additionally, if an energy provider (such as Tibber) supplies a malicious default name for an entity, the vulnerability can be exploited without direct user action when the default name is used. This issue has been patched in version 2025.10.2. No known workarounds exist.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.CVE-2025-62157 · Other software · argoproj · reported by GitHubHigh 8.5
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.
- Product
- argo-workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.CVE-2025-62156 · Other software · argoproj · reported by GitHubHigh 8.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic (workflow/executor/executor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the intended extraction directory. A malicious archive entry can supply a traversal or absolute path that, after cleaning, overrides the destination directory and causes files to be written outside the /work/tmp extraction path and into system directories such as /etc inside the container. The vulnerability enables arbitrary file creation or overwrite in system configuration locations (for example /etc/passwd, /etc/hosts, /etc/crontab), which can lead to privilege escalation or persistence within the affected container. Update to 3.6.12 or 3.7.3 to remediate the issue.
- Product
- argo-workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025EspoCRM is an open source customer relationship management application.CVE-2025-59428 · Other software · espocrm · reported by GitHubMedium 5.4
EspoCRM is an open source customer relationship management application. In versions before 9.1.9, a vulnerability allows arbitrary user creation, including administrative accounts, through a combination of stored SVG injection and lack of CSRF protection. An attacker with Knowledge Base edit permissions can embed a malicious SVG element containing a link in the body field of an article. When an authenticated user clicks the malicious link, they are redirected to an attacker-controlled HTML page that executes a CSRF request against the api/v1/User endpoint. If the victim is prompted for and enters their credentials, an attacker-controlled account is created with privileges determined by the CSRF payload. This issue has been patched in version 9.1.9.
- Product
- espocrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-62361 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.8
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This vulnerability is fixed in 3.5.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in tCVE-2025-62360 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-62359 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.3
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /pet/profile_pet.php?id_pet= endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_pet parameter. This vulnerability is fixed in 3.5.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-62358 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, the log parameter in configuracao_geral.php is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker can inject arbitrary JavaScript, which executes in the victim’s browser. This vulnerability is fixed in 3.5.1.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-62179 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.6
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, specifically in the cpf parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-62178 · Other software · LabRedesCefetRJ · reported by GitHubLow 3.5
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the idatendido parameter. This vulnerability is fixed in 3.5.1.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-62177 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.6
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar.php endpoint, specifically in the id_funcionario parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Emlog is an open source website building system.CVE-2025-61930 · Other software · emlog · reported by GitHubHigh 8.1
Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025Synapse is an open source Matrix homeserver implementation.CVE-2025-61672 · Other software · element-hq · reported by GitHubMedium 5.3
Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. The issue is patched in Synapse 1.138.3, 1.138.4, 1.139.1, and 1.139.2. Note that even though 1.138.3 and 1.139.1 fix the vulnerability, they inadvertently introduced an unrelated regression. For this reason, the maintainers of Synapse recommend skipping these releases and upgrading straight to 1.138.4 and 1.139.2.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025Emlog is an open source website building system.CVE-2025-61769 · Other software · emlog · reported by GitHubLow 2.1
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload .svg file that contains JavaScript code that is later being executed. Commit 052f9c4226b2c0014bcd857fec47677340b185b1 fixes the issue.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025phpMyFAQ is an open source FAQ web application.CVE-2025-59943 · Other software · thorsten · reported by GitHubHigh 8.1
phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue is fixed in version 4.0.13.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Redis is an open source, in-memory database that persists on disk.CVE-2025-49844 · Other software · redis · reported by GitHubCritical 9.9
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Redis is an open source, in-memory database that persists on disk.CVE-2025-46819 · Other software · redis · reported by GitHubMedium 6.3
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Redis is an open source, in-memory database that persists on disk.CVE-2025-46818 · Other software · redis · reported by GitHubMedium 6
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Redis is an open source, in-memory database that persists on disk.CVE-2025-46817 · Other software · redis · reported by GitHubHigh 7
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
- Product
- redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Emlog is an open source website building system.CVE-2025-61599 · Other software · emlog · reported by GitHubMedium 5.1
Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below. An authenticated user with privileges to post a "Twitter" message can inject arbitrary JavaScript code. The malicious script is stored on the server and gets executed in the browser of any user, including administrators, when they click on the malicious post to view it. This issue does not currently have a fix.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Emlog is an open source website building system.CVE-2025-61597 · Other software · emlog · reported by GitHubHigh 7.6
Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Traccar is an open source GPS tracking system.CVE-2025-61666 · Other software · traccar · reported by GitHubHigh 8.7
Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and non default installs between versions 5.8 - 6.0 are vulnerable to unauthenticated local file inclusion attacks which can lead to leakage of passwords or any file on the file system including the Traccar configuration file. Versions 5.8 - 6.0 are only vulnerable if <entry key='web.override'>./override</entry> is set in the configuration file. Versions 6.1 - 6.8.1 are vulnerable by default as the web override is enabled by default. The vulnerable code is removed in version 6.9.0.
- Product
- traccar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025WeGIA is an open source web manager with a focus on charitable institutions.CVE-2025-61665 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.7
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025WeGIA is an open source web manager with a focus on charitable institutions.CVE-2025-61606 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.8
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This issue is fixed in version 3.5.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025WeGIA is an open source web manager with a focus on charitable institutions.CVE-2025-61605 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identified in the /pet/profile_pet.php endpoint, specifically in the id_pet parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025WeGIA is an open source web manager with a focus on charitable institutions.CVE-2025-61604 · Other software · LabRedesCefetRJ · reported by GitHubHigh 7.1
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.