Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,306 results · page 65 of 127
Apr 9, 2025SEO Help: Server-Side Request Forgery (SSRF)CVE-2025-32675 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Server-Side Request Forgery (SSRF) vulnerability in QuantumCloud SEO Help seo-help allows Server Side Request Forgery.This issue affects SEO Help: from n/a through <= 6.7.9.
- Product
- SEO Help
- Affected
- up to 6.7.9
- What to do
- Affects up to 6.7.9. Update SEO Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Waymark: Server-Side Request Forgery (SSRF)CVE-2025-32487 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Joe Waymark waymark allows Server Side Request Forgery.This issue affects Waymark: from n/a through <= 1.5.2.
- Product
- Waymark
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Waymark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025IndieBlocks: Server-Side Request Forgery (SSRF)CVE-2025-31009 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from n/a through <= 0.13.1.
- Product
- IndieBlocks
- Affected
- up to 0.13.1
- What to do
- Affects up to 0.13.1. Update IndieBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer.CVE-2025-3288 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
- Product
- Arena®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Apr 8, 2025A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer.CVE-2025-3286 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
- Product
- Arena®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Apr 8, 2025A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer.CVE-2025-3285 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
- Product
- Arena®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Apr 8, 2025A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer.CVE-2025-2829 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
- Product
- Arena®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Apr 8, 2025A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer.CVE-2025-2293 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
- Product
- Arena®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Apr 8, 2025A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer.CVE-2025-2288 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.5
A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file.
- Product
- Arena®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Apr 7, 2025Transient DOS may occur while parsing SSID in action frames.CVE-2025-21448 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS may occur while parsing SSID in action frames.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2025In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security.CVE-2025-32359 · Other software · Zammad · reported by MITREMedium 4.8
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad only on the front end level, and not when using the API directly.
- Product
- Zammad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Sidebar Manager Light: Cross-Site Request Forgery (CSRF)CVE-2025-32112 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light sidebar-manager-light allows Cross Site Request Forgery.This issue affects Sidebar Manager Light: from n/a through <= 1.18.
- Product
- Sidebar Manager Light
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Sidebar Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode.CVE-2025-2245 · Other software · Bitdefender · reported by cve-requests@bitdefender.comMedium 6.9
A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.
- Product
- GravityZone Update Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characteCVE-2025-2243 · Other software · Bitdefender · reported by cve-requests@bitdefender.comMedium 6.9
A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.
- Product
- GravityZone Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restrictionCVE-2025-3192 · Other software · reported by report@snyk.ioHigh 7.8
Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsecurity.snyk.io
Apr 3, 2025An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side.CVE-2024-47215 · Other software · Snowplow · reported by MITREHigh 7.5
An issue was discovered in Snowbridge setups sending data to Google Tag Manager Server Side. It involves attaching an invalid GTM SS preview header to events, causing them to be retried indefinitely. As a result, the performance of forwarding events to GTM SS overall can be affected (latency, throughput).
- Product
- Snowbridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Residential Address Detection: Missing AuthorizationCVE-2025-30916 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Residential Address Detection: from n/a through <= 2.5.4.
- Product
- Residential Address Detection
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Residential Address Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not haCVE-2025-29063 · Other software · Lb-link · reported by MITRECritical 9.8
An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not handled properly.
- Product
- Bl-ac2100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parse_sec_desc() If osidoffset, gsidoffset and dacloffset coulCVE-2025-21946 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.8
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parse_sec_desc() If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd struct size. If it is smaller, It could cause slab-out-of-bounds. And when validating sid, It need to check it included subauth array size.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: mm: memory-failure: update ttu flag inside unmap_poisoned_folio Patch series "mm: memory_fCVE-2025-21907 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: mm: memory-failure: update ttu flag inside unmap_poisoned_folio Patch series "mm: memory_failure: unmap poisoned folio during migrate properly", v3. Fix two bugs during folio migration if the folio is poisoned. This patch (of 3): Commit 6da6b1d4a7df ("mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON") introduce TTU_HWPOISON to replace TTU_IGNORE_HWPOISON in order to stop send SIGBUS signal when accessing an error page after a memory error on a clean folio. However during page migration, anon folio must be set with TTU_HWPOISON during unmap_*(). For pagecache we need some policy just like the one in hwpoison_user_mappings to set this flag. So move this policy from hwpoison_user_mappings to unmap_poisoned_folio to handle this warning properly. Warning will be produced during unamp poison folio with the following log: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 365 at mm/rmap.c:1847 try_to_unmap_one+0x8fc/0xd3c Modules linked in: CPU: 1 UID: 0 PID: 365 Comm: bash Tainted: G W 6.13.0-rc1-00018-gacdb4bbda7ab #42 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtu
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 1, 2025WP Optin Wheel: Server-Side Request Forgery (SSRF)CVE-2025-31824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel wp-optin-wheel allows Server Side Request Forgery.This issue affects WP Optin Wheel: from n/a through <= 1.4.7.
- Product
- WP Optin Wheel
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update WP Optin Wheel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025ElementsCSS Addons for Elementor: Server-Side Request Forgery (SSRF)CVE-2025-31796 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in TheInnovs ElementsCSS Addons for Elementor css-for-elementor allows Server Side Request Forgery.This issue affects ElementsCSS Addons for Elementor: from n/a through <= 1.0.8.9.
- Product
- ElementsCSS Addons for Elementor
- Affected
- up to 1.0.8.9
- What to do
- Affects up to 1.0.8.9. Update ElementsCSS Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.CVE-2025-21384 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.3
An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
- Product
- Azure Health Bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025WP Link Preview: Server-Side Request Forgery (SSRF)CVE-2025-31527 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview wp-link-preview allows Server Side Request Forgery.This issue affects WP Link Preview: from n/a through <= 1.4.1.
- Product
- WP Link Preview
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WP Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.CVE-2025-24517 · Other software · Inaba Denki Sangyo Co., Ltd. · reported by vultures@jpcert.or.jpHigh 7.5
Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a remote attacker may obtain the product login password without authentication.
- Product
- CHOCO TEI WATCHER mini (IB-MCT001)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.CVE-2025-28096 · Other software · Onenav · reported by MITREMedium 5.4
OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.
- Product
- Onenav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.CVE-2025-28093 · Other software · Shopxo · reported by MITREMedium 6.3
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.CVE-2025-28092 · Other software · Shopxo · reported by MITREMedium 6.3
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.CVE-2025-28091 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.CVE-2025-28090 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.CVE-2025-28089 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forCVE-2025-1781 · Other software · W3C · reported by cve-coordination@google.comHigh 8.4
There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to read arbitrary local files if an attacker has access to exception messages.
- Product
- CSS Validator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025WP Compress for MainWP: Server-Side Request Forgery (SSRF)CVE-2025-31076 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Server Side Request Forgery.This issue affects WP Compress for MainWP: from n/a through <= 6.30.03.
- Product
- WP Compress for MainWP
- Affected
- up to 6.30.03
- What to do
- Affects up to 6.30.03. Update WP Compress for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.CVE-2024-48944 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api on another internal host and possibly get leaked information. There are two preconditions: 1) The attacker has got admin access to a kylin server; 2) Another internal host has the "/kylin/api/xxx/diag" api endpoint open for service. This issue affects Apache Kylin: from 5.0.0 through 5.0.1. Users are recommended to upgrade to version 5.0.2, which fixes the issue.
- Product
- Apache Kylin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Mar 27, 2025Video & Photo Gallery for Ultimate Member: Server-Side Request Forgery (SSRF)CVE-2025-22672 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Server Side Request Forgery.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.2.
- Product
- Video & Photo Gallery for Ultimate Member
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Video & Photo Gallery for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Metform: Server-Side Request Forgery (SSRF)CVE-2025-30914 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Roxnor Metform metform allows Server Side Request Forgery.This issue affects Metform: from n/a through <= 3.9.2.
- Product
- Metform
- Affected
- up to 3.9.2
- What to do
- Affects up to 3.9.2. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Off-Canvas Sidebars & Menus (Slidebars): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows DOM-Based XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through <= 0.5.8.2.
- Product
- Off-Canvas Sidebars & Menus (Slidebars)
- Affected
- up to 0.5.8.2
- What to do
- Affects up to 0.5.8.2. Update Off-Canvas Sidebars & Menus (Slidebars) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows.CVE-2025-2499 · Other software · Devolutions · reported by security@devolutions.netMedium 5.4
Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to bypass certain permission restrictions—specifically View Password, Edit Asset, and Edit Permissions by performing specific actions. This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29.
- Product
- Remote Desktop Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connectiCVE-2022-39163 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.7
IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
- Product
- Cognos Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Server-Side Request ForgeryCVE-2025-1912 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Product Import Export for WooCommerce – Import Export Product CSV Suite
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2025Zapier for: Server-Side Request ForgeryCVE-2024-13411 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
- Product
- Zapier for
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Zapier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2025WP Compress – Instant Performance & Speed Optimization: Server-Side Request ForgeryCVE-2025-2109 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
- Product
- WP Compress – Instant Performance & Speed Optimization
- Affected
- up to 6.30.15
- What to do
- Affects up to 6.30.15. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2025Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client aCVE-2025-27809 · Other software · Mbed · reported by MITREMedium 5.4
Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostname.
- Product
- mbedtls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commbed-tls.readthedocs.io
Mar 25, 2025SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382; however, a patch is available from the vendor.CVE-2024-44903 · Other software · SirsiDynix · reported by MITREHigh 7.5
SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382; however, a patch is available from the vendor. This is in ipac.jsp in a SELECT WHERE statement, in a part of the uri= variable in the second part of the full= inner variable.
- Product
- IPAC20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordartresilia.comartresilia.com
Mar 25, 2025A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the wCVE-2024-10207 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comMedium 5.3
A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force theCVE-2024-10206 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comMedium 6.9
A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data inteCVE-2024-8773 · Other software · Simple SA · reported by cvd@cert.plHigh 8.3
SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version received a patch 6.30@a03.9, which make it possible for an administrator to enforce encrypted communication. Versions 6.20 and 6.25 remain unpatched.
- Product
- SIMPLE.ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2025Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a locCVE-2025-2691 · Other software · Nossrf Project · reported by report@snyk.ioHigh 7.8
Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.
- Product
- Nossrf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Mar 22, 2025Export and Import Users and Customers: Server-Side Request ForgeryCVE-2025-1970 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Export and Import Users and Customers
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 22, 2025Your Friendly Drag and Drop Page Builder — Make Builder: Server-Side Request ForgeryCVE-2024-13856 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.10 via the make_builder_ajax_subscribe() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Your Friendly Drag and Drop Page Builder — Make Builder
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Your Friendly Drag and Drop Page Builder — Make Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.