Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Aug 12, 2026An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection.CVE-2025-41771 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.3
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphoenixcontact.csaf-tp.certvde.com
Aug 12, 2026An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via theCVE-2025-41770 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.7
An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphoenixcontact.csaf-tp.certvde.com
Aug 12, 2026The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration.CVE-2025-41769 · Other software · Phoenix Contact · reported by info@cert.vde.comCritical 9.3
The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordphoenixcontact.csaf-tp.certvde.com
May 27, 2026A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related filesCVE-2025-41670 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.7
A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locations that are not sufficiently protected against modification by low-privileged users. As the service runs with elevated privileges, successful exploitation may result in a local privilege escalation.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implemeCVE-2025-41669 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.7
The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute acceCVE-2025-41668 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 8.8
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file oCVE-2025-41667 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 8.8
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the deviCVE-2025-41666 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 8.8
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.CVE-2025-41665 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comMedium 6.5
An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affectCVE-2023-46144 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comMedium 6.5
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on tCVE-2023-46142 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 8.8
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.
- Product
- AXC F 1152
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2020On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack.CVE-2020-12521 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 6.5
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS a specially crafted LLDP packet may lead to a high system load in the PROFINET stack. An attacker can cause failure of system services or a complete reboot.
- Product
- AXC F 1152 (1151412)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Dec 17, 2020On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e.CVE-2020-12519 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.8
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use this vulnerability i.e. to open a reverse shell with root privileges.
- Product
- AXC F 1152 (1151412)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Dec 17, 2020On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitiveCVE-2020-12518 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.5
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.
- Product
- AXC F 1152 (1151412)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Dec 17, 2020On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rCVE-2020-12517 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 8.8
On Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS an authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).
- Product
- AXC F 1152 (1151412)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.