Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,829 results · page 53 of 137
Jan 19, 2025A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13.CVE-2025-0566 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpan.baidu.comvuldb.com
Jan 18, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0562 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/health_status_entry.php. The manipulation of the argument usrid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2025A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0.CVE-2025-0558 · Other software · TDuckCloud · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThemeRequest of the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java. The manipulation of the argument color leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- tduck-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical.CVE-2025-0541 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/admin/edit_member.php. The manipulation of the argument name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability classified as critical has been found in Codezips Gym Management System 1.0.CVE-2025-0535 · Other software · Codezips · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem_submit.php. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Gym Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code.CVE-2024-12757 · Other software · Nedap Librix · reported by ics-cert@hq.dhs.govHigh 8.8
Nedap Librix Ecoreader is missing authentication for critical functions that could allow an unauthenticated attacker to potentially execute malicious code.
- Product
- Ecoreader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20.CVE-2025-0528 · Network & remote access · Tenda · reported by VulDBHigh 8.6
A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- AC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal CVE-2024-11146 · Other software · i3 Verticals · reported by 9119a7d8-5eab-497f-8521-727c672e3725Medium 6.3
TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.
- Product
- TrueFiling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosec.exchangeraw.githubusercontent.com
Jan 16, 2025Simple Vertical Timeline: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23856 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Odyno Simple Vertical Timeline simple-vertical-timeline allows DOM-Based XSS.This issue affects Simple Vertical Timeline: from n/a through <= 0.1.
- Product
- Simple Vertical Timeline
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Simple Vertical Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical.CVE-2025-0492 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability has been found in D-Link DIR-823X 240126/240802 and classified as critical. Affected by this vulnerability is the function FUN_00412244. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtasty-foxtrot-3a8.notion.sitevuldb.com
Jan 15, 2025A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0.CVE-2025-0491 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. Affected is an unknown function of the file /fladmin/cat_dodel.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0.CVE-2025-0490 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Fanli2012 native-php-cms 1.0. This issue affects some unknown processing of the file /fladmin/article_dodel.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0.CVE-2025-0489 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Fanli2012 native-php-cms 1.0. This vulnerability affects unknown code of the file /fladmin/friendlink_dodel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0.CVE-2025-0488 · Other software · Fanli2012 · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file product_list.php. The manipulation of the argument cat leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical.CVE-2025-0484 · Other software · Fanli2012 · reported by VulDBMedium 6.9
A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfig_doedit.php of the component Backend. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0.CVE-2025-0482 · Other software · Fanli2012 · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- native-php-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS VCVE-2025-0355 · Other software · NEC Corporation · reported by psirt-info@cyber.jp.nec.comHigh 7.5
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.
- Product
- WG2600HS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical.CVE-2025-0462 · Other software · Shanghai Lingdang Information Technology · reported by VulDBMedium 5.3
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affects some unknown processing of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The manipulation of the argument searchcontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Lingdang CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is retuCVE-2024-52898 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart.CVE-2025-0460 · Other software · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Jan 14, 2025A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2CVE-2024-35277 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.6
A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the managed devices by sending specifically crafted packets
- Product
- FortiManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Jan 14, 2025Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCPCVE-2024-11864 · Computers, phones & browsers · Arm · reported by arm-security@arm.comHigh 7.5
Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP
- Product
- SCP-Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCPCVE-2024-11863 · Computers, phones & browsers · Arm · reported by arm-security@arm.comMedium 5.3
Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP
- Product
- SCP-Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025An issue in the GDKanalytical_correlation component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.CVE-2024-57621 · Other software · Monetdb · reported by MITREHigh 7.5
An issue in the GDKanalytical_correlation component of MonetDB Server v11.47.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Monetdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability classified as critical was found in liujianview gymxmjpa 1.0.CVE-2025-0410 · Other software · liujianview · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in liujianview gymxmjpa 1.0. This vulnerability affects the function MenberDaoInpl of the file src/main/java/com/liujian/gymxmjpa/controller/MenberConntroller.java. The manipulation of the argument hyname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- gymxmjpa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0.CVE-2025-0409 · Other software · liujianview · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0. This affects the function MembertypeDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/MembertypeController.java. The manipulation of the argument typeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- gymxmjpa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability was found in liujianview gymxmjpa 1.0 and classified as critical.CVE-2025-0405 · Other software · liujianview · reported by VulDBMedium 5.3
A vulnerability was found in liujianview gymxmjpa 1.0 and classified as critical. This issue affects the function GoodsDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/GoodsController.java. The manipulation of the argument goodsName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- gymxmjpa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability has been found in liujianview gymxmjpa 1.0 and classified as critical.CVE-2025-0404 · Other software · liujianview · reported by VulDBMedium 5.3
A vulnerability has been found in liujianview gymxmjpa 1.0 and classified as critical. This vulnerability affects the function CoachController of the file src/main/java/com/liujian/gymxmjpa/controller/CoachController.java. The manipulation of the argument coachName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- gymxmjpa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability classified as critical was found in 1902756969 reggie 1.0.CVE-2025-0402 · Other software · 1902756969 · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- reggie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability classified as critical has been found in 1902756969 reggie 1.0.CVE-2025-0401 · Other software · 1902756969 · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in 1902756969 reggie 1.0. Affected is the function download of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- reggie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2025A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21.CVE-2025-0396 · Other software · exelban · reported by VulDBHigh 8.5
A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.CVE-2025-0392 · Other software · Guangzhou Huayi Intelligent Technology · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.CVE-2025-0391 · Other software · Guangzhou Huayi Intelligent Technology · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2025A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229.CVE-2025-0390 · Other software · Guangzhou Huayi Intelligent Technology · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- Jeewms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host computer unavailableCVE-2024-46464 · Other software · reported by MITREHigh 7.8
In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host computer unavailable or to execute programs with an elevation of privilege.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a crafted payload to the paCVE-2024-48806 · Other software · reported by MITREMedium 6.8
Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a crafted payload to the password field
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issCVE-2024-13268 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.8
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
- Product
- Opigno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local FiCVE-2024-13267 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.
- Product
- Opigno TinCan Question Type
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File InclCVE-2024-13265 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
- Product
- Opigno Learning path
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.TCVE-2024-13264 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
- Product
- Opigno module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File InclCVE-2024-13263 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.5
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.
- Product
- Opigno group manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16.CVE-2025-0349 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src/mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
- Product
- AC6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability was found in leiyuxi cy-fast 1.0 and classified as critical.CVE-2025-0345 · Other software · leiyuxi · reported by VulDBMedium 5.3
A vulnerability was found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this issue is the function listData of the file /sys/menu/listData. The manipulation of the argument order leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- cy-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical.CVE-2025-0344 · Other software · leiyuxi · reported by VulDBMedium 5.3
A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /commpara/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- cy-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicteCVE-2024-40762 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicted by an attacker potentially resulting in authentication bypass.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Jan 9, 2025A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical.CVE-2025-0334 · Other software · leiyuxi · reported by VulDBMedium 5.3
A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /sys/user/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- cy-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0.CVE-2025-0333 · Other software · leiyuxi · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in leiyuxi cy-fast 1.0. Affected is the function listData of the file /sys/role/listData. The manipulation of the argument order leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- cy-fast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2.CVE-2025-0331 · Other software · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2. This issue affects the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 9, 2025A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0.CVE-2025-0328 · Other software · KaiYuanTong · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation of the argument code leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ECT Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.zhaoj.invuldb.com
Jan 8, 2025A vulnerability classified as critical has been found in SingMR HouseRent 1.0.CVE-2024-13212 · Other software · SingMR · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in SingMR HouseRent 1.0. This affects the function singleUpload/upload of the file src/main/java/com/house/wym/controller/AddHouseController.java. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- HouseRent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.