Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
980 results · page 6 of 20
Oct 13, 2025SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when acCVE-2025-42901 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability of the application.
- Product
- SAP Application Server for ABAP (BAPI Browser)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2025Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via APCVE-2025-24525 · Other software · Keysight · reported by ics-cert@hq.dhs.govHigh 8.7
Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authentication if the end user does not replace the TLS certificate that shipped with the device. Remediation is available in Version 6.9.1, released on September 23, 2025.
- Product
- Ixia Vision Product Family
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.ixiacom.comsupport.ixiacom.com
Sep 29, 2025A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using tCVE-2025-56807 · Other software · Fairsketch · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using the file explorer in the admin dashboard when creating new folders.
- Product
- Rise Ultimate Project Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.CVE-2025-26278 · Other software · reported by MITREHigh 7.5
A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 24, 2025Memory corruption due to global buffer overflow when a test command uses an invalid payload type.CVE-2025-47317 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption due to global buffer overflow when a test command uses an invalid payload type.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.CVE-2025-21487 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability.CVE-2025-10244 · Other software · Autodesk · reported by psirt@autodesk.comHigh 8.7
A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.appstreaming.autodesk.comdl.appstreaming.autodesk.com
Sep 9, 2025Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots fCVE-2025-52277 · Other software · Yeswiki · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field
- Product
- Yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacCVE-2025-9999 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932High 7.6
Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacker to execute unauthorized commands in the application.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025In the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_chaCVE-2025-38679 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.3
In the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 4, 2025An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via the "word" POST parameCVE-2025-57263 · Websites & servers · Phpversion · reported by MITREHigh 7.2
An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via the "word" POST parameter in the words.php admin panel.
- Product
- VX Guestbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In BootRom, there's a possible missing payload size check.CVE-2022-38696 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In BootRom, there's a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
- Product
- SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025In FDL1, there is a possible missing payload size check.CVE-2022-38693 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comCritical 9.8
In FDL1, there is a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
- Product
- SC9863A//T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS functiCVE-2023-41471 · Other software · 9001 · reported by MITREHigh 7.8
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more simply upload HTML files containing JavaScript.
- Product
- Copyparty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation.CVE-2025-4644 · Other software · Payload CMS · reported by cvd@cert.plMedium 5.3
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload.
- Product
- Payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Payload uses JSON Web Tokens (JWT) for authentication.CVE-2025-4643 · Other software · Payload CMS · reported by cvd@cert.plMedium 6.3
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.
- Product
- Payload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU coCVE-2025-6203 · Other software · HashiCorp · reported by security@hashicorp.comHigh 7.5
A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get renderedCVE-2025-55618 · Other software · Hyundai · reported by MITREHigh 7.3
In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get rendered.
- Product
- Navigation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leadCVE-2025-43960 · Other software · Adminer · reported by MITREHigh 8.6
Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2025In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB.CVE-2025-6791 · Other software · Centreon · reported by bd4443e6-1eef-43f3-9886-25fc9ceeaae7High 8.8
In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.This issue affects web: 24.10.0, 24.04.0, 23.10.0.
- Product
- web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comthewatch.centreon.com
Aug 20, 2025Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index.CVE-2024-57154 · Other software · reported by MITRECritical 9.8
Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload,CVE-2025-51487 · Other software · Moonshine · reported by MITREMedium 4.5
A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article.
- Product
- Moonshine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload.CVE-2025-55673 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 13, 2025An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process moduleCVE-2025-52385 · Other software · reported by MITRECritical 9.8
An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgcwe.mitre.org
Jul 31, 2025An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSIDCVE-2025-26063 · Other software · Intelbras · reported by MITRECritical 9.8
An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted payload into the ESSID name when creating a network.
- Product
- RX 1500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanuais.intelbras.com.brmanuais.intelbras.com.br
Jul 25, 2025A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecteCVE-2025-45406 · Other software · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URLCVE-2025-6185 · Other software · Leviton · reported by ics-cert@hq.dhs.govHigh 8.7
Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service.
- Product
- AcquiSuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Memory corruption while processing manipulated payload in video firmware.CVE-2025-27043 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing manipulated payload in video firmware.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.CVE-2025-21427 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload tCVE-2024-27685 · Websites & servers · Phpgurukul · reported by MITREHigh 7.1
SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload to the $cshortname, $cfullname, and $cdate variables.
- Product
- Student Record System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comphpgurukul.com
Jun 23, 2025A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field CVE-2023-47295 · Other software · NCR · reported by MITRECritical 9.8
A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field that accepts strings.
- Product
- Terminal Handler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jun 18, 2025A cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a crafted payload intoCVE-2025-45661 · Other software · Heavenspell · reported by MITREMedium 5.9
A cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a crafted payload into the id parameter at /members/edit.php.
- Product
- Minitcg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordambiguous.aniyu.netgithub.com
May 15, 2025A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload intCVE-2025-46053 · Other software · Weberp · reported by MITREMedium 5.1
A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29691 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29690 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29689 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29688 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29686 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage withCVE-2025-3020 · Other software · Wiesemann & Theis · reported by info@cert.vde.comMedium 5.4
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.
- Product
- ERP-Gateway 12x Digital Input, 6x Digital Relais
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.CVE-2025-45617 · Other software · Megagao · reported by MITREHigh 7.5
Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
- Product
- Production SSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload.CVE-2025-45614 · Other software · Lcw2004 · reported by MITREHigh 7.5
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload.
- Product
- ONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload.CVE-2025-45613 · Other software · Zhaojun1998 · reported by MITREHigh 7.5
Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload.
- Product
- Shiro-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payloadCVE-2025-45610 · Other software · Passjava · reported by MITREHigh 7.5
Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payload.
- Product
- Passjava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload.CVE-2025-45609 · Other software · KE · reported by MITREHigh 7.5
Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
- Product
- KOB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.CVE-2025-45608 · Other software · Zykzhangyukang · reported by MITREHigh 7.5
Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
- Product
- Xinguan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints.CVE-2025-42603 · Other software · Meon · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive information belonging to other users. Successful exploitation of this vulnerability could allow remote attacker to impersonate the target user and gain unauthorized access to the user account.
- Product
- KYC solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into thCVE-2023-43378 · Other software · Digitaldruid · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1_1 parameter.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflashy-lemonade-192.notion.siteflashy-lemonade-192.notion.site
Apr 21, 2025A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into theCVE-2025-28102 · Other software · Dogukanurker · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the postContent parameter at /createpost.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2025Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image titleCVE-2024-42699 · Other software · Alkacon · reported by MITREMedium 6.5
Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field
- Product
- Opencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2024-41446 · Other software · Alkacon · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.
- Product
- Opencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.