Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,829 results · page 51 of 137
Feb 16, 2025A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical.CVE-2025-1366 · Other software · MicroWord · reported by VulDBMedium 4.8
A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function strcpy of the component VirusPopUp. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eScan Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability, which was classified as critical, was found in GNU elfutils 0.192.CVE-2025-1365 · Other software · GNU · reported by VulDBMedium 4.8
A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
- Product
- elfutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 16, 2025A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical.CVE-2025-1364 · Other software · MicroWord · reported by VulDBMedium 4.8
A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is the function passPrompt of the component USB Protection Service. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- eScan Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical.CVE-2025-1353 · Other software · Kong · reported by VulDBHigh 7.3
A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The real existence of this vulnerability is still doubted at the moment. The vendor is not able to reproduce the issue.
- Product
- Insomnia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2025A vulnerability has been found in GNU elfutils 0.192 and classified as critical.CVE-2025-1352 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.
- Product
- elfutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 16, 2025A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329.CVE-2025-1340 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging modeCVE-2025-22962 · Other software · reported by MITREHigh 7.2
A critical remote code execution (RCE) vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging mode is enabled. An attacker with a valid session ID (sess_id) can send specially crafted POST requests to the /json endpoint, enabling arbitrary command execution on the underlying system. This vulnerability can lead to full system compromise, including unauthorized access, privilege escalation, and potentially full device takeover.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access CVE-2025-22961 · Other software · reported by MITREHigh 8
A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access Control (CWE-284). Unauthenticated attackers can directly access sensitive database backup files (snapshot_users.db) via publicly exposed URLs (/logs/devcfg/snapshot/ and /logs/devcfg/user/). Exploiting this vulnerability allows retrieval of sensitive user data, including login credentials, potentially leading to full system compromise.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6.CVE-2025-1229 · Other software · olajowon · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected by this vulnerability is an unknown functionality of the file /read/?page=1&logfile=eee&match=. The manipulation of the argument path leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- Loggrove
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of service via local acceCVE-2024-39355 · Other software · reported by secure@intel.comMedium 5.7
Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of service via local access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintel.comlists.debian.org
Feb 12, 2025A vulnerability classified as critical was found in ywoa up to 2024.07.03.CVE-2025-1224 · Other software · R1bbit · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/mapper/xml/UserMapper.xml. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Yimioa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03.CVE-2025-1216 · Other software · R1bbit · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Yimioa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability classified as critical has been found in pihome-shc PiHome 2.0.CVE-2025-1214 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26366 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable front panel authentication via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26365 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable front panel authentication via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26364 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable an authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26363 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable an authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26362 · Other software · Q-Free · reported by prodsec@nozominetworks.comHigh 7.5
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unautheCVE-2025-26361 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.1
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an uCVE-2025-26360 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.3
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26359 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenCVE-2025-26347 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenCVE-2025-26345 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unCVE-2025-26344 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26342 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauCVE-2025-26341 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticCVE-2025-26339 · Other software · Q-Free · reported by prodsec@nozominetworks.comCritical 9.8
A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0.CVE-2025-1188 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/updateroutine.php. The manipulation of the argument tid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical.CVE-2025-1184 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModal_MQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability has been found in CodeZips Gym Management System 1.0 and classified as critical.CVE-2025-1183 · Other software · CodeZips · reported by VulDBMedium 5.3
A vulnerability has been found in CodeZips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/admin/more-userprofile.php. The manipulation of the argument login_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and escalate privileges by mCVE-2024-54916 · Other software · reported by MITREMedium 6.8
An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and escalate privileges by manipulating the return value of the checkPasscode method.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Feb 11, 2025A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices.CVE-2025-26409 · Other software · Wattsense · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.8
A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to the bootloader is possible, as well as a Linux login prompt. The bootloader access can be used to gain a root shell on the device. This issue is fixed in recent firmware versions BSP >= 6.4.1.
- Product
- Wattsense Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comsupport.wattsense.com
Feb 11, 2025The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB.CVE-2025-26408 · Other software · Wattsense · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.1
The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full access to the device is possible. This enables an attacker to extract information, modify and debug the device's firmware. All known versions are affected.
- Product
- Wattsense Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comsupport.wattsense.com
Feb 11, 2025A vulnerability, which was classified as critical, was found in GNU Binutils 2.43.CVE-2025-1182 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 11, 2025A vulnerability classified as critical was found in GNU Binutils 2.43.CVE-2025-1181 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 11, 2025A vulnerability was found in GNU Binutils 2.43 and classified as critical.CVE-2025-1176 · Other software · GNU · reported by VulDBLow 2.3
A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.
- Product
- Binutils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceware.orgsourceware.org
Feb 10, 2025A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical.CVE-2025-1167 · Other software · Mayuri K · reported by VulDBMedium 5.3
A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is some unknown functionality of the file /hr_soft/admin/Update_User.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Employee Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data.CVE-2025-23189 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability
- Product
- SAP NetWeaver and ABAP Platform (SDCCN)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data.CVE-2025-23187 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability.
- Product
- SAP NetWeaver and ABAP Platform (SDCCN)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability, which was classified as critical, was found in Lumsoft ERP 8.CVE-2025-1165 · Other software · Lumsoft · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability was found in Allims lab.online up to 20250201 and classified as critical.CVE-2025-1157 · Other software · Allims · reported by VulDBMedium 5.3
A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the file /model/model_recuperar_senha.php. The manipulation of the argument recuperacao leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- lab.online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical.CVE-2025-1156 · Other software · Pix Software · reported by VulDBMedium 6.9
A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login. The manipulation of the argument usuario leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Vivaz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1.CVE-2025-1154 · Other software · xxyopen · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Novel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Feb 8, 2025A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart.CVE-2025-1117 · Other software · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the argument coin leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.3 is able to address this issue. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 8, 2025A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart.CVE-2025-1116 · Other software · Dreamvention · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the function searchresults/search of the file /?route=extension/live_search/module/live_search.searchresults. The manipulation of the argument keyword leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Live AJAX Search Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Feb 7, 2025A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager <= ce92321, specifically in the /setup/index.php endpoint via CVE-2024-57279 · Other software · reported by MITREMedium 5.4
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager <= ce92321, specifically in the /setup/index.php endpoint via the returnto parameter. This vulnerability arises due to improper sanitization of user-supplied input, allowing an attacker to inject malicious JavaScript.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025A vulnerability classified as critical has been found in CmsEasy 7.7.7.9.CVE-2025-1106 · Other software · Cmseasy · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/database_admin.php. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cmseasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical.CVE-2025-1104 · Network & remote access · D-Link · reported by VulDBMedium 6.9
A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authentication bypass by spoofing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DHP-W310AV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical.CVE-2025-1086 · Other software · Safetytest · reported by VulDBMedium 6.9
A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /static/. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Cloud-Master Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned.CVE-2024-56467 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
- Product
- EntireX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.