2025

Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `v

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows auth

WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerabilit

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnera

XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Auth

Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input da

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject she

DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability

VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules

Exporting a TPM based RSA key larger than 2048 bits from the TPM could overrun a stack buffer if the default `MAX_RSA_KE

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contai

ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks.

A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded w

A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware version

An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) runnin

A stack-based buffer overflow vulnerability exists in Synactis PDF In-The-Box ActiveX control (PDF_IN_1.ocx), specifical

An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in th

A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htacce

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

A local privilege escalation vulnerability exists in Agnitum Outpost Internet Security 8.1 that allows an unprivileged u

Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege esc

webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8

A null pointer dereference vulnerability exists in the IOMap64.sys driver of ASUS AI Suite 3. The vulnerability can be t

In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core

The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modi

A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitra

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated

A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vul

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via

An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel (developed by LXCenter) pri

A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router.

Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vul

A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the

A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to

An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The u

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The para

A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCW_BTLINDV1.0.0B04 when parsing

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin.

An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoi

An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the db_restore.php endpoint. The flaw

A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling

A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due

There exists a TOCTOU race condition in TvSettings AppRestrictionsFragment.java that lead to start of attacker supplied

Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3,

The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denia

The Ember ZNet stack’s packet buffer manager may read out of bound memory leading to an assert, causing a Denial of Serv

A Zigbee Radio Co-Processor (RCP), which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host