Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,242 results · page 7 of 25
Oct 10, 2025A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier.CVE-2025-61864 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 10, 2025An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete_mem of V-SFT v6.2.7.0 and earlier.CVE-2025-61863 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete_mem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 10, 2025An out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0 and earlier.CVE-2025-61862 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 10, 2025An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier.CVE-2025-61861 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 10, 2025An out-of-bounds read vulnerability exists in VS6MemInIF!set_temp_type_default of V-SFT v6.2.7.0 and earlier.CVE-2025-61860 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds read vulnerability exists in VS6MemInIF!set_temp_type_default of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 10, 2025An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::is_motion_tween of V-SFT v6.2.7.0 and earlier.CVE-2025-61859 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::is_motion_tween of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 10, 2025An out-of-bounds write vulnerability exists in VS6ComFile!set_AnimationItem of V-SFT v6.2.7.0 and earlier.CVE-2025-61858 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds write vulnerability exists in VS6ComFile!set_AnimationItem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 10, 2025An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlier.CVE-2025-61857 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 10, 2025A stack-based buffer overflow vulnerability exists in VS6ComFile!CV7BaseMap::WriteV7DataToRom of V-SFT v6.2.7.0 and earlier.CVE-2025-61856 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
A stack-based buffer overflow vulnerability exists in VS6ComFile!CV7BaseMap::WriteV7DataToRom of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
- Product
- V-SFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpmonitouch.fujielectric.com
Oct 2, 2025Delta Electronics DIAScreen lacks proper validation of the user-supplied file.CVE-2025-59300 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 6.8
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Oct 2, 2025Delta Electronics DIAScreen lacks proper validation of the user-supplied file.CVE-2025-59299 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 6.8
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Oct 2, 2025Delta Electronics DIAScreen lacks proper validation of the user-supplied file.CVE-2025-59298 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 6.8
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Oct 2, 2025Delta Electronics DIAScreen lacks proper validation of the user-supplied file.CVE-2025-59297 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 6.8
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Sep 24, 2025Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file.CVE-2025-58319 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 7.8
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Sep 24, 2025Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file.CVE-2025-58317 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 7.8
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- Product
- CNCSoft-G2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Sep 14, 2025A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization.CVE-2025-10204 · Other software · LG Electronics · reported by product.security@lge.comHigh 7.1
A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to change the administrator password without verifying login status or user permissions.
- Product
- AC Smart II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability.CVE-2025-58321 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 10
Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability.
- Product
- DIALink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Sep 11, 2025Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability.CVE-2025-58320 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 7.3
Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability.
- Product
- DIALink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Sep 4, 2025Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.CVE-2025-55305 · Other software · electron · reported by GitHubMedium 6.1
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.
- Product
- electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025Delta Electronics DIAView has an authentication bypass vulnerability.CVE-2025-58318 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 5.9
Delta Electronics DIAView has an authentication bypass vulnerability.
- Product
- DIAView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 26, 2025Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability.CVE-2025-57704 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 5.5
Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability.
- Product
- EIP Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 26, 2025Delta Electronics COMMGR has Code Injection vulnerability.CVE-2025-53419 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 7.8
Delta Electronics COMMGR has Code Injection vulnerability.
- Product
- COMMGR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 26, 2025Delta Electronics COMMGR has Stack-based Buffer Overflow vulnerability.CVE-2025-53418 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 8.6
Delta Electronics COMMGR has Stack-based Buffer Overflow vulnerability.
- Product
- COMMGR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 18, 2025DIAEnergie - Reflected Cross-site ScriptingCVE-2025-57703 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 5.9
DIAEnergie - Reflected Cross-site Scripting
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 18, 2025DIAEnergie - Reflected Cross-site ScriptingCVE-2025-57702 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 5.9
DIAEnergie - Reflected Cross-site Scripting
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 18, 2025DIAEnergie - Reflected Cross-site ScriptingCVE-2025-57701 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bMedium 5.9
DIAEnergie - Reflected Cross-site Scripting
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 18, 2025DIAEnergie - Stored Cross-site ScriptingCVE-2025-57700 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bHigh 7
DIAEnergie - Stored Cross-site Scripting
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 16, 2025In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HPCVE-2025-38540 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. Add these 2 devices to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 13, 2025Part-DB is an open source inventory management system for electronic components.CVE-2025-55194 · Other software · Part-DB · reported by GitHubMedium 5.7
Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 9, 2025A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical.CVE-2025-8775 · Other software · Qiyuesuo · reported by VulDBLow 2.1
A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of the file /api/code/upload of the component Scheduled Task Handler. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Eelectronic Signature Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2025The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (rCVE-2025-53520 · Other software · EG4 Electronics · reported by ics-cert@hq.dhs.govHigh 8.6
The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the firmware is unencrypted and can be unpacked and altered without detection.
- Product
- EG4 12kPV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeg4electronics.comcisa.gov
Aug 8, 2025The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registerCVE-2025-47872 · Other software · EG4 Electronics · reported by ics-cert@hq.dhs.govMedium 6.9
The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registered, or does not exist in the database. Combined with the fact that serial numbers are sequentially assigned, this allows an attacker to gain information on the product registration status of different S/Ns.
- Product
- EG4 12kPV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeg4electronics.comcisa.gov
Aug 8, 2025The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthoCVE-2025-46414 · Other software · EG4 Electronics · reported by ics-cert@hq.dhs.govCritical 9.2
The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number. The API provides clear feedback when the correct PIN is entered. This vulnerability was patched in a server-side update on April 6, 2025.
- Product
- EG4 12kPV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeg4electronics.comcisa.gov
Aug 8, 2025The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation.CVE-2025-52586 · Other software · EG4 Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write operations for voltage, current, and power configuration, operational status, alarms, telemetry, system reset, or inverter control commands, potentially disrupting power generation or reconfiguring inverter settings.
- Product
- EG4 12kPV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeg4electronics.comeg4electronics.com
Aug 4, 2025DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure VulnerabilityCVE-2025-53417 · Other software · Delta Electronics · reported by 759f5e80-c8e1-4224-bead-956d7b33c98bCritical 9.3
DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability
- Product
- DIAView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfilecenter.deltaww.com
Aug 4, 2025Electron Capture facilitates video playback for screen-sharing and capture.CVE-2025-54871 · Other software · steveseguin · reported by GitHubMedium 5.5
Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRON_RUN_AS_NODE. This environment variable allows arbitrary Node.js code to be executed via the -e flag, which runs inside the main Electron context, inheriting any previously granted TCC entitlements (such as access to Documents, Downloads, etc.). This issue is fixed in version 2.20.0.
- Product
- electroncapture
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses.CVE-2025-51387 · Other software · Axosoft · reported by MITRECritical 9.8
The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode, enabling attackers to pass arguments that result in arbitrary code execution.
- Product
- Gitkraken Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstorm.news
Jul 30, 2025playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2025-51954 · Other software · Electronhub · reported by MITREMedium 6.1
playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability.
- Product
- AI Playground
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complayground.electronhub.ai
Jul 29, 2025An 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on the filesystem.CVE-2025-53082 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comMedium 6.1
An 'Arbitrary File Deletion' in Samsung DMS(Data Management Server) allows attackers to delete arbitrary files from unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses.
- Product
- Data Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 29, 2025An 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create arbitrary files in unintended locations on the filesystem.CVE-2025-53081 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comMedium 6.4
An 'Arbitrary File Creation' in Samsung DMS(Data Management Server) allows attackers to create arbitrary files in unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses.
- Product
- Data Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 29, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Samsung DMS(Data Management Server) allows authenticated attackers to create aCVE-2025-53080 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Samsung DMS(Data Management Server) allows authenticated attackers to create arbitrary files in unintended locations on the filesystem
- Product
- Data Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 29, 2025Absolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive filesCVE-2025-53079 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comMedium 4.9
Absolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive files
- Product
- Data Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 29, 2025Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to systemCVE-2025-53078 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comHigh 8
Deserialization of Untrusted Data in Samsung DMS(Data Management Server) allows attackers to execute arbitrary code via write file to system
- Product
- Data Management Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 29, 2025An execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute limited functions without permissions.CVE-2025-53077 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comMedium 6.5
An execution after redirect in Samsung DMS(Data Management Server) allows attackers to execute limited functions without permissions. An attacker could compromise the integrity of the platform by executing this vulnerability.
- Product
- DMS(Data Management Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungda.com
Jul 23, 2025Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less tCVE-2025-54455 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comCritical 9.1
Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Jul 23, 2025Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less tCVE-2025-54454 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comCritical 9.1
Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Jul 23, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.ThiCVE-2025-54453 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Jul 23, 2025Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21CVE-2025-54452 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comHigh 7.3
Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Jul 23, 2025Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicCVE-2025-54451 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comCritical 9.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Jul 23, 2025Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.ThiCVE-2025-54450 · Computers, phones & browsers · Samsung Electronics · reported by PSIRT@samsung.comHigh 7.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.
- Product
- MagicINFO 9 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungtv.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.