Critical vulnerability archive — page 259

TrioFox1 vulnerability on this pageMax CVSS 9.1Priority 97KEV 1

CVE-2025-12480 · TrioFox TrioFox

Gladinet Triofox Improper Access Control Vulnerability

KEV · due 3 Dec EPSS 96%public exploit SSVC act CVSS 9.1

Red Hat1 vulnerability on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2025-10230 · Red Hat Red Hat Enterprise Linux 10

Samba: command injection in wins server hook script

EPSS 40%public exploit CVSS 10.0

Sangfor1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-12916 · Sangfor Operation and Maintenance Security Management System

Sangfor Operation and Maintenance Security Management System Frontend portal_login command injection

EPSS 5%public exploit CVSS 9.8

Employee Records System1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2021-4462 · Employee Records System Employee Records System

Employee Records System v1.0 Arbitrary File Upload RCE

EPSS 3%public exploit CVSS 9.8

mitre3 vulnerabilities on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2025-63689 · mitre

Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) a…

EPSS 0.9%public exploit CVSS 10.0

CVE-2025-63690 · mitre

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management m…

EPSS 1%public exploit CVSS 9.1

CVE-2025-63691 · mitre

In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query inte…

EPSS 0.4%public exploit CVSS 9.6

Monsta Limited of New Zealand1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-34299 · Monsta Limited of New Zealand Monsta FTP

Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload

EPSS 73%CVSS 9.8

code-projects5 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-12928 · code-projects Online Job Search Engine

code-projects Online Job Search Engine login.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-12855 · code-projects Responsive Hotel Site

code-projects Responsive Hotel Site newsletterdel.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-12856 · code-projects Responsive Hotel Site

code-projects Responsive Hotel Site reservation.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-12857 · code-projects Responsive Hotel Site

code-projects Responsive Hotel Site roombook.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-12913 · code-projects Responsive Hotel Site

code-projects Responsive Hotel Site roomdel.php sql injection

EPSS 0.4%public exploit CVSS 9.8

projectworlds2 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-12938 · projectworlds Online Admission System

projectworlds Online Admission System process_login.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-12862 · projectworlds Online Notes Sharing Platform

projectworlds Online Notes Sharing Platform userprofile.php unrestricted upload

EPSS 0.4%public exploit CVSS 9.8

rymcu1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-12925 · rymcu forest

rymcu forest UserDicController.java deleteDic authorization

EPSS 0.5%public exploit CVSS 9.8

SourceCodester7 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-12929 · SourceCodester Survey Application System

SourceCodester Survey Application System LoginRegistration.php update_user sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-12853 · SourceCodester Best House Rental Management System

SourceCodester Best House Rental Management System admin_class.php delete_house sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-12932 · SourceCodester Baby Care System

SourceCodester Baby Care System admin.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-12930 · SourceCodester Food Ordering System

SourceCodester Food Ordering System view-ticket.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-12931 · SourceCodester Food Ordering System

SourceCodester Food Ordering System edit-orders.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-12933 · SourceCodester Baby Care System

SourceCodester Baby Care System updatewelcome.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-12939 · SourceCodester Interview Management System

SourceCodester Interview Management System addCandidate.php sql injection

EPSS 0.4%public exploit CVSS 9.8

Campcodes1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-12873 · Campcodes School File Management

Campcodes School File Management update_user.php sql injection

EPSS 0.4%public exploit CVSS 9.8

Zohocorp1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2025-8324 · Zohocorp ManageEngine Analytics Plus

SQL Injection

EPSS 2%CVSS 9.8

charmbracelet1 vulnerability on this pageMax CVSS 9.1Priority 44KEV 0

CVE-2025-64522 · charmbracelet soft-serve

Soft Serve is vulnerable to SSRF through its Webhooks

EPSS 0.4%public exploit CVSS 9.1

Gravity Forms1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-12352 · Gravity Forms Gravity Forms

Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'

EPSS 1%CVSS 9.8

leopardhost1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2025-12539 · leopardhost TNC Toolbox: Web Performance

TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

EPSS 1%CVSS 10.0

strix-bubol51 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2025-12813 · strix-bubol5 Holiday class post calendar

Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'

EPSS 0.9%CVSS 9.8

kddiwebcommunications1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-11170 · kddiwebcommunications WP移行専用プラグイン for CPI

WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload

EPSS 0.8%CVSS 9.8

SAP_SE2 vulnerabilities on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2025-42890 · SAP_SE SQL Anywhere Monitor (Non-Gui)

Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)

EPSS 0.7%CVSS 10.0

CVE-2025-42887 · SAP_SE SAP Solution Manager

Code Injection vulnerability in SAP Solution Manager

EPSS 0.6%CVSS 9.9

GitHub1 vulnerability on this pageMax CVSS 9.6Priority 40KEV 0

CVE-2025-11892 · GitHub Enterprise Server

DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers

EPSS 0.7%CVSS 9.6

milvus-io1 vulnerability on this pageMax CVSS 9.3Priority 40KEV 0

CVE-2025-64513 · milvus-io milvus

Milvus Proxy has Critical Authentication Bypass Vulnerability

EPSS 0.9%CVSS 9.3

CyberTutor1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-12868 · CyberTutor New Site Server

CyberTutor｜New Site Server - Use of Client-Side Authentication

EPSS 0.6%CVSS 9.8

Hundred Plus1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-12866 · Hundred Plus EIP Plus

Hundred Plus｜EIP Plus - Weak Password Recovery Mechanism

EPSS 0.6%CVSS 9.8

Beijing Star-Net Ruijie Network Technology Co., Ltd.1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2020-36870 · Beijing Star-Net Ruijie Network Technology Co., Ltd. RG-EG1000C

Ruijie Gateway EG & NBR Models v11.1(6)B9P1 - 11.9(4)B12P1 RCE

EPSS 0.6%CVSS 9.2

easycommerce1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-11457 · easycommerce EasyCommerce – AI-Powered WordPress Ecommerce Plugin to Sell Digital Products, Subscriptions & Physical Goods

EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation

EPSS 0.4%CVSS 9.8

QNAP Systems Inc.1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-52425 · QNAP Systems Inc. QuMagie

QuMagie

EPSS 0.4%CVSS 9.8

Mozilla5 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

GE Vernova1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2025-3222 · GE Vernova Smallworld

Smallworld SWMFS Improper Authentication

EPSS 0.4%CVSS 9.3

Manager-io1 vulnerability on this pageMax CVSS 10.0Priority 35KEV 0

CVE-2025-64180 · Manager-io Manager

Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)

EPSS 0.3%CVSS 10.0

NEC Corporation1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-11546 · NEC Corporation CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux)

CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X Singl…

EPSS 0.4%CVSS 9.3

Avast1 vulnerability on this pageMax CVSS 9.9Priority 33KEV 0

CVE-2025-13032 · Avast (Free/Premiium/Ultimeat) Antivirus

Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool over…

EPSS 0.2%CVSS 9.9

DIAL1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2025-10870 · DIAL CentrosNet

SQL injection in DIAL's CentrosNet

EPSS 0.3%CVSS 9.3

kovidgoyal1 vulnerability on this pageMax CVSS 9.3Priority 30KEV 0

CVE-2025-64486 · kovidgoyal calibre

calibre is vulnerable to arbitrary code execution when opening FB2 files

EPSS 0.2%CVSS 9.3

The archive.