Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,443 results · page 6 of 29
Jun 6, 2025BP Profile as Homepage: Cross-Site Request Forgery (CSRF)CVE-2025-49453 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Profile as Homepage: from n/a through <= 1.1.
- Product
- BP Profile as Homepage
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BP Profile as Homepage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 22, 2025Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leadinCVE-2025-2394 · Other software · Ecovacs · reported by vdp@themissinglink.com.auMedium 4.7
Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive data disclosure.
- Product
- Ecovacs Mobile and Android Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordecovacs.comthemissinglink.com.au
May 14, 2025Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before.CVE-2025-44024 · Other software · reported by MITREMedium 6.1
Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0.CVE-2025-4455 · Other software · Patch My PC · reported by VulDBHigh 7.3
A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0. It has been rated as critical. This issue affects some unknown processing in the library advapi32.dll/BCrypt.dll/comctl32.dll/crypt32.dll/dwmapi.dll/gdi32.dll/gdiplus.dll/imm32.dll/iphlpapi.dll/kernel32.dll/mscms.dll/msctf.dll/ntdll.dll/ole32.dll/oleaut32.dll/PresentationNative_cor3.dll/secur32.dll/shcore.dll/shell32.dll/sspicli.dll/System.IO. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Home Updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 5, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php.CVE-2025-44071 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Homey: Insecure Direct Object ReferenceCVE-2025-1327 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's accounts.
- Product
- Homey
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
May 2, 2025Homey: Unauthorized modification of dataCVE-2025-1326 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts.
- Product
- Homey
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Apr 18, 2025Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.CVE-2025-28232 · Other software · Jmbroadcast · reported by MITRECritical 9.1
Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.
- Product
- Jmb0150 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").CVE-2025-31654 · Other software · Growatt · reported by ics-cert@hq.dhs.govMedium 6.9
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
- Product
- Cloud portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Home Services: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26930 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alleythemes Home Services home-services allows DOM-Based XSS.This issue affects Home Services: from n/a through <= 1.2.6.
- Product
- Home Services
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Home Services to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion SensoCVE-2021-27289 · Other software · reported by MITRECritical 9.1
A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attacker within wireless range can resend captured packets with a higher sequence number, which the devices incorrectly accept as legitimate messages. This allows spoofed commands to be injected without authentication, triggering false alerts and misleading the user through notifications in the mobile application used to monitor the network.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Apr 15, 2025Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter.CVE-2025-32993 · Other software · Vision Helpdesk · reported by MITREMedium 6.5
Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter. Authentication is not needed.
- Product
- Vision Helpdesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnav1n.medium.comvisionhelpdesk.com
Apr 9, 2025jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php.CVE-2025-29390 · Other software · Jerryhanjj · reported by MITREHigh 8.8
jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php.
- Product
- ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 4, 2025Homey: Incorrect Privilege AssignmentCVE-2024-51800 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.
- Product
- Homey
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025A vulnerability was found in itning Student Homework Management System up to 1.2.7.CVE-2025-3150 · Other software · itning · reported by VulDBMedium 5.3
A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected.
- Product
- Student Homework Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025A vulnerability was found in itning Student Homework Management System up to 1.2.7.CVE-2025-3149 · Other software · itning · reported by VulDBMedium 4.8
A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an unknown function of the file /shw_war/fileupload of the component Edit Job Page. The manipulation of the argument Course leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Student Homework Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26.CVE-2025-2237 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26. This is due to insufficient role restrictions in the 'process_register' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
- Affected
- up to 1.6.26
- What to do
- Affects up to 1.6.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 26, 2025An code execution vulnerability exists in the Xiaomi smarthome application product.CVE-2024-45352 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comHigh 8.8
An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- Product
- Xiaomi smarthome application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Synapse is an open source Matrix homeserver implementation.CVE-2025-30355 · Other software · element-hq · reported by GitHubHigh 7.1
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2025Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsCVE-2024-51322 · Other software · Zucchetti · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsp/gsfr_feditorHTML.jsp, /servlet/SPVisualZoom, /jsp/gsmd_container.jsp components
- Product
- AD HOC Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmembers.backbox.orgmembers.backbox.org
Mar 6, 2025Homey: Authentication bypassCVE-2025-0749 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers to log in to the first verified user.
- Product
- Homey
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfavethemes.zendesk.comwordfence.com
Mar 6, 2025Homey: Cross-Site Request ForgeryCVE-2025-0748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Homey
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfavethemes.zendesk.comwordfence.com
Mar 5, 2025Homey: Privilege escalationCVE-2024-12281 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the Administrator, Editor, or Shop Manager role.
- Product
- Homey
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 5, 2025Homey Login Register: Privilege escalationCVE-2024-11951 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
- Product
- Homey Login Register
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Homey Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 27, 2025Arbitrary file overwrite during home directory recovery due to improper symbolic link handling.CVE-2025-24832 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615.
- Product
- Acronis Backup plugin for cPanel & WHM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Feb 27, 2025A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0.CVE-2025-1743 · Other software · zyx0814 · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pichome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0.CVE-2025-1742 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0. Affected by this issue is some unknown functionality of the file /home.php. The manipulation of the argument page_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php compCVE-2025-22974 · Other software · Seacms · reported by MITRECritical 9.8
SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1616 · Other software · FiberHome · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality of the component Diagnosis. The manipulation of the argument Destination Address leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1615 · Other software · FiberHome · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the component NAT Submenu. The manipulation of the argument Description leads to cross site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1614 · Other software · FiberHome · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pf_Description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1613 · Other software · FiberHome · reported by VulDBMedium 4.8
A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511. It has been rated as problematic. This issue affects some unknown processing of the file /goform/URL_filterCfg of the component URL Filtering Submenu. The manipulation of the argument url_IP leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2025Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker withCVE-2022-28339 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comHigh 7.3
Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated privileges.
- Product
- Trend Micro HouseCall for Home Networks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comzerodayinitiative.com
Feb 18, 2025Home Assistant Core is an open source home automation that puts local control and privacy first.CVE-2025-25305 · Other software · home-assistant · reported by GitHubHigh 7
Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen. When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector. This issue has been addressed in version 2024.1.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability classified as critical has been found in pihome-shc PiHome 2.0.CVE-2025-1214 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability was found in pihome-shc PiHome 1.77.CVE-2025-1213 · Other software · pihome-shc · reported by VulDBMedium 5.1
A vulnerability was found in pihome-shc PiHome 1.77. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability was found in pihome-shc PiHome 2.0.CVE-2025-1185 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModal_Sensor_Graph. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical.CVE-2025-1184 · Other software · pihome-shc · reported by VulDBMedium 5.3
A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModal_MQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- PiHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025FlexIDX Home Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25082 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through <= 2.1.2.
- Product
- FlexIDX Home Search
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update FlexIDX Home Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2025Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.CVE-2025-24845 · Other software · Humming Heads Inc. · reported by vultures@jpcert.or.jpMedium 5.5
Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition.
- Product
- Defense Platform Home Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jphummingheads.co.jp
Feb 6, 2025NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.CVE-2025-24483 · Other software · Humming Heads Inc. · reported by vultures@jpcert.or.jpMedium 5.5
NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition.
- Product
- Defense Platform Home Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jphummingheads.co.jp
Feb 6, 2025Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.CVE-2025-23236 · Other software · Humming Heads Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained.
- Product
- Defense Platform Home Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jphummingheads.co.jp
Feb 6, 2025Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.CVE-2025-22894 · Other software · Humming Heads Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary files in the system may be altered. As a result, an arbitrary DLL may be executed with SYSTEM privilege.
- Product
- Defense Platform Home Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jphummingheads.co.jp
Feb 6, 2025Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.CVE-2025-20094 · Other software · Humming Heads Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege.
- Product
- Defense Platform Home Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jphummingheads.co.jp
Feb 6, 2025Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier.CVE-2025-22890 · Other software · Humming Heads Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege of the Windows system where the product is running may be obtained.
- Product
- Defense Platform Home Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jphummingheads.co.jp
Jan 31, 2025ECT Home Page Products: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13225 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ECT Home Page Products
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update ECT Home Page Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations.CVE-2024-23921 · Other software · ChargePoint · reported by ics-cert@hq.dhs.govHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanapp module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
- Product
- Home Flex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations.CVE-2024-23920 · Other software · ChargePoint · reported by ics-cert@hq.dhs.govHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the onboardee module. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of root.
- Product
- Home Flex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations.CVE-2024-23971 · Other software · ChargePoint · reported by ics-cert@hq.dhs.govHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
- Product
- Home Flex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations.CVE-2024-23970 · Other software · ChargePoint · reported by ics-cert@hq.dhs.govMedium 6.5
This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CURLOPT_SSL_VERIFYHOST setting. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root.
- Product
- Home Flex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.