Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,305 results · page 9 of 47
Dec 17, 2025Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.CVE-2025-61736 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.1
Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.
- Product
- iSTAReX, iSTAR Edge, iSTAR Ultra LT, iSTAR Ultra , iSTAR Ultra SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govjohnsoncontrols.com
Dec 15, 2025ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a manCVE-2023-53881 · Other software · Ruijie · reported by VulnCheckCritical 9.2
ReyeeOS 1.204.1614 contains an unencrypted CWMP communication vulnerability that allows attackers to intercept and manipulate device communication through a man-in-the-middle attack. Attackers can create a fake CWMP server to inject and execute arbitrary commands on Ruijie Reyee Cloud devices by exploiting the unprotected HTTP polling requests.
- Product
- ReyeeOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordruijienetworks.comexploit-db.com
Dec 13, 2025The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and toCVE-2025-36753 · Other software · Growatt · reported by csirt@divd.nlHigh 8.6
The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device
- Product
- ShineLan-X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2025Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, suCVE-2025-36752 · Other software · Growatt · reported by csirt@divd.nlCritical 9.4
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle.
- Product
- ShineLan-X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to exploit weak session management by reusing IP-bound session identiCVE-2023-53776 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckHigh 8.7
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to exploit weak session management by reusing IP-bound session identifiers. Attackers can issue unauthorized requests to the device management API by leveraging the session binding mechanism to perform critical operations on the transmitter.
- Product
- Screen SFT DAB Series - Compact Radio DAB Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 10, 2025Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change user passwords by exploiting weak session management controCVE-2023-53775 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckHigh 7.1
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change user passwords by exploiting weak session management controls. Attackers can reuse IP-bound session identifiers to issue unauthorized requests to the userManager API and modify user credentials without proper authentication.
- Product
- Screen SFT DAB Series - Compact Radio DAB Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 10, 2025External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via loCVE-2025-67461 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5
External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.
- Product
- Zoom Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilegCVE-2025-67460 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.8
Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Rooms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP.CVE-2025-65827 · Other software · Meatmeet · reported by MITRECritical 9.1
The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.
- Product
- Meatmeet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 10, 2025Screen SFT DAB 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP address-bound sessioCVE-2023-53741 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckMedium 5.1
Screen SFT DAB 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP address-bound session identifiers. Attackers can exploit the vulnerable API by intercepting and reusing established sessions to remove user accounts without proper authorization.
- Product
- Screen SFT DAB Series - Compact Radio DAB Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 10, 2025Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentialCVE-2023-53740 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckHigh 8.6
Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentials. Attackers can exploit the userManager.cgx endpoint by sending a crafted JSON request with a new MD5-hashed password to directly modify the admin account.
- Product
- Screen SFT DAB Series - Compact Radio DAB Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 9, 2025Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication.CVE-2025-66457 · Other software · elysiajs · reported by GitHubHigh 7.5
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there an existing cookie schema), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, but when combined with GHSA-hxj9-33pp-j2cc, it allows for a full RCE chain. An attack requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). This issue is fixed in version 1.4.18.
- Product
- elysia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication.CVE-2025-66456 · Other software · elysiajs · reported by GitHubCritical 9.1
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.
- Product
- elysia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production.CVE-2025-42878 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.2
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.
- Product
- SAP Web Dispatcher and Internet Communication Manager (ICM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory cCVE-2025-42877 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.5
SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory corruption vulnerability. This results in high impact on the availability with no impact on confidentiality or integrity of the application.
- Product
- SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse autCVE-2025-42875 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.6
The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.
- Product
- SAP NetWeaver Internet Communication Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services.CVE-2025-66624 · Other software · bacnet-stack · reported by GitHubHigh 7.5
BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. Prior to 1.5.0.rc2, The npdu_is_expected_reply function in src/bacnet/npdu.c indexes request_pdu[offset+2/3/5] and reply_pdu[offset+1/2/4] without verifying that those APDU bytes exist. bacnet_npdu_decode() can return offset == 2 for a 2-byte NPDU, so tiny PDUs pass the version check and then get read out of bounds. On ASan/MPU/strict builds this is an immediate crash (DoS). On unprotected builds it is undefined behavior and can mis-route replies; RCE is unlikely because only reads occur, but DoS is reliable.
- Product
- bacnet-stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, therebyCVE-2025-41744 · Other software · Sprecher Automation · reported by info@cert.vde.comCritical 9.1
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity.
- Product
- SPRECON-E-C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsprecher-automation.com
Dec 1, 2025Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information.CVE-2025-58488 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.5
Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information. User interaction is required for triggering this vulnerability.
- Product
- SmartTouchCall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Dec 1, 2025An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux aCVE-2025-41739 · Other software · CODESYS · reported by info@cert.vde.comMedium 5.9
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.
- Product
- CODESYS PLCHandler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025File upload vulnerability in HCL Technologies Ltd.CVE-2025-51736 · Other software · Hcltech · reported by MITREMedium 6.3
File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025CSV formula injection vulnerability in HCL Technologies Ltd.CVE-2025-51735 · Other software · Hcltech · reported by MITREHigh 7.5
CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd.CVE-2025-51734 · Other software · Hcltech · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd.CVE-2025-51733 · Other software · Hcltech · reported by MITREMedium 5.5
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.
- Product
- Unica
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66263 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 8.9
Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_setting.php allows reading arbitrary files. The `/var/tdf/download_setting.php` endpoint constructs file paths by concatenating user-controlled `$_GET['filename']` with a forced `.tgz` extension. Running on PHP 5.3.2 (pre-5.3.4), the application is vulnerable to null byte injection (%00), allowing attackers to bypass the extension restriction and traverse paths. By requesting `filename=../../../../etc/passwd%00`, the underlying C functions treat the null byte as a string terminator, ignoring the appended `.tgz` and enabling unauthenticated arbitrary file disclosure of any file readable by the web server user.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66262 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.3
Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Tar extraction with -C / allow arbitrary file overwrite via crafted archive. The `restore_mozzi_memories.sh` script extracts user-controlled tar archives with `-C /` flag, depositing contents to the filesystem root without path validation. When combined with the unauthenticated file upload vulnerabilities (CVE-01, CVE-06, CVE-07), attackers can craft malicious .tgz archives containing path-traversed filenames (e.g., `etc/shadow`, `var/www/index.php`) to overwrite critical system files in writable directories, achieving full system compromise.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66261 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.9
Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec() allows remote code execution. The `/var/tdf/restore_settings.php` endpoint passes user-controlled `$_GET["name"]` parameter through `urldecode()` directly into `exec()` without validation or escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, `&&`, etc.) to achieve unauthenticated remote code execution as the web server user.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66260 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 7.2
PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_sql.php. The `status_sql.php` endpoint constructs SQL UPDATE queries by directly concatenating user-controlled `sw1` and `sw2` parameters without using parameterized queries or `pg_escape_string()`. While PostgreSQL's `pg_exec` limitations prevent stacked queries, attackers can inject subqueries for data exfiltration and leverage verbose error messages for reconnaissance.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66259 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.3
Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.php user supplied data/hour/time is passed directly into date shell command
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66258 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 7.1
Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Stored XSS via crafted filenames injected into patchlist.xml. User-controlled filenames are directly concatenated into `patchlist.xml` without encoding, allowing injection of malicious JavaScript payloads via crafted filenames (e.g., `<img src=x onerror=alert()>.bin`). The XSS executes when ajax.js processes and renders the XML file.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66257 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.2
Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files. The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66256 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.9
Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66255 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.9
Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages. The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66254 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 7.8
Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade parameter allows unauthenticated deletion of arbitrary files. The `deleteupgrade` parameter in `/var/www/upgrade_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/upload/` without any extension restriction or path sanitization, enabling attackers to remove critical system files.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66253 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.9
Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec() allows remote code execution via start_upgrade.php. The `/var/tdf/start_upgrade.php` endpoint passes user-controlled `$_GET["filename"]` directly into `exec()` without sanitization or shell escaping. Attackers can inject arbitrary shell commands using metacharacters (`;`, `|`, etc.) to achieve remote code execution as the web server user (likely root).
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66252 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 8.4
Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Infinite loop when unlink() fails in status_contents.php causing DoS. Due to the fact that the unlink operation is done in a while loop; if an immutable file is specified or otherwise a file in which the process has no permissions to delete; it would repeatedly attempt to do in a loop.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabdulmhsblog.comabdulmhsblog.com
Nov 25, 2025Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66251 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceHigh 7.7
Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden parameter allows path traversal deletion of arbitrary .tgz files.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2025Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A.CVE-2025-66250 · Other software · DB Electronica Telecomunicazioni S.p.A. · reported by b7efe717-a805-47cf-8e9a-921fca0ce0ceCritical 9.2
Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.
- Product
- Mozart FM Transmitter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2025PJSIP is a free and open source multimedia communication library.CVE-2025-65102 · Other software · pjsip · reported by GitHubHigh 8.7
PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, while the input frame length, which is based on stream ptime, may be less than that. This issue affects PJSIP users who use the Opus audio codec in receiving direction. The vulnerability can lead to unexpected application termination due to a memory overwrite. This issue has been patched in version 2.16.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd.CVE-2025-0645 · Other software · Narkom Communication and Software Technologies Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.2
Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Pyxis Signage: through 31012025.
- Product
- Pyxis Signage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 20, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies TradCVE-2025-0643 · Other software · Narkom Communication and Software Technologies Trade Ltd. Co. · reported by iletisim@usom.gov.trHigh 7.2
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Stored XSS. This issue affects Pyxis Signage: through 31012025.
- Product
- Pyxis Signage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 14, 2025Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests tCVE-2023-7328 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckMedium 6.9
Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values.
- Product
- Screen SFT DAB 600/C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdbbroadcast.com
Nov 14, 2025PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication.CVE-2021-4468 · Other software · PLANEX COMMUNICATIONS Inc. · reported by VulnCheckHigh 8.7
PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication. A remote, unauthenticated attacker can directly retrieve a compressed configuration backup file from the device. The backup contains sensitive configuration information, including credentials, allowing an attacker to obtain administrative access to the camera and compromise the confidentiality of the monitored environment.
- Product
- CS-QP50F-ING2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.compacketstorm.news
Nov 14, 2025Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002.CVE-2021-4467 · Other software · Positive Technologies · reported by VulnCheckHigh 8.7
Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002. The service generates a new session identifier for each incoming connection without adequately limiting concurrent requests. An unauthenticated remote attacker can repeatedly issue HTTPS requests to the service, causing excessive allocation of session identifiers. Under load, session identifier collisions may occur, forcing active client sessions to disconnect and resulting in service disruption.
- Product
- MaxPatrol 8 (Server)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comvulners.com
Nov 14, 2025Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier.CVE-2025-64444 · Other software · Sony Network Communications Inc. · reported by vultures@jpcert.or.jpHigh 8.6
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS command with root privileges.
- Product
- NCP-HG100/Cellular model
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.sonynetwork.co.jp
Nov 13, 2025Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of CVE-2025-62484 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.1
Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via CVE-2025-64741 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 8.1
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
- Product
- Zoom Workplace for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalaCVE-2025-64740 · Other software · Zoom Communications Inc. · reported by security@zoom.usHigh 7.5
Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- Product
- Zoom Workplace VDI Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.CVE-2025-64739 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 4.3
External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.
- Product
- Zoom Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information vCVE-2025-64738 · Other software · Zoom Communications Inc. · reported by security@zoom.usMedium 5
External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.
- Product
- Zoom Workplace for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.