Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Jun 16, 2025A web application for configuring the controller is accessible at a specific path.CVE-2025-25265 · Other software · WAGO · reported by info@cert.vde.comMedium 4.9
A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.
- Product
- WAGO CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code.CVE-2025-25264 · Other software · WAGO · reported by info@cert.vde.comMedium 6.5
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit.CVE-2025-0101 · Other software · WAGO · reported by info@cert.vde.comMedium 6.5
A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes some functions to work unexpected or stop working at all. Both during runtime and after a restart.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area.CVE-2024-12650 · Other software · WAGO · reported by info@cert.vde.comMedium 5.4
An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of the application but it does not affected other applications.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS CVE-2024-41974 · Other software · WAGO · reported by info@cert.vde.comHigh 7.1
A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS limited to BACNet communication.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.CVE-2024-41973 · Other software · WAGO · reported by info@cert.vde.comHigh 8.1
A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privileges.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges.CVE-2024-41972 · Other software · WAGO · reported by info@cert.vde.comMedium 6.5
A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privileges.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.CVE-2024-41971 · Other software · WAGO · reported by info@cert.vde.comHigh 8.1
A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.CVE-2024-41970 · Other software · WAGO · reported by info@cert.vde.comMedium 5.7
A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full CVE-2024-41969 · Other software · WAGO · reported by info@cert.vde.comHigh 8.8
A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which could lead to full system access and/or DoS.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.CVE-2024-41968 · Other software · WAGO · reported by info@cert.vde.comMedium 5.4
A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denialCVE-2024-41967 · Other software · WAGO · reported by info@cert.vde.comHigh 8.1
A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade process or a denial-of-service attack.
- Product
- CC100 0751-9x01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.