Critical vulnerability archive — page 245

Tenda2 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-14879 · Tenda WH450

Tenda WH450 HTTP Request onSSIDChange stack-based overflow

EPSS 7%public exploit CVSS 9.8

CVE-2025-14878 · Tenda WH450

Tenda WH450 HTTP Request wirelessRestart stack-based overflow

EPSS 1.0%public exploit CVSS 9.8

TinyWebGallery1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2023-53922 · TinyWebGallery TinyWebGallery

TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload

EPSS 1%public exploit CVSS 9.8

Sitemagic1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2023-53921 · Sitemagic SitemagicCMS

SitemagicCMS 4.4.3 Remote Code Execution via Unrestricted File Upload

EPSS 1.0%public exploit CVSS 9.8

mitre4 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2025-56157 · mitre

Default credentials in Dify thru 1.5.1.

EPSS 0.9%public exploit CVSS 9.8

CVE-2025-63389 · mitre

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3.

EPSS 0.7%CVSS 9.8

CVE-2025-63386 · mitre

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint.

EPSS 0.2%CVSS 9.1

CVE-2025-63388 · mitre

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint.

EPSS 0.2%CVSS 9.1

Ulicms2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2023-53914 · ulicms Ulicms

UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability

EPSS 0.7%public exploit CVSS 9.8

CVE-2023-53923 · Ulicms Ulicms

UliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account Creation

EPSS 0.6%public exploit CVSS 9.8

ChurchCRM6 vulnerabilities on this pageMax CVSS 10.0Priority 47KEV 0

CVE-2025-68110 · ChurchCRM CRM

ChurchCRM discloses database information on error message

EPSS 0.4%public exploit CVSS 10.0

CVE-2025-68112 · ChurchCRM CRM

ChurchCRM has SQL injection in EditEventAttendees.php

EPSS 0.4%public exploit CVSS 9.6

CVE-2025-68400 · ChurchCRM CRM

ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

EPSS 0.4%public exploit CVSS 9.3

CVE-2025-68109 · ChurchCRM CRM

ChurchCRM vulnerable to RCE with database restore functionality

EPSS 2%CVSS 9.1

CVE-2025-67876 · ChurchCRM CRM

ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking

EPSS 0.2%public exploit CVSS 9.3

CVE-2025-68275 · ChurchCRM CRM

ChurchCRM vulnerable to Stored XSS - Group name > Person Listing

EPSS 0.2%public exploit CVSS 9.2

Campcodes1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-14877 · Campcodes Supplier Management System

Campcodes Supplier Management System add_retailer.php sql injection

EPSS 0.4%public exploit CVSS 9.8

code-projects1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-14833 · code-projects Online Appointment Booking System

code-projects Online Appointment Booking System deletemanagerclinic.php sql injection

EPSS 0.4%public exploit CVSS 9.8

itsourcecode1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-14832 · itsourcecode Online Cake Ordering System

itsourcecode Online Cake Ordering System updateproduct.php sql injection

EPSS 0.4%public exploit CVSS 9.8

modelcontextprotocol1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2025-68145 · modelcontextprotocol servers

mcp-server-git has missing path validation when using --repository flag

EPSS 7%CVSS 9.1

WODESYS1 vulnerability on this pageMax CVSS 9.4Priority 45KEV 0

CVE-2025-65008 · WODESYS WD-R608U

OS Command Injection in WODESYS WD-R608U router

EPSS 3%CVSS 9.4

capstone-engine1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-68114 · capstone-engine capstone

Capstone doesn't check vsnprintf return in SStream_concat, allows stack buffer underflow and overflow

EPSS 0.2%public exploit CVSS 9.8

PHPJabbers1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2023-53926 · PHPJabbers Simple CMS

PHPJabbers Simple CMS 5.0 SQL Injection via Column Parameter

EPSS 0.6%CVSS 9.8

AncoraThemes1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-53433 · AncoraThemes EasyEat

WordPress EasyEat theme <= 1.9.0 - Local File Inclusion vulnerability

EPSS 0.5%CVSS 9.8

axiomthemes1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-58935 · axiomthemes Lunna

WordPress Lunna theme <= 1.15 - Local File Inclusion vulnerability

EPSS 0.5%CVSS 9.8

CRM Perks6 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-60089 · CRM Perks WP Gravity Forms FreshDesk Plugin

WordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerability

EPSS 0.5%CVSS 9.8

CVE-2025-60090 · CRM Perks WP Gravity Forms Insightly

WordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerability

EPSS 0.5%CVSS 9.8

CVE-2025-60091 · CRM Perks WP Gravity Forms Zoho CRM and Bigin

WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerability

EPSS 0.5%CVSS 9.8

CVE-2025-60174 · CRM Perks WP Gravity Forms Constant Contact Plugin

WordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerability

EPSS 0.5%CVSS 9.8

CVE-2025-60178 · CRM Perks WP Gravity Forms HubSpot

WordPress WP Gravity Forms HubSpot plugin <= 1.2.6 - Deserialization of untrusted data vulnerability

EPSS 0.5%CVSS 9.8

CVE-2025-60180 · CRM Perks WP Gravity Forms Salesforce

WordPress WP Gravity Forms Salesforce plugin <= 1.5.1 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

TieLabs1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-64206 · TieLabs Jannah

WordPress Jannah theme <= 7.6.0 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.8

AmentoTech1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-64236 · AmentoTech Tuturn

WordPress Tuturn plugin < 3.6 - Broken Authentication vulnerability

EPSS 0.4%CVSS 9.8

BoldThemes2 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-54723 · BoldThemes DentiCare

WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability

EPSS 0.5%CVSS 9.8

CVE-2025-64233 · BoldThemes Codiqa

WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

PenciDesign1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-64188 · PenciDesign Soledad

WordPress Soledad theme <= 8.6.9 - Privilege Escalation vulnerability

EPSS 0.4%CVSS 9.8

BoldGrid1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-64227 · BoldGrid Client Invoicing by Sprout Invoices

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerability

EPSS 0.4%CVSS 9.8

StylemixThemes1 vulnerability on this pageMax CVSS 9.9Priority 36KEV 0

CVE-2025-64374 · StylemixThemes Motors

WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability

EPSS 0.4%CVSS 9.9

Utarit Informatics Services Inc.1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2025-7358 · Utarit Informatics Services Inc. SoliClub

Use of Hard-coded Credentials in Utarit Informatics' SoliClub

EPSS 0.4%CVSS 9.8

Govee1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2025-10910 · Govee H6056

Gaining remote control over Govee devices

EPSS 0.4%CVSS 9.3

RedefiningTheWeb1 vulnerability on this pageMax CVSS 9.9Priority 35KEV 0

CVE-2025-64231 · RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database

WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerability

EPSS 0.3%CVSS 9.9

mmetrodw1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-60062 · mmetrodw tPlayer

WordPress tPlayer plugin <= 1.2.1.6 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

Mozilla1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2025-14860 · Mozilla Firefox

Use-after-free in the Disability Access APIs component

EPSS 0.3%CVSS 9.8

nicotsx1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2025-68435 · nicotsx zerobyte

Zerobyte has Authentication Bypass by Primary Weakness

EPSS 0.4%CVSS 9.1

smartcms1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-58951 · smartcms Advance Seat Reservation Management for WooCommerce

WordPress Advance Seat Reservation Management for WooCommerce plugin <= 3.1 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

jetmonsters1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2025-66078 · jetmonsters Hotel Booking Lite

WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability

EPSS 0.4%CVSS 9.1

homarr-labs1 vulnerability on this pageMax CVSS 9.0Priority 32KEV 0

CVE-2025-67493 · homarr-labs homarr

Homarr: missing input sanitization and possible privilege escalation through ldap search query injection

EPSS 0.3%CVSS 9.0

Cozmoslabs1 vulnerability on this pageMax CVSS 9.0Priority 31KEV 0

CVE-2025-66074 · Cozmoslabs WP Webhooks

WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability

EPSS 0.3%CVSS 9.0

FreeRDP1 vulnerability on this pageMax CVSS 9.1Priority 30KEV 0

CVE-2025-68118 · FreeRDP FreeRDP

Potential Heap Out-of-Bounds Read in freerdp_certificate_data_hash_ via Unsafe _snprintf Usage

EPSS 0.2%CVSS 9.1

Qualcomm, Inc.1 vulnerability on this pageMax CVSS 9.0Priority 27KEV 0

CVE-2025-47372 · Qualcomm, Inc. Snapdragon

Buffer Copy Without Checking Size of Input in Boot

EPSS 0.1%CVSS 9.0

The archive.