CVEs published August 28, 2025
192 CVEs were published on August 28, 2025: 16 critical, 66 high. 1 is now in CISA KEV.
- Published
- 192
- Critical
- 16
- High
- 66
- Medium
- 105
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 32
Most affected products
- DOS Co. SS1
- 8
- Comfast CF-N1
- 6
- OpenSolution QuickCMS
- 6
- contao · contao/core-bundle +1
- 4
- HCL Software BigFix Service Management
- 3
- itsourcecode Apartment Management System
- 3
- Acronis Cyber Protect Cloud Agent
- 2
- asterisk
- 2
- LB-LINK BL-X26
- 2
- plugincy Dynamic AJAX Product Filters for WooCommerce
- 2
Critical 16
- CVE-2025-58059Valtimo scripting engine can be used to gain access to sensitive data or resourcesvaltimo-platform valtimo-backend-libraries · com.ritense.va…
- CVE-2025-58048Paymenter Vulnerable to Remote Code Execution via Public File UploadsPaymenter · paymenter/paymenter
- CVE-2025-57819FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCEFreePBX endpoint
- CVE-2025-54738WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication VulnerabilityNooTheme Jobmonster
- CVE-2025-54725WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerabilityuxper Golo
- CVE-2025-54720WordPress Nest Addons Plugin <= 1.6.3 - SQL Injection VulnerabilitySteelThemes Nest Addons
- CVE-2025-52761WordPress WP Funnel Manager Plugin <= 1.4.0 - PHP Object Injection Vulnerabilitymanfcarlo WP Funnel Manager
- CVE-2025-49388WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerabilitykamleshyadav Miraculous Core Plugin
- CVE-2025-49387WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerabilityadd-ons.org Drag and Drop File Upload for Elementor Forms
- CVE-2025-48100WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerabilityextremeidea bidorbuy Store Integrator
- CVE-2025-39496WordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerabilityWBW WooBeWoo Product Filter Pro
- CVE-2024-58240tls: separate no-async decryption request handling from asyncLinux
- CVE-2025-54762SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and exeDOS Co. SS1
- CVE-2025-53970SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and exeDOS Co. SS1
- CVE-2025-7955RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Functionpbmacintyre RingCentral Communications Plugin – FREE
- CVE-2025-55583D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi
High 66
- CVE-2025-58062LSTM-Kirigaya's openmcp-client Vulnerable to RCE in MCP Authorization FlowLSTM-Kirigaya openmcp-client
- CVE-2025-6203Vault unauthenticated denial of service through complex json payloadHashiCorp Vault · github.com/hashicorp/vault
- CVE-2025-58047Volto affected by possible DoS by invoking specific URL by anonymous userplone volto · @plone/volto
- CVE-2025-58334In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for tJetBrains IDE Services
- CVE-2024-13986Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCENagios XI
- CVE-2025-57767Asterisk can crash from a specifically malformed Authorization header in an incoming SIP requestasterisk
- CVE-2025-8067Udisks: out-of-bounds read in udisks daemonstoraged-project udisks · Red Hat Enterprise Linux
- CVE-2025-9578Local privilege escalation due to insecure folder permissions.Acronis Cyber Protect Cloud Agent
- CVE-2025-54742WordPress WpEvently Plugin <= 4.4.8 - PHP Object Injection Vulnerabilitymagepeopleteam WpEvently
- CVE-2025-54731WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerabilityemarket-design YouTube Showcase
- CVE-2025-54724WordPress Golo Theme <= 1.7.1 - Cross Site Scripting (XSS) Vulnerabilityuxper Golo
- CVE-2025-54716WordPress Ireca Theme <= 1.8.5 - Local File Inclusion Vulnerabilityovatheme Ireca
- CVE-2025-54714WordPress Zephyr Project Manager Plugin <= 3.3.201 - Broken Access Control VulnerabilityDylan James Zephyr Project Manager
- CVE-2025-54710WordPress Tiktok Feed Plugin <= 1.0.21 - Broken Access Control VulnerabilitybPlugins Tiktok Feed
- CVE-2025-54029WordPress WooCommerce csv import export Plugin <= 2.0.6 - Arbitrary File Deletion Vulnerabilityextendons WooCommerce csv import export
- CVE-2025-53588WordPress UPC/EAN/GTIN Code Generator Plugin <= 2.0.2 - Arbitrary File Deletion VulnerabilityDmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generat…
- CVE-2025-53584WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - PHP Object Injection Vulnerabilityemarket-design WP Ticket Customer Service Software & Suppor…
- CVE-2025-53583WordPress Employee Spotlight Plugin <= 5.1.1 - PHP Object Injection Vulnerabilityemarket-design Employee Spotlight
- CVE-2025-53579WordPress Captcha.eu Plugin < 1.0.61 - Cross Site Scripting (XSS) VulnerabilityCaptcha.eu
- CVE-2025-53578WordPress Kipso Theme <= 1.3.4 - Local File Inclusion Vulnerabilitygavias Kipso
- CVE-2025-53576WordPress Ovatheme Events Plugin <= 1.2.8 - Local File Inclusion VulnerabilityOvatheme Events
- CVE-2025-53572WordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection Vulnerabilityemarket-design WP Easy Contact
- CVE-2025-53334WordPress Jannah Theme < 7.5.1 - Local File Inclusion VulnerabilityTieLabs Jannah
- CVE-2025-53328WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage Plugin <= 19.11.0 - Local File Inclusion VulnerabilityPoll, Survey & Quiz Maker Plugin by Opinion Stage
- CVE-2025-53326WordPress Gutenify Plugin <= 1.5.4 - Local File Inclusion VulnerabilityCodeYatri Gutenify
- CVE-2025-53289WordPress Theme Blvd Widget Areas Plugin <= 1.3.0 - Cross Site Scripting (XSS) VulnerabilityJason Theme Blvd Widget Areas
- CVE-2025-53248WordPress Magazine Theme <= 1.2.2 - Local File Inclusion Vulnerabilityunfoldwp Magazine
- CVE-2025-53247WordPress BlogMarks Theme <= 1.0.8 - Local File Inclusion Vulnerabilitywpinterface BlogMarks
- CVE-2025-53244WordPress Magazine Elite Theme <= 1.2.4 - Local File Inclusion Vulnerabilityunfoldwp Magazine Elite
- CVE-2025-53243WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerabilityemarket-design Employee Directory – Staff Listing & Team Di…
- CVE-2025-53230WordPress Page Manager for Elementor Plugin <= 2.0.5 - Broken Access Control Vulnerabilityhonzat Page Manager for Elementor
- CVE-2025-53227WordPress Magazine Saga Theme <= 1.2.7 - Local File Inclusion Vulnerabilityunfoldwp Magazine Saga
- CVE-2025-53225WordPress e-Boekhouden.nl Plugin <= 1.9.3 - Cross Site Scripting (XSS) Vulnerabilityeboekhouden e-Boekhouden.nl
- CVE-2025-53224WordPress NextGEN Gallery Search Plugin <= 2.12 - Cross Site Scripting (XSS) VulnerabilityKoen Schuit NextGEN Gallery Search
- CVE-2025-53223WordPress Theme Switcher Reloaded Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityundoIT Theme Switcher Reloaded
- CVE-2025-53220WordPress XmasB Quotes Plugin <= 1.6.1 - Cross Site Scripting (XSS) VulnerabilityXmasB Quotes
- CVE-2025-53216WordPress Glamer Theme <= 1.0.2 - Local File Inclusion Vulnerabilitythemeuniver Glamer
- CVE-2025-53215WordPress Yahoo! WebPlayer Plugin <= 2.0.6 - Cross Site Scripting (XSS) Vulnerability8bitkid Yahoo! WebPlayer
- CVE-2025-49407WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerabilityfavethemes Houzez
- CVE-2025-49404WordPress Listeo-Core Plugin < 2.0.7 - SQL Injection Vulnerabilitypurethemes Listeo Core
- CVE-2025-49402WordPress Exertio Framework Plugin <= 1.3.3 - SQL Injection Vulnerabilityscriptsbundle Exertio Framework
- CVE-2025-49383WordPress Neresa Theme <= 1.3 - Local File Inclusion VulnerabilityCocoBasic Neresa
- CVE-2025-48359WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitythaihavnn07 ATT YouTube Widget
- CVE-2025-48353WordPress Clickbank WordPress Plugin (Niche Storefront) plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitydactum Clickbank WordPress Plugin
- CVE-2025-48351WordPress Kento Splash Screen plugin <= 1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityPluginsPoint Kento Splash Screen
- CVE-2025-48343WordPress WPMU Ldap Authentication plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityAaron Axelsen WPMU Ldap Authentication
- CVE-2025-48325WordPress WP Admin Theme plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityshmish111 WP Admin Theme
- CVE-2025-48321WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerabilitydyiosah Ultimate twitter profile widget
- CVE-2025-48320WordPress 百度分享按钮 plugin <= 1.0.6 - CSRF to Stored XSS vulnerabilitycuckoohello 百度分享按钮
- CVE-2025-48311WordPress Invisible Optin plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityOffClicks Invisible Optin
- CVE-2025-48309WordPress BetPress plugin <= 1.0.1 Lite - CSRF to Stored XSS vulnerabilityweb-able BetPress
- CVE-2025-48308WordPress Newsletter subscription optin module plugin <= 1.2.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitynonletter Newsletter subscription optin module
- CVE-2025-48307WordPress SEO For Images plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitykasonzhao SEO For Images
- CVE-2025-48306WordPress Savyour Affiliate Partner plugin <= 2.1.4 - CSRF to Stored XSS vulnerabilitydevelopers savyour Savyour Affiliate Partner
- CVE-2025-48304WordPress Google XML News Sitemap plugin plugin <= 0.02 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityGary Illyes Google XML News Sitemap plugin
- CVE-2025-48109WordPress XM-Backup plugin <= 0.9.1 - CSRF to Stored XSS vulnerabilityXavier Media XM-Backup
- CVE-2025-48963Local privilege escalation due to improper soft link handling.Acronis Cyber Protect Cloud Agent
- CVE-2025-58081Use of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenDOS Co. SS1
- CVE-2025-58072Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:DOS Co. SS1
- CVE-2025-53396Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), whiDOS Co. SS1
- CVE-2025-46409Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier).DOS Co. SS1
- CVE-2025-58322NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrarNAVER MYBOX Explorer
- CVE-2024-13807Xagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up FilesXagio SEO – AI Powered SEO
- CVE-2025-36003IBM Security Verify Governance Identity Manager information disclosureIBM Security Verify Governance Identity Manager
- CVE-2025-7812Video Share VOD – Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injectionvideowhisper Video Share VOD – Turnkey Video Site Builder S…
- CVE-2025-57215Tenda AC10 v4.0 firmware v16.03.10.20 was discovered to contain a stack overflow via the function get_parentControl_list_Info.
Medium, low and unrated 110
- CVE-2025-9596itsourcecode Sports Management System login.php sql injectionitsourcecode Sports Management System
- CVE-2025-9595code-projects Student Information Management System login.php cross site scriptingcode-projects Student Information Management System
- CVE-2025-48979An Improper Input Validation in UISP Application could allow a Command Injection by a malicious actor with High Privileges and local access.Ubiquiti UISP Application
- CVE-2025-9594itsourcecode Apartment Management System complain_info.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9593itsourcecode Apartment Management System unit_status_info.php sql injectionitsourcecode Apartment Management System
- CVE-2025-58061OpenEBS Local PV RawFile persistent volume data is world readableopenebs rawfile-localpv
- CVE-2025-9592itsourcecode Apartment Management System bill_info.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9591ZrLog Theme Configuration Form config cross site scriptingZrLog
- CVE-2025-58058github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archivesulikunitz xz · github.com/ulikunitz/xz
- CVE-2025-9590Weaver E-Mobile Mobile Management Platform cross site scriptingWeaver E-Mobile Mobile Management Platform
- CVE-2025-9589Cudy WR1200EA shadow default passwordCudy WR1200EA
- CVE-2025-9586Comfast CF-N1 webmgnt wireless_device_dissoc command injectionComfast CF-N1
- CVE-2025-9585Comfast CF-N1 webmgnt wifilith_delete_pic_file command injectionComfast CF-N1
- CVE-2025-9584Comfast CF-N1 webmgnt update_interface_png command injectionComfast CF-N1
- CVE-2025-9583Comfast CF-N1 webmgnt ping_config command injectionComfast CF-N1
- CVE-2025-9582Comfast CF-N1 webmgnt ntp_timezone command injectionComfast CF-N1
- CVE-2025-9581Comfast CF-N1 webmgnt multi_pppoe command injectionComfast CF-N1
- CVE-2025-9580LB-LINK BL-X26 HTTP set_blacklist os command injectionLB-LINK BL-X26
- CVE-2025-9579LB-LINK BL-X26 HTTP set_hidessid_cfg os command injectionLB-LINK BL-X26
- CVE-2025-9577TOTOLINK X2000R Administrative shadow.sample default credentialsTOTOLINK X2000R
- CVE-2025-31971AIML Solutions for HCL SX is susceptible to a URL validation vulnerabilityHCL Software AIML Solutions for SX
- CVE-2025-9576seeedstudio ReSpeaker Administrative shadow default credentialsseeedstudio ReSpeaker
- CVE-2025-9575Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 upload.cgi cgiMain os command injectionLinksys RE6250 · Linksys RE6300 +4
- CVE-2025-9195Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of ServiceSolidigm D7-PS1010/D7-PS1030
- CVE-2025-58049XWiki PDF export jobs store sensitive cookies unencrypted in job statusesxwiki-platform · org.xwiki.platform:xwiki-platform-export-p…
- CVE-2025-31979A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix Service Management (SM)HCL Software BigFix Service Management
- CVE-2025-31977A cryptographic weakness has been identified in the HCL BigFix Service Management (SM)HCL Software BigFix Service Management
- CVE-2025-31972HCL BigFix Service Management (SM) is affected by a Sensitive Information Exposure vulnerabilityHCL Software BigFix Service Management
- CVE-2025-58335In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.28JetBrains Junie
- CVE-2025-57759Contao has improper privilege management for page and article fieldscontao · contao/core-bundle +1
- CVE-2025-57758Contao has improper access control in the back end voterscontao · contao/core-bundle +1
- CVE-2025-57757Contao discloses information in the news modulecontao · contao/core-bundle +1
- CVE-2025-57756Contao discloses sensitive information in the front end search indexcontao · contao/core-bundle +1
- CVE-2025-25010Kibana privilege escalation via reporting_user roleElastic Kibana
- CVE-2025-54995Asterisk remotely exploitable leak of RTP UDP ports and internal resourcesasterisk
- CVE-2024-48908lychee-action vulnerable to arbitrary code injection in composite actionlycheeverse lychee-action
- CVE-2024-49790IBM Watson Studio on Cloud Pak for Data cross-site scriptingIBM Watson Studio on Cloud Pak for Data
- CVE-2025-58127Lack of TLS validation in plugin Dell Powerscale on Checkmk ExchangeDell Powerscale
- CVE-2025-58126Lack of TLS validation in plugin VMware vSAN on Checkmk ExchangeVMware vSAN
- CVE-2025-58125Lack of TLS validation in plugin Freebox v6 agent on Checkmk ExchangeFreebox v6 agent
- CVE-2025-58124Lack of TLS validation in plugin check-mk-api on Checkmk Exchangecheck-mk-api
- CVE-2025-58123Lack of TLS validation in plugin BGP Monitoring on Checkmk ExchangeBGP Monitoring
- CVE-2025-54734WordPress B Slider Plugin <= 1.1.30 - Broken Access Control VulnerabilitybPlugins B Slider
- CVE-2025-54733WordPress All Bootstrap Blocks Plugin <= 1.3.28 - Broken Access Control Vulnerabilityall_bootstrap_blocks All Bootstrap Blocks
- CVE-2025-53337WordPress LifePress plugin <= 2.1.3 - Broken Access Control vulnerabilityAshan Perera LifePress
- CVE-2025-53250WordPress Chartbeat Plugin <= 2.0.7 - Server Side Request Forgery (SSRF) VulnerabilityChartbeat
- CVE-2025-49405WordPress Houzez Theme < 4.1.4 - Local File Inclusion VulnerabilityFavethemes Houzez
- CVE-2025-48365WordPress Custom Comment plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerabilityimaprogrammer Custom Comment
- CVE-2025-48364WordPress rajce plugin <= 0.4.2 - Server Side Request Forgery (SSRF) vulnerabilityvEnCa-X rajce
- CVE-2025-48363WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerabilityMetin Saraç Popup for CF7 with Sweet Alert
- CVE-2025-48362WordPress Hesabfa Accounting plugin <= 2.2.5 - Cross Site Request Forgery (CSRF) vulnerabilitySaeed Sattar Beglou Hesabfa Accounting
- CVE-2025-48361WordPress Hesabfa Accounting plugin <= 2.2.5 - Sensitive Data Exposure via Log File vulnerabilitySaeed Sattar Beglou Hesabfa Accounting
- CVE-2025-48360WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityRazvan Stanga Varnish/Nginx Proxy Caching
- CVE-2025-48358WordPress Risk Free Cash On Delivery (COD) – WooCommerce plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityeverythingwp Risk Free Cash On Delivery (COD) – WooCommerce
- CVE-2025-48357WordPress Century ToolKit plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Activation vulnerabilityTheme Century Century ToolKit
- CVE-2025-48356WordPress Kanpress plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityIsra Kanpress
- CVE-2025-48354WordPress Better Post & Filter Widgets for Elementor plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerabilityWP Smart Widgets Better Post & Filter Widgets for Elementor
- CVE-2025-48352WordPress Yandex Site search pinger plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilitysitesearch-yandex Yandex Site search pinger
- CVE-2025-48350WordPress AutoWP plugin <= 2.2.7 - Broken Access Control vulnerabilityBasar Ventures AutoWP
- CVE-2025-48349WordPress Video Gallery – Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityorigincode Video Gallery – Vimeo and YouTube Gallery
- CVE-2025-48348WordPress Site Offline plugin <= 1.5.7 - Broken Access Control vulnerabilitychandrashekharsahu Site Offline
- CVE-2025-48347WordPress bxSlider integration for WordPress plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerabilityVincent Mimoun-Prat bxSlider integration for WordPress
- CVE-2025-48327WordPress WP Mailgun SMTP plugin <= 1.0.7 - Broken Access Control vulnerabilityinkthemes WP Mailgun SMTP
- CVE-2025-48324WordPress tli.tl auto Twitter poster plugin <= 3.4 - Cross Site Scripting (XSS) vulnerabilitykhashabawy tli.tl auto Twitter poster
- CVE-2025-48323WordPress Advance Food Menu plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityMd Abunaser Khan Advance Food Menu
- CVE-2025-48322WordPress Statify Widget plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerabilityFinn Dohrn Statify Widget
- CVE-2025-48319WordPress Mesa Mesa Reservation Widget plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilitygslauraspeck Mesa Mesa Reservation Widget
- CVE-2025-48318WordPress 多说社会化评论框 plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityshen2 多说社会化评论框
- CVE-2025-48316WordPress Responsive Mobile-Friendly Tooltip plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerabilityItayXD Responsive Mobile-Friendly Tooltip
- CVE-2025-48315WordPress WordPress HTML plugin <= 0.51 - Cross Site Scripting (XSS) vulnerabilitystanton119 WordPress HTML
- CVE-2025-48314WordPress Add Code To Head plugin <= 1.17 - Cross Site Scripting (XSS) vulnerabilitysalubrio Add Code To Head
- CVE-2025-48313WordPress Tripadvisor Shortcode plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilitykevin heath Tripadvisor Shortcode
- CVE-2025-48312WordPress WPAvatar plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability文派翻译（WP Chinese Translation） WPAvatar
- CVE-2025-48310WordPress Table Editor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerabilitywptableeditor Table Editor
- CVE-2025-48305WordPress Goal Tracker for Patreon plugin <= 0.4.6 - Cross Site Scripting (XSS) vulnerabilityvikingjs Goal Tracker for Patreon
- CVE-2025-48110WordPress Link View plugin <= 0.8.0 - Cross Site Scripting (XSS) vulnerabilitymibuthu Link View
- CVE-2025-9376Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypasssminozzi Block Bad Bots and Stop Bad Bots Crawlers and Spid…
- CVE-2025-55175Reflected XSS in QuickCMSOpenSolution QuickCMS
- CVE-2025-54544Stored XSS in QuickCMSOpenSolution QuickCMS
- CVE-2025-54543Stored XSS in QuickCMSOpenSolution QuickCMS
- CVE-2025-54542Sending Password in GET RequestOpenSolution QuickCMS
- CVE-2025-54541Cross-Site Request Forgery in QuickCMSOpenSolution QuickCMS
- CVE-2025-54540Reflected XSS in QuickCMSOpenSolution QuickCMS
- CVE-2025-54819Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:DOS Co. SS1
- CVE-2025-52460Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier).DOS Co. SS1
- CVE-2025-6255Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameterplugincy Dynamic AJAX Product Filters for WooCommerce
- CVE-2025-8073Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameterplugincy Dynamic AJAX Product Filters for WooCommerce
- CVE-2025-7956Ajax Search Lite <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handlerwpdreams Ajax Search Lite – Live Search & Filter
- CVE-2025-8977Simple Download Monitor <= 3.9.33 - Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionalitymra13 Simple Download Monitor
- CVE-2025-9345File Manager, Code Editor, and Backup by Managefy <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Downloadsoftdiscover File Manager, Code Editor, and Backup by Manag…
- CVE-2025-9346Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevelop Booking Calendar
- CVE-2024-9648WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File UploadWP ULike Pro
- CVE-2025-8603Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scriptingunitecms Unlimited Elements For Elementor
- CVE-2025-0951LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins DeactivatedLiquidThemes AI Hub - Startup & Technology WordPress The… +1
- CVE-2025-8897Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scriptingbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2025-9344UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scriptingstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2025-9352Pronamic Google Maps <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingPronamic Google Maps
- CVE-2025-29364spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls.
- CVE-2025-51643Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper prot
- CVE-2025-51967A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0.
- CVE-2025-51968A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0.
- CVE-2025-51969A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0.
- CVE-2025-51971A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0.
- CVE-2025-51972A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of
- CVE-2025-52054An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05.
- CVE-2025-56236FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature.FormCMS
- CVE-2025-57217Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7We
- CVE-2025-57218Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function s
- CVE-2025-57219Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate privi
- CVE-2025-57220An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a craf