Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,687 results · page 8 of 34
Nov 25, 2025Bookme – Free Online Appointment Booking and Scheduling: Time-based SQL InjectionCVE-2025-13385 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Bookme – Free Online Appointment Booking and Scheduling
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Bookme – Free Online Appointment Booking and Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 20, 2025Microsoft SharePoint Online Elevation of Privilege VulnerabilityCVE-2025-59245 · Email & office · Microsoft · reported by secure@microsoft.comCritical 9.8
Microsoft SharePoint Online Elevation of Privilege Vulnerability
- Product
- Microsoft SharePoint Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025i-Educar is free, fully online school management software.CVE-2025-65024 · Other software · portabilis · reported by GitHubHigh 7.2
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda_admin_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit 3e9763a.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025i-Educar is free, fully online school management software.CVE-2025-65023 · Other software · portabilis · reported by GitHubHigh 7.2
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/funcionario_vinculo_cad.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_funcionario_vinculo GET parameter, which is directly concatenated into an SQL query without proper sanitization. This issue has been patched in commit a00dfa3.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025i-Educar is free, fully online school management software.CVE-2025-65022 · Other software · portabilis · reported by GitHubHigh 7.2
i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the ieducar/intranet/agenda.php script. An attacker with access to an authenticated session can execute arbitrary SQL commands against the application's database. This vulnerability is caused by the improper handling of the cod_agenda request parameter, which is directly concatenated into multiple SQL queries without proper sanitization. This issue has been patched in commit b473f92.
- Product
- i-educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management.CVE-2025-64766 · Other software · NixOS · reported by GitHubMedium 5.3
NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.
- Product
- nixpkgs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455.CVE-2025-13276 · Other software · g33kyrash · reported by VulDBMedium 5.5
A vulnerability was detected in g33kyrash Online-Banking-System up to 12dbfa690e5af649fb72d2e5d3674e88d6743455. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument Username results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- Online-Banking-System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-64714 · Other software · PrivateBin · reported by GitHubMedium 5.8
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated Local File Inclusion exists in the template-switching feature. If `templateselection` is enabled in the configuration, the server trusts the `template` cookie and includes the referenced PHP file. An attacker can read sensitive data or, if they manage to drop a PHP file elsewhere, gain remote code execution. The constructed path of the template file is checked for existence, then included. For PrivateBin project files this does not leak any secrets due to data files being created with PHP code that prevents execution, but if a configuration file without that line got created or the visitor figures out the relative path to a PHP script that directly performs an action without appropriate privilege checking, those might execute or leak information. The issue has been patched in version 2.0.3. As a workaround, set `templateselection = false` (which is the default) in `cfg/conf.php` or remove it entirely
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Privilege escalationCVE-2025-11923 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.
- Product
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- What to do
- Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-64711 · Other software · PrivateBin · reported by GitHubLow 3.9
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on PrivateBin will execute arbitrary JavaScript within their own session (self-XSS). This allows an attacker who can entice a victim to drag or otherwise attach such a file to exfiltrate plaintext, encryption keys, or stored pastes before they are encrypted or sent. Certain conditions must exist for the vulnerability to be exploitable. Only macOS or Linux users are affected, due to the way the `>` character is treated in a file name on Windows. The PrivateBin instance needs to have file upload enabled. An attacker needs to have access to the local file system or somehow convince the user to create (or download) a malicious file (name). An attacker needs to convince the user to attach that malicious file to PrivateBin. Any Mac / Linux user who can be tricked into dragging a maliciously named file into the editor is impacted; code runs in the origin of the PrivateBin instance they are using. Attackers
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perCVE-2025-62211 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.7
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
- Product
- Dynamics 365 Field Service (online)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perCVE-2025-62210 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.7
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
- Product
- Dynamics 365 Field Service (online)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admisCVE-2025-41107 · Other software · QDOCS · reported by cve-coordination@incibe.esMedium 5.1
Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admission', wich affects the parameters 'firstname', 'lastname', 'guardian_name' and others. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her session cookie details.
- Product
- Smart Schoo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Therefore Corporation GmbH has recently become aware that Therefore™ Online and Therefore™ On-Premises contain an account impersonation vulnerability.CVE-2025-11843 · Other software · Therefore Corporation GmbH · reported by 4586e0a2-224d-4f8a-9cb4-8882b208c0b3High 8.8
Therefore Corporation GmbH has recently become aware that Therefore™ Online and Therefore™ On-Premises contain an account impersonation vulnerability. A malicious user may potentially be able to impersonate the web service account or the account of a service using the API when connecting to the Therefore™ Server. If the malicious user gains this impersonation user access, then it is possible for them to access the documents stored in Therefore™. This impersonation is at application level (Therefore access level), not the operating system level.
- Product
- Therefore Online and Therefore On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025PrivateBin is an online pastebin where the server has zero knowledge of pasted data.CVE-2025-62796 · Other software · PrivateBin · reported by GitHubMedium 5.8
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. An attacker can modify attachment_name before encryption so that, after decryption, arbitrary HTML is inserted unescaped into the page near the file size hint, enabling redirect (e.g., meta refresh) and site defacement and related phishing attacks. Script execution is normally blocked by the recommended Content Security Policy, limiting confidentiality impact. The issue was introduced in 1.7.7 and fixed in 2.0.2. Update to 2.0.2 or later. Workarounds include enforcing the recommended CSP, deploying PrivateBin on a separate domain, or disabling attachments.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton.CVE-2025-62781 · Other software · THM-Health · reported by GitHubMedium 5
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in 4.8.0.
- Product
- PILOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton.CVE-2025-62524 · Other software · THM-Health · reported by GitHubMedium 5.3
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.
- Product
- PILOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton.CVE-2025-62523 · Other software · THM-Health · reported by GitHubMedium 6.3
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim’s credentials if the server accepts those cross-origin requests as authenticated. Laravel’s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel’s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0
- Product
- PILOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php.CVE-2025-61247 · Other software · reported by MITREHigh 8.2
indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883.CVE-2025-12277 · Other software · Abdullah-Hasan-Sajjad · reported by VulDBMedium 5.5
A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Online-School
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2025SpendeOnline.org: Stored Cross-Site ScriptingCVE-2025-11875 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SpendeOnline.org plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spendeonline' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- SpendeOnline.org
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update SpendeOnline.org to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2025Tutor LMS – eLearning and online course solution: Sensitive Information ExposureCVE-2025-6680 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to view assignments for courses they don't teach which may contain sensitive information.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025Tutor LMS Pro – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2025-6639 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students.
- Product
- Tutor LMS Pro – eLearning and online course solution
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Tutor LMS Pro – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 25, 2025Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2025-11564 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 12, 2025A vulnerability was identified in yousaf530 Inferno Online Clothing Store up to 827dd42bfbe380e8de76fdc67958c24cf1246208.CVE-2025-11654 · Other software · yousaf530 · reported by VulDBMedium 5.5
A vulnerability was identified in yousaf530 Inferno Online Clothing Store up to 827dd42bfbe380e8de76fdc67958c24cf1246208. The affected element is an unknown function of the file /log.php. Such manipulation of the argument cemail/password leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Inferno Online Clothing Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2025A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64.CVE-2025-11628 · Other software · jimit105 · reported by VulDBLow 2
A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file /delete.php of the component Product Inventory Handler. This manipulation of the argument product_code causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Project-Online-Shopping-Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0.CVE-2025-52021 · Other software · reported by MITRECritical 9.8
A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The product_id GET parameter is unsafely passed to a SQL query without proper validation or parameterization.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a.CVE-2025-11333 · Other software · langleyfcu · reported by VulDBLow 1.9
A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. This impacts an unknown function of the file /customer_add_action.php of the component Add Customer Page. The manipulation of the argument First Name leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
- Product
- Online Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025RestroPress – Online Food Ordering System: Authentication BypassCVE-2025-9209 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
- Product
- RestroPress – Online Food Ordering System
- Affected
- 3.0.0 to 3.1.9.2
- What to do
- Affects 3.0.0 to 3.1.9.2. Update RestroPress – Online Food Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Sep 30, 2025The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input.CVE-2025-10659 · Other software · MegaSys · reported by ics-cert@hq.dhs.govCritical 9.3
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular expression check within the endpoint. Because the input is not correctly validated or sanitized, an unauthenticated attacker can inject arbitrary operating system commands through a crafted HTTP request, leading to remote code execution on the server in the context of the web application service account.
- Product
- Telenium Online Web Application:
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.portal.megasys.comcisa.gov
Sep 28, 2025A vulnerability was found in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a.CVE-2025-11125 · Other software · langleyfcu · reported by VulDBLow 2.1
A vulnerability was found in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. Affected by this vulnerability is an unknown functionality of the file /connection_error.php of the component Error Message Handler. Performing manipulation of the argument Error results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
- Product
- Online Banking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2025A flaw has been found in CodeAstro Online Leave Application 1.0.CVE-2025-11114 · Other software · CodeAstro · reported by VulDBLow 2.1
A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.php. Executing manipulation of the argument absence[] can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
- Product
- Online Leave Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Sep 28, 2025A vulnerability was detected in CodeAstro Online Leave Application 1.0.CVE-2025-11113 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the argument city results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Other parameters might be affected as well.
- Product
- Online Leave Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Sep 23, 2025A flaw has been found in Reservation Online Hotel Reservation System 1.0.CVE-2025-10843 · Other software · Reservation · reported by VulDBMedium 5.5
A flaw has been found in Reservation Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /reservation/paypalpayout.php. Executing manipulation of the argument confirm can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
- Product
- Online Hotel Reservation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025eZee Online Hotel Booking Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58661 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eZee Technosys eZee Online Hotel Booking Engine online-booking-engine allows Stored XSS.This issue affects eZee Online Hotel Booking Engine: from n/a through <= 1.0.0.
- Product
- eZee Online Hotel Booking Engine
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update eZee Online Hotel Booking Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2025Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS).CVE-2025-57880 · Other software · Hallo Welt! GmbH · reported by security@bluespice.comMedium 5.9
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.
- Product
- BlueSpice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login functionCVE-2025-57119 · Websites & servers · Phpgurukul · reported by MITRECritical 9.8
An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function
- Product
- Online Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0.CVE-2025-10425 · Other software · 1000projects · reported by VulDBMedium 5.5
A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function of the file /admin/controller/student_controller.php. Such manipulation of the argument new_image leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.
- Product
- Online Student Project Report Submission and Evaluation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0.CVE-2025-10424 · Other software · 1000projects · reported by VulDBMedium 5.5
A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/faculty_controller.php. This manipulation of the argument new_image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Online Student Project Report Submission and Evaluation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl.CVE-2025-57572 · Network & remote access · Tenda · reported by MITREMedium 5.6
Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl.
- Product
- F3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server.CVE-2025-58750 · Other software · rathena · reported by GitHubHigh 8.2
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b.
- Product
- rathena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server.CVE-2025-58448 · Other software · rathena · reported by GitHubCritical 9.1
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue.
- Product
- rathena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server.CVE-2025-58447 · Other software · rathena · reported by GitHubCritical 9.8
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.
- Product
- rathena
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules.CVE-2022-50238 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.4
The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodic monthly Windows updates. It is possible to fully synchronize the driver blocklist using WDAC policies. NOTE: The vendor explains that Windows Update provides a smaller, compatibility-focused driver blocklist for general users, while the full XML list is available for advanced users and organizations to customize at the risk of usability issues.
- Product
- Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlearn.microsoft.com
Aug 29, 2025iATS Online Forms: Time-based SQL InjectionCVE-2025-9441 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- iATS Online Forms
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update iATS Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 28, 2025A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input CVE-2025-51972 · Other software · Puneethreddyhc · reported by MITREMedium 6.5
A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
- Product
- Online Shopping System Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0.CVE-2025-51971 · Other software · Puneethreddyhc · reported by MITREMedium 5.4
A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in the f_name parameter is reflected in the server response without proper HTML encoding or output escaping. This allows remote attackers to inject arbitrary JavaScript code.
- Product
- Online Shopping System Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0.CVE-2025-51969 · Other software · Puneethreddyhc · reported by MITREMedium 6.5
A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. This flaw is present in the product_id GET parameter, which is not properly validated before being included in a SQL statement.
- Product
- Online Shopping System Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0.CVE-2025-51968 · Other software · Puneethreddyhc · reported by MITREMedium 6.5
A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize user-supplied input in the proId POST parameter, allowing attackers to inject arbitrary SQL expressions.
- Product
- Online Shopping System Advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025A vulnerability has been found in 1000projects Online Project Report Submission and Evaluation System 1.0.CVE-2025-9444 · Other software · 1000projects · reported by VulDBMedium 5.5
A vulnerability has been found in 1000projects Online Project Report Submission and Evaluation System 1.0. This issue affects some unknown processing of the file /admin/controller/delete_group_student.php. The manipulation of the argument batch_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Project Report Submission and Evaluation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.