The Consensus Security Vulnerability Alert

Jump to:

Internet Storm Center Spotlight
Recent CVEs
Sponsors
Read More

Example of "Modular" Malware (2025.05.07)

https://isc.sans.edu/diary/Example+of+Modular+Malware/31928/

Steganography Challenge (2025.05.03)

https://isc.sans.edu/diary/Steganography+Challenge/31910/

Steganography Analysis With pngdump.py: Bitstreams (2025.05.01)

https://isc.sans.edu/diary/Steganography+Analysis+With+pngdumppy+Bitstreams/31904/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

Product: SonicWall SSLVPN SMA100

CVSS Score: 0

** KEV since 2021-11-03 **

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2021-20016

ISC Podcast:

https://isc.sans.edu/podcastdetail/9432

Product: SonicWall SMA 500V Firmware

CVSS Score: 0

** KEV since 2025-05-01 **

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2023-44221

Product: Samsung MagicINFO 9 Server

CVSS Score: 0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2024-7399

ISC Diary:

https://isc.sans.edu/diary/31920

ISC Podcast:

https://isc.sans.edu/podcastdetail/9438

Product: Multiple Apple products

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-24252

NVD References:

https://support.apple.com/en-us/122371

https://support.apple.com/en-us/122372

https://support.apple.com/en-us/122373

https://support.apple.com/en-us/122374

https://support.apple.com/en-us/122375

https://support.apple.com/en-us/122377

https://support.apple.com/en-us/122378

Product: Mozilla Firefox and Thunderbird

CVSS Score: 9.1

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-4083

NVD References:

https://bugzilla.mozilla.org/show_bug.cgi?id=1958350

https://www.mozilla.org/security/advisories/mfsa2025-28/

https://www.mozilla.org/security/advisories/mfsa2025-29/

https://www.mozilla.org/security/advisories/mfsa2025-30/

https://www.mozilla.org/security/advisories/mfsa2025-31/

https://www.mozilla.org/security/advisories/mfsa2025-32/

Product: Slims (Senayan Library Management Systems)

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-25403

Product: Coresmartcontracts Uniswap

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-25962

NVD References:

https://github.com/CVEProject/docs/blob/gh-pages/requester/reservation-guidelines.md

Product: YesWiki

CVSS Score: 10.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-46348

NVD References:

https://github.com/YesWiki/yeswiki/commit/0d4efc880a727599fa4f6d7a64cc967afe475530

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wc9g-6j9w-hr95

Product: vLLM

CVSS Score: 10.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-32444

NVD References:

https://github.com/vllm-project/vllm/security/advisories/GHSA-hj4w-hm2g-p6w5

https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7

Product: PHPGurukul Park Ticketing Management System v2.0

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45017

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45018

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45019

NVD References:

https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/SQL/SQL_injection_in_edit_ticket.md

https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/SQL/SQl_Injection_in_was_foreigner-bwdates-reports-details.md

https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/SQL/SQL_injection_add_foreigners_ticket.md

Product: XWiki Platform

CVSS Score: 9.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-32973

NVD References:

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-x7wv-5qg4-vmr6

https://jira.xwiki.org/browse/XWIKI-22460

Product: XWiki Platform

CVSS Score: 9.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-32974

NVD References:

https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mvgm-3rw2-7j4r

https://jira.xwiki.org/browse/XWIKI-22002

Product: XWiki Contrib Syntax Markdown

CVSS Score: 9.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-46558

NVD References:

https://github.com/xwiki-contrib/syntax-markdown/security/advisories/GHSA-8g2j-rhfh-hq3r

https://jira.xwiki.org/browse/MARKDOWN-80

Product: Azure

CVSS Score: 9.9

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-30390

NVD References:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30390

Product: Azure Bot Framework SDK

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-30392

NVD References:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30392

Product: SourceCodester Simple Barangay Management System v1.0

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-44192

Product: Ladybird LibJS

CVSS Score: 9.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-47154

NVD References:

https://jessie.cafe/posts/pwning-ladybirds-libjs/

https://news.ycombinator.com/item?id=43852096

Product: ADOdb PHP database class library

CVSS Score: 10.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-46337

NVD References:

https://github.com/ADOdb/ADOdb/issues/1070

https://github.com/ADOdb/ADOdb/security/advisories/GHSA-8x27-jwjr-8545

Product: KUNBUS Revolution Pi OS Bookworm

CVSS Score: 10.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-24522

NVD References:

http://packages.revolutionpi.de/pool/main/p/pictory/

https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01

Product: KUNBUS PiCtory

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-32011

NVD References:

http://packages.revolutionpi.de/pool/main/p/pictory/

https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01

Product: KUNBUS PiCtory

CVSS Score: 9.0

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-35996

NVD References:

http://packages.revolutionpi.de/pool/main/p/pictory/

https://www.cisa.gov/news-events/ics-advisories/icsa-25-121-01

Product: Sematell ReplyOne

CVSS Score: 9.1

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2024-48905

NVD References:

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-082.txt

Product: Le-yan Le-show medical practice management system

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-3708

NVD References:

https://www.twcert.org.tw/en/cp-139-10086-dbfd0-2.html

https://www.twcert.org.tw/tw/cp-132-10085-69e16-1.html

Product: Flowring Technology Agentflow

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-3709

NVD References:

https://www.twcert.org.tw/en/cp-139-10090-112f7-2.html

https://www.twcert.org.tw/tw/cp-132-10091-12462-1.html

Product: Mydata Informatics Ticket Sales Automation

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-2812

NVD References:

https://www.usom.gov.tr/bildirim/tr-25-0099

Product: Honeywell MB-Secure

CVSS Score: 9.9

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-2605

NVD References:

https://www.honeywell.com/us/en/product-security#security-notices

Product: Wavlink WL-WN530H4

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-44868

NVD References:

https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WL-WN530H4/ping_test/readme.md

Product: Tenda AC9

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-44872

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-44877

NVD References:

https://github.com/Summermu/VulnForIoT/tree/main/Tenda_AC/AC9_formsetUsbUnload

https://github.com/Summermu/VulnForIoT/tree/main/Tenda_AC/AC9_formSetSambaConf

Product: Tenda AC9

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45042

NVD References:

https://github.com/Ghostsuzhijian/Iot-/blob/main/ac9_telnetd/rx3_telnetd.md

Product: WSO2 API Manager

CVSS Score: 9.1

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-2905

NVD References:

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993/

Product: Output Messenger

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-27920

NVD References:

https://www.outputmessenger.com/cve-2025-27920/

https://www.srimax.com/products-2/output-messenger/

Product: kashipara Online Service Management Portal V1.0

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45322

NVD References:

https://github.com/0xBhushan/Writeups/blob/main/CVE/Kashipara/Online%20Service%20Management%20Portal/SQL%20Injection-CheckStatus.pdf

Product: OpenCTI platform

CVSS Score: 9.1

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-24977

NVD References:

https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-mf88-g2wq-p7qm

Product: foxcms v1.2.5

CVSS Score: 9.1

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45238

NVD References:

https://gist.github.com/chao112122/27010786774f2bb584cc715fb027b95c

https://gitee.com/qianfox/foxcms

Product: Google Chrome

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-4052

NVD References:

https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html

https://issues.chromium.org/issues/401927528

Product: itranswarp v2.19

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45607

NVD References:

https://github.com/michaelliao/itranswarp/issues/73

Product: hope-boot v1.0.0

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45611

NVD References:

https://github.com/java-aodeng/hope-boot/issues/86

Product: xmall v1.1

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45612

NVD References:

https://github.com/Exrick/xmall/issues/96

Product: yaoqishan v0.0.1-SNAPSHOT

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45615

NVD References:

https://github.com/user-xiangpeng/yaoqishan/issues/29

Product: brcc v1.2.0

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-45616

NVD References:

https://github.com/baidu/brcc/issues/194

Product: SeaCMS v13.3

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-44071

NVD References:

https://github.com/202110420106/CVE/blob/master/seacms/seacms_rce.md

Product: SeaCMS v13.3

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-44072

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-44074

NVD References:

https://github.com/202110420106/CVE/blob/master/seacms/seacms_manage_sql.md

https://github.com/202110420106/CVE/blob/master/seacms/seacms_topic_sql.md

Product: Kibana

CVSS Score: 9.1

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-25014

NVD References:

https://discuss.elastic.co/t/kibana-8-17-6-8-18-1-or-9-0-1-security-update-esa-2025-07/377868

Product: Quarkus quarkus-security-webauthn

CVSS Score: 9.1

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2024-12225

NVD References:

https://access.redhat.com/security/cve/CVE-2024-12225

https://bugzilla.redhat.com/show_bug.cgi?id=2330484

CVE-2025-27007 - Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82.

Product: Brainstorm Force SureTriggers

Active Installations: 100,000+

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-27007

NVD References:

https://patchstack.com/articles/additional-critical-ottokit-formerly-suretriggers-vulnerability-patched?_s_id=cve

https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-suretriggers-1-0-82-privilege-escalation-vulnerability?_s_id=cve

CVE-2025-3746 - The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation and account takeover in versions 2.0.14 to 2.0.59, allowing unauthenticated attackers to change email addresses and reset passwords.

Product: WordPress OTP-less one tap Sign in plugin

Active Installations: This plugin has been closed as of April 30, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-3746

NVD References:

https://plugins.trac.wordpress.org/browser/otpless/tags/2.0.59./includes/class-login.php

https://www.wordfence.com/threat-intel/vulnerabilities/id/63fab608-1a75-4b07-8d82-8ab87e197547?source=cve

CVE-2025-3918 - The Job Listings plugin for WordPress is vulnerable to Privilege Escalation through unauthenticated attackers elevating their privileges by manipulating user roles.

Product: WordPress Job Listings plugin

Active Installations: This plugin has been closed as of May 1, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-3918

NVD References:

https://plugins.trac.wordpress.org/browser/job-listings/trunk/includes/forms/class-jlt-form-member.php#L68

https://wordpress.org/plugins/job-listings/#developers

https://www.wordfence.com/threat-intel/vulnerabilities/id/c9cd43f5-c3d0-4eb2-9c18-1af2edca37ff?source=cve

CVE-2025-1909 - The BuddyBoss Platform Pro plugin for WordPress up to version 2.7.01 is vulnerable to authentication bypass through Apple OAuth, allowing unauthenticated attackers to impersonate any user with access to the email.

Product: BuddyBoss Platform Pro plugin for WordPress

Active Installations: Unknown. Update to version 2.7.10, or a newer patched version

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-1909

NVD References:

https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/

https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/2-7-10/

https://www.wordfence.com/threat-intel/vulnerabilities/id/7cce9b8b-0589-4b09-b184-a66fc86fcb46?source=cve

CVE-2025-0855 - The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 5.8.0, allowing unauthenticated attackers to inject a PHP Object and potentially execute harmful actions.

Product: WordPress PGS Core plugin

Active Installations: Unknwon. Update to version 5.9.0, or a newer patched version

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-0855

NVD References:

https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog/

https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfc2249-3761-49c6-966e-73c33be74c0e?source=cve

CVE-2025-3844 - The PeproDev Ultimate Profile Solutions plugin for WordPress allows unauthenticated attackers to login as other users, including administrators, due to an Authentication Bypass vulnerability in versions 1.9.1 to 7.5.2.

Product: PeproDev Ultimate Profile Solutions plugin for WordPress

Active Installations: This plugin has been closed as of May 5, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-3844

NVD References:

https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L1483

https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L2836

https://www.wordfence.com/threat-intel/vulnerabilities/id/65be9417-7029-4f34-b834-98208a42743b?source=cve

Product: Brainstorm Force SureTriggers

Active Installations: 100,000+

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-27007

NVD References:

https://patchstack.com/articles/additional-critical-ottokit-formerly-suretriggers-vulnerability-patched?_s_id=cve

https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-suretriggers-1-0-82-privilege-escalation-vulnerability?_s_id=cve

Product: WordPress OTP-less one tap Sign in plugin

Active Installations: This plugin has been closed as of April 30, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-3746

NVD References:

https://plugins.trac.wordpress.org/browser/otpless/tags/2.0.59./includes/class-login.php

https://www.wordfence.com/threat-intel/vulnerabilities/id/63fab608-1a75-4b07-8d82-8ab87e197547?source=cve

Product: WordPress Job Listings plugin

Active Installations: This plugin has been closed as of May 1, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-3918

NVD References:

https://plugins.trac.wordpress.org/browser/job-listings/trunk/includes/forms/class-jlt-form-member.php#L68

https://wordpress.org/plugins/job-listings/#developers

https://www.wordfence.com/threat-intel/vulnerabilities/id/c9cd43f5-c3d0-4eb2-9c18-1af2edca37ff?source=cve

Product: BuddyBoss Platform Pro plugin for WordPress

Active Installations: Unknown. Update to version 2.7.10, or a newer patched version

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-1909

NVD References:

https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/

https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/2-7-10/

https://www.wordfence.com/threat-intel/vulnerabilities/id/7cce9b8b-0589-4b09-b184-a66fc86fcb46?source=cve

Product: WordPress PGS Core plugin

Active Installations: Unknwon. Update to version 5.9.0, or a newer patched version

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-0855

NVD References:

https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog/

https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfc2249-3761-49c6-966e-73c33be74c0e?source=cve

Product: PeproDev Ultimate Profile Solutions plugin for WordPress

Active Installations: This plugin has been closed as of May 5, 2025 and is not available for download. This closure is temporary, pending a full review.

CVSS Score: 9.8

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2025-3844

NVD References:

https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L1483

https://plugins.trac.wordpress.org/browser/peprodev-ups/tags/7.5.2/login/login.php#L2836

https://www.wordfence.com/threat-intel/vulnerabilities/id/65be9417-7029-4f34-b834-98208a42743b?source=cve

SEC504: Hacker Tools, Techniques, and Incident Handling

Wiz

SANS

SANS

Broadcom Inc.

SEC504: Hacker Tools, Techniques, and Incident Handling

The Consensus Security Vulnerability Alert

Share

Internet Storm Center Spotlight

Internet Storm Center Entries

Recent CVEs

CVE-2021-20016 - SonicWall SSLVPN SMA100 SQL Injection Vulnerability

CVE-2023-44221 - SMA100 SSL-VPN management interface is vulnerable to OS Command Injection by remote authenticated attackers with administrative privilege.

CVE-2024-7399 - Samsung MagicINFO 9 Server versions before 21.1050 is vulnerable to allowing attackers to write arbitrary files in restricted directories as system authority.

CVE-2025-24252 - macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4, iPadOS 18.4, and visionOS 2.4 prior to the update suffered from a use-after-free vulnerability that could allow a local network attacker to corrupt process memory.

CVE-2025-4083 - Firefox and Thunderbird versions below 138 and 128.10, respectively, are susceptible to a process isolation vulnerability when handling javascript: URIs, leading to possible sandbox escape.

CVE-2025-25403 - Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php.

CVE-2025-25962 - Coresmartcontracts Uniswap v.3.0 vulnerability allows remote attackers to escalate privileges via the _modifyPosition function.

cve-2025-25962 - f7cf21536978

CVE-2025-46348 - YesWiki allows for unauthorized site backups to be created and downloaded, potentially leading to file system overload or exposure of sensitive information.

CVE-2025-32444 - vLLM is vulnerable to remote code execution due to insecure ZeroMQ sockets when integrated with mooncake versions prior to 0.8.5.

CVE-2025-45017, CVE-2025-45018, & CVE-2025-45019 - PHPGurukul Park Ticketing Management System v2.0 SQL injection vulnerabilities

CVE-2025-32973 - XWiki allows attackers to gain programming rights on the wiki by exploiting a lack of warning when editing documents containing XWiki.ComponentClass objects, patched in versions 15.10.12, 16.4.3, and 16.8.0-rc-1.

CVE-2025-32974 - XWiki is vulnerable to an issue in versions 15.9-rc-1 to before 15.10.8 and 16.0.0-rc-1 to before 16.2.0, allowing users to insert malicious scripts that could impact the system's security.

CVE-2025-46558 - XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown, making versions 8.2 to before 8.9 vulnerable to XSS attacks through embedded Javascript code, compromising the security of the entire XWiki installation.

CVE-2025-30390 - Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.

CVE-2025-30392 - Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

CVE-2025-44192 - SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_clearance.

CVE-2025-47154 - Ladybird's LibJS vulnerability before f5a6704 could allow remote attackers to execute arbitrary code via a crafted .js file due to mishandling the freeing of vector arguments_list.

CVE-2025-46337 - ADOdb is vulnerable to SQL injection attacks prior to version 5.22.9 when connecting to a PostgreSQL database and using user-supplied data with pg_insert_id().

CVE-2025-24522 - KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable to unauthenticated remote attackers gaining full access to the Node-RED server due to lack of default authentication configuration.

CVE-2025-32011 - KUNBUS PiCtory versions 2.5.0 through 2.11.1 are vulnerable to authentication bypass via path traversal, allowing remote attackers to access the system without proper authentication.

CVE-2025-35996 - KUNBUS PiCtory version 2.11.1 and earlier allows an authenticated remote attacker to conduct a cross-site scripting attack via a specially crafted filename passed through API endpoints.

CVE-2024-48905 - Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.

CVE-2025-3708 - Le-show medical practice management system from Le-yan is vulnerable to SQL Injection, which can be exploited by remote attackers to manipulate the database and access sensitive information.

CVE-2025-3709 - Agentflow from Flowring Technology is susceptible to an Account Lockout Bypass vulnerability permitting remote attackers to conduct password brute force attacks without authentication.

CVE-2025-2812 - Mydata Informatics Ticket Sales Automation before 03.04.2025 is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands.

CVE-2025-2605 - Honeywell MB-Secure is vulnerable to privilege abuse due to improper neutralization of special elements used in an OS command, affecting versions from V11.04 to V12.53 and MB-Secure PRO from V01.06 to V03.09.

CVE-2025-44868 - Wavlink WL-WN530H4 20220801 is susceptible to command injection through the ping_test function in the adm.cgi, enabling attackers to run malicious commands.

CVE-2025-44872 & CVE-2025-44877 - Tenda AC9 V15.03.06.42_multi command injection vulnerabilities

CVE-2025-45042 - Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function.

CVE-2025-2905 - WSO2 API Manager has an XML External Entity (XXE) vulnerability in its gateway component, allowing unauthenticated remote attackers to read files from the server's filesystem or launch denial-of-service attacks.

CVE-2025-27920 - Output Messenger before 2.0.63 was vulnerable to a directory traversal attack allowing attackers to access sensitive files outside the intended directory.

CVE-2025-45322 - kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in osms/Requester/CheckStatus.php via the checkid parameter.

CVE-2025-24977 - OpenCTI allows any user with `manage customizations` capability to execute commands on the underlying infrastructure and access internal server side secrets via web-hooks, leading to potential root shell access and further attacks, fixed in version 6.4.11.

CVE-2025-45238 - foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method.

CVE-2025-4052 - Google Chrome DevTools prior to version 136.0.7103.59 had a low severity vulnerability that could allow a remote attacker to bypass access controls by tricking a user with specific UI gestures.

CVE-2025-45607 - An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request.

CVE-2025-45611 - Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request.

CVE-2025-45612 - Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.

CVE-2025-45615 - Yaoqishan v0.0.1-SNAPSHOT is vulnerable to attackers gaining Admin rights through crafted requests due to incorrect access control in the /admin/ API.

CVE-2025-45616 - brcc v1.2.0's /admin/** API has incorrect access control, enabling attackers to gain Admin rights through a crafted request.

CVE-2025-44071 - SeaCMS v13.3 is vulnerable to remote code execution through phomebak.php, enabling attackers to run arbitrary code with a crafted request.

CVE-2025-44072 & CVE-2025-44074 - SeaCMS v13.3 was discovered to contain SQL injection vulnerabilities.

CVE-2025-25014 - Kibana is vulnerable to prototype pollution, allowing arbitrary code execution through crafted HTTP requests to machine learning and reporting endpoints.

CVE-2024-12225 - Quarkus is vulnerable to unauthorized access due to default REST endpoints remaining accessible when developers provide custom REST endpoints.

CVE-2025-27007 - Incorrect Privilege Assignment vulnerability in Brainstorm Force SureTriggers allows Privilege Escalation.This issue affects SureTriggers: from n/a through 1.0.82.

CVE-2025-3746 - The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation and account takeover in versions 2.0.14 to 2.0.59, allowing unauthenticated attackers to change email addresses and reset passwords.

CVE-2025-3918 - The Job Listings plugin for WordPress is vulnerable to Privilege Escalation through unauthenticated attackers elevating their privileges by manipulating user roles.

CVE-2025-1909 - The BuddyBoss Platform Pro plugin for WordPress up to version 2.7.01 is vulnerable to authentication bypass through Apple OAuth, allowing unauthenticated attackers to impersonate any user with access to the email.

CVE-2025-0855 - The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 5.8.0, allowing unauthenticated attackers to inject a PHP Object and potentially execute harmful actions.

CVE-2025-3844 - The PeproDev Ultimate Profile Solutions plugin for WordPress allows unauthenticated attackers to login as other users, including administrators, due to an Authentication Bypass vulnerability in versions 1.9.1 to 7.5.2.

Sponsors

Wiz

SANS

SANS

Broadcom Inc.