CVEs published August 20, 2025
273 CVEs were published on August 20, 2025: 39 critical, 138 high.
- Published
- 273
- Critical
- 39
- High
- 138
- Medium
- 95
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 53
Most affected products
- Linksys RE6250 · Linksys RE6300 +4
- 10
- Adobe Experience Manager
- 8
- Liferay Portal · Liferay DXP +1
- 6
- Tenda AC6
- 6
- Schneider Electric EcoStruxure™ Power Monitoring Expert · S…
- 5
- Commvault CommCell
- 4
- JetBrains IntelliJ IDEA
- 4
- Crocoblock JetEngine
- 3
- elunez eladmin
- 3
- JetBrains TeamCity
- 3
Critical 39
- CVE-2025-9288Missing type checks leading to hash rewind and passing on crafted datasha.js
- CVE-2025-9287Missing type checks leading to hash rewind and passing on crafted datacipher-base
- CVE-2025-55746Directus allows unauthenticated file upload and file modification due to lacking input sanitizationdirectus · @directus/api
- CVE-2025-8611AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution VulnerabilityAOMEI Cyber Backup
- CVE-2025-8610AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution VulnerabilityAOMEI Cyber Backup
- CVE-2011-10026Spreecommerce < 0.50.x API RCESpreecommerce · spree +1
- CVE-2010-20103ProFTPD 1.3.3c Backdoor Command ExecutionProFTPD Project ProFTPD
- CVE-2010-20049LeapFTP < 3.1.x Stack Buffer OverflowLeapWare LeapFTP
- CVE-2010-20059FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command ExecutioniXsystems FreeNAS
- CVE-2025-9074Docker Desktop allows unauthenticated access to Docker Engine API from containersDocker Desktop
- CVE-2025-27129An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110.Tenda AC6
- CVE-2025-49381WordPress ads.txt Guru Connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerabilityads.txt Guru Connect
- CVE-2025-49400WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 8.2 - Cross Site Scripting (XSS) Vulnerabilityosama.esh WP Visitor Statistics
- CVE-2025-49408WordPress Templately Plugin <= 3.2.7 - Sensitive Data Exposure VulnerabilityWPDeveloper Templately
- CVE-2025-49409WordPress SensorPress plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitybrewlabs SensorPress
- CVE-2025-49410WordPress TC Testimonials plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityImran Emu TC Testimonials
- CVE-2025-49422WordPress Support Ticket Plugin <= 1.9 - Privilege Escalation Vulnerabilitythemepassion Support Ticket
- CVE-2025-49434WordPress Cars4Rent Theme <= 1.4.2 - PHP Object Injection Vulnerabilityaxiomthemes Cars4Rent
- CVE-2025-49890WordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection VulnerabilityThemeREX Organic Beauty
- CVE-2025-48148WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload VulnerabilityStoreKeeper B.V. StoreKeeper for WooCommerce
- CVE-2025-48169WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) VulnerabilityJordy Meow Code Engine
- CVE-2025-53213WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload VulnerabilityELEXtensions ReachShip WooCommerce Multi-Carrier & Conditio…
- CVE-2025-53299WordPress ThemeMakers Visual Content Composer Plugin <= 1.5.8 - PHP Object Injection VulnerabilityThemeMakers Visual Content Composer
- CVE-2025-53577WordPress Global DNS Plugin <= 3.1.0 - Remote Code Execution (RCE) Vulnerabilitythehp Global DNS
- CVE-2025-53580WordPress Simple Business Directory Pro Plugin < 15.6.9 - Privilege Escalation Vulnerabilityquantumcloud Simple Business Directory Pro
- CVE-2025-54014WordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection VulnerabilityQuanticaLabs MediCenter - Health Medical Clinic
- CVE-2025-54048WordPress Custom API for WP <= 4.2.2 - SQL Injection VulnerabilityminiOrange Custom API for WP
- CVE-2025-54049WordPress Custom API for WP <= 4.2.2 - Privilege Escalation VulnerabilityminiOrange Custom API for WP
- CVE-2025-54677WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload VulnerabilityOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2025-54713WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerabilitymagepeopleteam Taxi Booking Manager for WooCommerce
- CVE-2025-54726WordPress JS Archive List Plugin < 6.1.6 - SQL Injection VulnerabilityMiguel Useche JS Archive List
- CVE-2024-12223Stored Cross-site Scripting (XSS) in Nutanix Prism CentralNutanix Prism Central
- CVE-2024-50640jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function
- CVE-2024-57154Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/
- CVE-2024-57155Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token.
- CVE-2024-57157Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token.
- CVE-2025-50901JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbit
- CVE-2025-50904There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11).
- CVE-2025-55444A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0.
High 138
- CVE-2025-9253Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_doSpecifySiteSurvey stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9252Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DisablePasswordAlertRedirect stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9251Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 sta_wps_pin stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9250Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setPWDbyBBS stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9249Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9248Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP_pingGatewayByBBS stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9247Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setVlan stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-54988Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFAApache Software Foundation Apache Tika PDF parser module… +1
- CVE-2025-9246Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 check_port_conflict stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9245Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 WPSSTAPINEnr stack-based overflowLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-5115MadeYouReset HTTP/2 vulnerabilityEclipse Jetty · org.eclipse.jetty.http2:http2-common +1
- CVE-2025-8309User privilege escalation vulnerabilityManageEngine Asset Explorer · ManageEngine ServiceDesk P… +1
- CVE-2025-6183Configd InjectionStrongDM sdm-cli
- CVE-2025-6182Root Certificate InjectionStrongDM sdm
- CVE-2025-6181The StrongDM Windows service incorrectly handled input validation.StrongDM sdm-cli
- CVE-2025-6180Authentication HijackStrongDM sdm-cli
- CVE-2010-20010Foxit PDF Reader < 4.2.0.0928 Title Stack Buffer OverflowFoxit Software Foxit PDF Reader
- CVE-2025-8612AOMEI Backupper Workstation Link Following Local Privilege Escalation VulnerabilityAOMEI Backupper Workstation
- CVE-2010-20042Xion Audio Player ≤ 1.0.126 Unicode Stack Buffer OverflowXion Audio Player
- CVE-2011-10025Subtitle Processor 7.7.1 .m3u SEH Unicode Buffer OverflowSubtitle Processor
- CVE-2011-10022SPlayer 3.7 Content-Type Header Buffer OverflowSPlayer Project SPlayer
- CVE-2011-10029Solar FTP Server <= 2.1.1 Malformed USER Denial of ServiceFlexbyte Software Solar FTP Server
- CVE-2012-10061Sockso Music Host Server <= 1.5 Path TraversalSockso Project Music Host Server
- CVE-2011-10028RealNetworks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code ExecutionRealNetworks RealArcade ActiveX
- CVE-2010-10014Odin Secure FTP <= 4.1 Stack Buffer Overflow via LIST ResponseOdin Software Odin Secure FTP
- CVE-2011-10023MJM QuickPlayer <= 2010 .s3m Stack-Based Buffer OverflowMJM Software QuickPlayer
- CVE-2011-10024MJM Core Player 2011 .s3m File Stack-Based Buffer OverflowMJM Software Core Player
- CVE-2011-10021Magix Musik Maker <= v16 .mmm Stack-Based Buffer OverflowMAGIX Software Magix Musik Maker
- CVE-2011-10020Kaillera 0.86 Server DoS via Malformed UDP PacketKaillera Project Server
- CVE-2011-10030Foxit PDF Reader < 4.3.1.0218 JavaScript File WriteFoxit Software Foxit PDF Reader
- CVE-2010-20045FileWrangler <= 5.30 Stack Buffer OverflowCursorArts FileWrangler
- CVE-2009-10005ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencodeContentKeeper Technologies Web Appliance
- CVE-2011-10027AOL Desktop 9.6 RTX Stack-Based Buffer OverflowAOL Desktop
- CVE-2025-55732Frappe has the possibility of SQL Injection due to improper validationsfrappe
- CVE-2025-43748Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Liferay Portal · Liferay DXP +1
- CVE-2025-54926CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code exeSchneider Electric EcoStruxure™ Power Monitoring Expert · S…
- CVE-2025-54925CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker conSchneider Electric EcoStruxure™ Power Monitoring Expert · S…
- CVE-2025-54924CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker senSchneider Electric EcoStruxure™ Power Monitoring Expert · S…
- CVE-2025-54923CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity whSchneider Electric EcoStruxure™ Power Monitoring Expert · S…
- CVE-2025-31355A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110.Tenda AC6
- CVE-2025-24322An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110.Tenda AC6
- CVE-2025-24496An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110.Tenda AC6
- CVE-2025-30256A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110.Tenda AC6
- CVE-2025-32010A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110.Tenda AC6
- CVE-2025-8453CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privilSchneider Electric Saitel DR RTU · Schneider Electric Saite…
- CVE-2025-57732In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownershipJetBrains TeamCity
- CVE-2025-57731In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram contentJetBrains YouTrack
- CVE-2025-5261IDOR in PozitifIK's Pik OnlinePik Online Yazılım Çözümleri A.Ş. Pik Online
- CVE-2025-5260SSRF in PozitifIK's Pik OnlinePik Online Yazılım Çözümleri A.Ş. Pik Online
- CVE-2025-49382WordPress JobZilla - Job Board WordPress Theme Theme <= 2.0 - Cross Site Request Forgery (CSRF) VulnerabilityDexignZone JobZilla - Job Board WordPress Theme
- CVE-2025-49399WordPress NEX-Forms Plugin <= 9.1.3 - Cross Site Request Forgery (CSRF) VulnerabilityBasix NEX-Forms
- CVE-2025-49406WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerabilityfavethemes Houzez
- CVE-2025-28977WordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityThimPress WP Pipes
- CVE-2025-30975WordPress Add Custom Codes <= 4.80 - Arbitrary Code Execution vulnerabilitySaifuMak Add Custom Codes
- CVE-2025-49411WordPress iFrame Block plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerabilityVikas Sharma iFrame Block
- CVE-2025-49413WordPress Super Store Finder Plugin <= 7.6 - Reflected Cross Site Scripting (XSS) Vulnerabilityhighwarden Super Store Finder
- CVE-2025-49420WordPress Ultra Portfolio - WordPress Plugin <= 6.7 - Cross Site Scripting (XSS) Vulnerabilitythemepassion Ultra Portfolio
- CVE-2025-49424WordPress Support Ticket Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerabilitythemepassion Support Ticket
- CVE-2025-49426WordPress Kitring Theme <= 2.8 - Local File Inclusion VulnerabilityDahz Kitring
- CVE-2025-49428WordPress Cookie Warning plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityDourou Cookie Warning
- CVE-2025-49436WordPress Anotte theme <= 1.8 - Local File Inclusion vulnerabilityCocoBasic Anotte
- CVE-2025-49438WordPress Simple Login Log plugin <= 1.1.3 - PHP Object Injection vulnerabilityMax Chirkov Simple Login Log
- CVE-2025-49889WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerabilityEdge-Themes Edge CPT
- CVE-2025-49891WordPress Uxper Booking Plugin <= 1.3.3 - SQL Injection VulnerabilityUxper Booking
- CVE-2025-49892WordPress Uxper Booking Plugin <= 1.3.3 - Local File Inclusion VulnerabilityUxper Booking
- CVE-2025-49893WordPress Nuss Theme <= 1.3.3 - Cross Site Scripting (XSS) Vulnerabilityuxper Nuss
- CVE-2025-49894WordPress Nuss Theme <= 1.3.3 - Local File Inclusion Vulnerabilityuxper Nuss
- CVE-2025-48142WordPress Bookify <= 1.0.9 - Privilege Escalation VulnerabilitySaad Iqbal Bookify
- CVE-2025-48149WordPress Cook&Meal <= 1.2.3 - Local File Inclusion Vulnerabilitydedalx Cook&Meal
- CVE-2025-48151WordPress CM Map Locations <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilityCreativeMindsSolutions CM Map Locations
- CVE-2025-48152WordPress Rentsyst Plugin <= 2.0.100 - Cross Site Scripting (XSS) Vulnerabilitydimafreund Rentsyst
- CVE-2025-48154WordPress Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin <= 2.1 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Multimedia Playlist Slider Addon for WPBakery…
- CVE-2025-48157WordPress Formality <= 1.5.9 - Local File Inclusion VulnerabilityMichele Giorgi Formality
- CVE-2025-48158WordPress BuddyPress XProfile Custom Image Field Plugin <= 3.0.1 - Arbitrary File Deletion VulnerabilityAlex Githatu BuddyPress XProfile Custom Image Field
- CVE-2025-48159WordPress Youtube Vimeo Video Player and Slider WP Plugin <= 3.8 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Youtube Vimeo Video Player and Slider WP Plugin
- CVE-2025-48160WordPress Caliris <= 1.5 - Local File Inclusion VulnerabilityCocoBasic Caliris
- CVE-2025-48162WordPress Simple Business Directory Pro <= 15.5.1 - Cross Site Scripting (XSS) Vulnerabilityquantumcloud Simple Business Directory Pro
- CVE-2025-48163WordPress SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Cross Site Scripting (XSS) VulnerabilityLambertGroup SHOUT - HTML5 Radio Player With Ads - ShoutCas…
- CVE-2025-48164WordPress SureDash <= 1.0.3 - Privilege Escalation VulnerabilityBrainstorm Force SureDash
- CVE-2025-48165WordPress DELUCKS SEO Plugin <= 2.6.0 - Privilege Escalation VulnerabilityDELUCKS SEO
- CVE-2025-48168WordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Apollo - Sticky Full Width HTML5 Audio Player
- CVE-2025-48170WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Universal Video Player - Addon for WPBakery Pa…
- CVE-2025-48171WordPress Cena Store <= 2.11.26 - Local File Inclusion Vulnerabilitythembay Cena Store
- CVE-2025-48296WordPress UpStore <= 1.7.0 - Cross Site Scripting (XSS) Vulnerabilityskygroup UpStore
- CVE-2025-48297WordPress Simple Link Directory < 14.8.1 - Cross Site Scripting (XSS) Vulnerabilityquantumcloud Simple Link Directory
- CVE-2025-48298WordPress SEOPress for MainWP <= 1.4 - Local File Inclusion VulnerabilityBenjamin Denis SEOPress for MainWP
- CVE-2025-48302WordPress FundEngine Plugin <= 1.7.4 - Local File Inclusion VulnerabilityRoxnor FundEngine
- CVE-2025-53194WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) VulnerabilityCrocoblock JetEngine
- CVE-2025-53198WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerabilityfavethemes Houzez
- CVE-2025-53201WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerabilityNooTheme Jobmonster
- CVE-2025-53204WordPress eventlist plugin <= 1.9.2 - Local File Inclusion Vulnerabilityovatheme eventlist
- CVE-2025-53205WordPress Radio Player Shoutcast & Icecast <= 4.4.7 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Radio Player Shoutcast & Icecast
- CVE-2025-53207WordPress WP Travel Gutenberg Blocks plugin <= 3.9.0 - Local File Inclusion VulnerabilityWP Travel Gutenberg Blocks
- CVE-2025-53208WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerabilitypaymayapg Maya Business
- CVE-2025-53210WordPress ZoloBlocks Plugin <= 2.3.2 - Local File Inclusion Vulnerabilitybdthemes ZoloBlocks
- CVE-2025-53212WordPress Revolution Video Player With Bottom Playlist <= 2.9.2 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Revolution Video Player With Bottom Playlist
- CVE-2025-53226WordPress Comments Capcha Box Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerabilitydigitalzoomstudio Comments Capcha Box
- CVE-2025-53319WordPress Raptive Ads Plugin <= 3.8.0 - Cross Site Scripting (XSS) VulnerabilityRaptive Ads
- CVE-2025-53559WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Universal Video Player - Addon for WPBakery Pa…
- CVE-2025-53560WordPress Noisa theme <= 2.6.0 - PHP Object Injection Vulnerabilityrascals Noisa
- CVE-2025-53562WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Universal Video Player - Addon for WPBakery Pa…
- CVE-2025-53563WordPress Youtube Vimeo Video Player and Slider <= 3.8 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Youtube Vimeo Video Player and Slider
- CVE-2025-53564WordPress HTML5 Radio Player - WPBakery Page Builder Addon <= 2.5 - Cross Site Scripting (XSS) VulnerabilityLambertGroup HTML5 Radio Player - WPBakery Page Builder Add…
- CVE-2025-53565WordPress Widget for Google Reviews <= 1.0.15 - Local File Inclusion VulnerabilityRadiusTheme Widget for Google Reviews
- CVE-2025-53567WordPress Ghost Kit <= 3.4.1 - Local File Inclusion VulnerabilitynK Ghost Kit
- CVE-2025-54007WordPress Post Grid and Gutenberg Blocks Plugin <= 2.3.11 - PHP Object Injection VulnerabilityPickPlugins Post Grid and Gutenberg Blocks
- CVE-2025-54012WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerabilityinfo@welcart Welcart e-Commerce
- CVE-2025-54017WordPress Paid Member Subscriptions <= 2.15.4 - Local File Inclusion VulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2025-54021WordPress Simple File List plugin <= 6.1.14 - Arbitrary File Download vulnerabilityMitchell Bennis Simple File List
- CVE-2025-54027WordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) VulnerabilitySchiocco Support Board
- CVE-2025-54028WordPress CF7 WOW Styler Plugin <= 1.7.2 - Local File Inclusion VulnerabilitySaleswonder Team: Tobias CF7 WOW Styler
- CVE-2025-54031WordPress Support Board <= 3.8.0 - Local File Inclusion VulnerabilitySchiocco Support Board
- CVE-2025-54032WordPress Real Estate Manager Pro Plugin <= 12.7.3 - Cross Site Scripting (XSS) VulnerabilityWebCodingPlace Real Estate Manager Pro
- CVE-2025-54034WordPress Newsletters plugin <= 4.10 - Local File Inclusion vulnerabilityTribulant Software Newsletters
- CVE-2025-54044WordPress Elite Video Player <= 10.0.5 - Cross Site Scripting (XSS) Vulnerability_CreativeMedia_ Elite Video Player
- CVE-2025-54052WordPress Realtyna Organic IDX plugin <= 5.0.0 - Local File Inclusion VulnerabilityRealtyna Organic IDX plugin
- CVE-2025-54055WordPress Druco <= 1.5.2 - Cross Site Scripting (XSS) Vulnerabilityskygroup Druco
- CVE-2025-54056WordPress Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Cross Site Scripting (XSS) VulnerabilityLambertGroup Responsive HTML5 Audio Player PRO With Playlist
- CVE-2025-54670WordPress oik Plugin <= 4.15.2 - Cross Site Scripting (XSS) Vulnerabilitybobbingwide oik
- CVE-2025-54735WordPress CubeWP Framework Plugin <= 1.1.24 - Privilege Escalation VulnerabilityImran Tauqeer CubeWP
- CVE-2025-54750WordPress Funnel Builder by FunnelKit Plugin <= 3.11.1 - Local File Inclusion VulnerabilityAman Funnel Builder by FunnelKit
- CVE-2025-55715WordPress Otter - Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure VulnerabilityThemeisle Otter - Gutenberg Block
- CVE-2025-57790Path Traversal VulnerabilityCommvault CommCell
- CVE-2025-8141Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletionthemeisle Redirection for Contact Form
- CVE-2025-8289Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserializationthemeisle Redirection for Contact Form
- CVE-2025-8145Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injectionthemeisle Redirection for Contact Form
- CVE-2025-9132Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2024-53495Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authent
- CVE-2024-57152Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication
- CVE-2024-57491Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API w
- CVE-2025-28041Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentic
- CVE-2025-50503A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password me
- CVE-2025-50902Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat_applet__open_source) thru 1.0.0 allows attack
- CVE-2025-51991XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the
- CVE-2025-55482Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the formSetCfm function.
- CVE-2025-55483Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and devic
- CVE-2025-55498Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.
- CVE-2025-55503Tenda AC6 V15.03.06.23_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function.
Medium, low and unrated 96
- CVE-2025-9264Xuxueli xxl-job Jobs JobInfoController.java remove resource injectionXuxueli xxl-job · com.xuxueli:xxl-job-admin
- CVE-2025-9263Xuxueli xxl-job JobLogController.java getJobsByGroup resource injectionXuxueli xxl-job · com.xuxueli:xxl-job-admin
- CVE-2025-9262wong2 mcp-cli oAuth provider.js redirectToAuthorization os command injectionwong2 mcp-cli · @wong2/mcp-cli
- CVE-2025-57749n8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted filesn8n-io n8n · n8n
- CVE-2025-9244Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaticRoute os command injectionLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9241elunez eladmin exportUser csv injectionelunez eladmin
- CVE-2025-43757A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QLiferay Portal · Liferay DXP +1
- CVE-2025-43746A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QLiferay Portal · Liferay DXP +2
- CVE-2025-9240elunez eladmin info information disclosureelunez eladmin
- CVE-2025-9239elunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryptionelunez eladmin
- CVE-2025-9238Swatadru Exam-Seating-Arrangement Student Login student.php sql injectionSwatadru Exam-Seating-Arrangement
- CVE-2025-9237CodeAstro Ecommerce Website Edit Your Account my_account.php cross site scriptingCodeAstro Ecommerce Website
- CVE-2025-9236Portabilis i-Educar Tipos de usuàrio educar_tipo_usuario_lst.php sql injectionPortabilis i-Educar
- CVE-2025-47054Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-46849Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-46852Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-9235Scada-LTS compound_events.shtm cross site scriptingScada-LTS
- CVE-2025-9234Scada-LTS maintenance_events.shtm cross site scriptingScada-LTS
- CVE-2025-46856Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-46932Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-46936Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-46962Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-46998Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-20345Cisco Duo Authentication Proxy Information Disclosure VulnerabilityCisco Duo Authentication Proxy
- CVE-2025-20269Cisco Evolved Programmable Network Manager and Prime Infrastructure Arbitrary File Download VulnerabilityCisco Evolved Programmable Network Manager · Cisco Prime In…
- CVE-2025-20131Cisco Identity Services Engine Arbitrary File Upload VulnerabilityCisco Identity Services Engine Software
- CVE-2025-8415Cryostat: authentication bypass if network policies are disabledCryostat · Red Hat Cryostat 4 on RHEL +1
- CVE-2025-9233Scada-LTS view_edit.shtm cross site scriptingScada-LTS
- CVE-2025-55751OnboardLite Open Redirect EndpointHackUCF OnboardLite
- CVE-2025-55731Frappe has the possibility of Authenticated SQL Injection due to improper validationsfrappe
- CVE-2025-1142IBM Edge Application Manager server-side request forgeryIBM Edge Application Manager
- CVE-2025-1139IBM Edge Application Manager incorrect permissionsIBM Edge Application Manager
- CVE-2025-36114IBM QRadar SOAR Plugin App path traversalIBM QRadar SOAR Plugin App
- CVE-2025-8448CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive cSchneider Eelctric EcoStruxure Building Operation Enterp… +1
- CVE-2025-8449CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specSchnieder Electric EcoStruxure Building Operation Enterp… +1
- CVE-2025-54927CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized acSchneider Electric EcoStruxure™ Power Monitoring Expert · S…
- CVE-2025-54175Reflected Cross-Site Scripting in QuickCMS.EXTOpenSolution Quick.CMS.EXT
- CVE-2025-54174Cross-Site Request Forgery in QuickCMSOpenSolution Quick.CMS
- CVE-2025-54172Stored Cross-Site Scripting in QuickCMSOpenSolution Quick.CMS
- CVE-2025-43749Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Liferay Portal · Liferay DXP +1
- CVE-2025-4877Libssh: write beyond bounds in binary to base64 conversion functionslibssh · Red Hat Enterprise Linux +1
- CVE-2025-4437Cri-o: large /etc/passwd file may lead to denial of serviceRed Hat OpenShift Container Platform · github.com/cri-o/cri…
- CVE-2025-43750Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Liferay Portal · Liferay DXP +1
- CVE-2025-43741A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QLiferay Portal · Liferay DXP +1
- CVE-2025-7777Mirror-registry: host header injection in mirror-registrymirror registry for Red Hat OpenShift
- CVE-2025-43742A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QLiferay Portal · Liferay DXP +1
- CVE-2025-8102Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functionssmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2025-57734In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script filesJetBrains TeamCity
- CVE-2025-57733In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email contentJetBrains TeamCity
- CVE-2025-57730In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development featureJetBrains IntelliJ IDEA
- CVE-2025-57729In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server startJetBrains IntelliJ IDEA
- CVE-2025-57728In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden filesJetBrains IntelliJ IDEA
- CVE-2025-57727In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote referenceJetBrains IntelliJ IDEA
- CVE-2024-39954Apache EventMesh Runtime: SSRFApache Software Foundation Apache EventMesh Runtime · org.a…
- CVE-2025-9229Information Disclosure in MiR robots and MiR fleet through verbose error pagesMobile Industrial Robots MiR Robots · Mobile Industrial Rob…
- CVE-2025-9228Insufficient authorization when creating notesMobile Industrial Robots MiR Robots · Mobile Industrial Rob…
- CVE-2025-49389WordPress Notice Bar Plugin <= 3.1.3 - Cross Site Scripting (XSS) VulnerabilityWEN Solutions Notice Bar
- CVE-2025-49391WordPress Sign-up Sheets Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) VulnerabilityFetch Designs Sign-up Sheets
- CVE-2025-49392WordPress Themify Audio Dock Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerabilitythemifyme Themify Audio Dock
- CVE-2025-49395WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerabilitythemifyme Themify Icons
- CVE-2025-49396WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerabilitythemifyme Themify Builder
- CVE-2025-49397WordPress Colorbox Lightbox Plugin <= 1.1.5 - Cross Site Scripting (XSS) VulnerabilityNoor Alam Colorbox Lightbox
- CVE-2025-47650WordPress Infility Global <= 2.15.06 - Arbitrary File Download vulnerabilityInfility Global
- CVE-2025-49412WordPress Page Transition plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitynumixtech Page Transition
- CVE-2025-49896WordPress WP Discord Post Plus – Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerabilitywptasker WP Discord Post Plus – Supports Unlimited Channels
- CVE-2025-53195WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetEngine
- CVE-2025-53196WordPress JetEngine <= 3.7.0 - Sensitive Data Exposure VulnerabilityCrocoblock JetEngine
- CVE-2025-53561WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal VulnerabilityminiOrange Prevent files / folders access
- CVE-2025-53983WordPress JetElements For Elementor <= 2.7.7 - Sensitive Data Exposure VulnerabilityCrocoblock JetElements For Elementor
- CVE-2025-53985WordPress JetTabs <= 2.2.9 - Sensitive Data Exposure VulnerabilityCrocoblock JetTabs
- CVE-2025-53987WordPress JetMenu <= 2.4.11.1 - Sensitive Data Exposure VulnerabilityCrocoblock JetMenu
- CVE-2025-53988WordPress JetBlocks For Elementor <= 1.3.18 - Sensitive Data Exposure VulnerabilityCrocoblock JetBlocks For Elementor
- CVE-2025-53992WordPress JetTricks <= 1.5.4.1 - Sensitive Data Exposure VulnerabilityCrocoblock JetTricks
- CVE-2025-53993WordPress JetPopup plugin <= 2.0.15 - Sensitive Data Exposure vulnerabilityCrocoblock JetPopup
- CVE-2025-53998WordPress JetWooBuilder <= 2.1.20 - Sensitive Data Exposure VulnerabilityCrocoblock JetWooBuilder
- CVE-2025-54008WordPress JetSmartFilters <= 3.6.7 - Sensitive Data Exposure VulnerabilityCrocoblock JetSmartFilters
- CVE-2025-54019WordPress Alone < 7.8.5 - Arbitrary Code Execution VulnerabilityBeplusthemes Alone
- CVE-2025-54025WordPress Coupon Affiliates Plugin <= 6.4.0 - Settings Change VulnerabilityElliot Sowersby / RelyWP Coupon Affiliates
- CVE-2025-54040WordPress Webba Booking <= 5.1.20 - Broken Access Control VulnerabilityWebba Appointment Booking Webba Booking
- CVE-2025-54046WordPress Cost Calculator Plugin <= 7.4 - Cross Site Scripting (XSS) VulnerabilityQuanticaLabs Cost Calculator
- CVE-2025-54053WordPress Groundhogg plugin <= 4.2.2 - PHP Object Injection vulnerabilityAdrian Tobey Groundhogg
- CVE-2025-9225Cross-site scripting (XSS) in MiR robots and MiR fleetMobile Industrial Robots MiR Robots · Mobile Industrial Rob…
- CVE-2025-9202ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installationthemegrill ColorMag
- CVE-2025-54551Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter.FUJIFILM Healthcare Americas Synapse Mobility
- CVE-2025-8618WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcodewpclever WPC Smart Quick View for WooCommerce
- CVE-2025-55706URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type.Six Apart Movable Type
- CVE-2025-53522Movable Type contains an issue with use of less trusted source.Six Apart Movable Type
- CVE-2025-57791Argument Injection Vulnerability in CommServeCommvault CommCell
- CVE-2025-57789Vulnerability in Initial Administrator Login ProcessCommvault CommCell
- CVE-2025-9193TOTVS Portal Meu RH Password Reset redirectTOTVS Portal Meu RH
- CVE-2025-50864An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restriction@elysiajs/cors
- CVE-2025-51990XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, spec
- CVE-2025-54363Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module.Microsoft Knack
- CVE-2025-54364Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module.Microsoft Knack
- CVE-2025-55499Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function.
- CVE-2025-57788Unauthorized API Access RiskCommvault CommCell