Critical vulnerability archive — page 285

FreePBX1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2025-57819 · FreePBX endpoint

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

KEV · due 19 Sep EPSS 95%public exploit SSVC act CVSS 10.0

TOTOLINK1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2025-9533 · TOTOLINK T10

TOTOLINK T10 formLoginAuth.htm improper authentication

EPSS 12%public exploit CVSS 9.8

Comfast2 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-9581 · Comfast CF-N1

Comfast CF-N1 webmgnt multi_pppoe command injection

EPSS 5%public exploit CVSS 9.8

CVE-2025-9582 · Comfast CF-N1

Comfast CF-N1 webmgnt ntp_timezone command injection

EPSS 5%public exploit CVSS 9.8

mitre3 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-55583 · mitre

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.c…

EPSS 7%public exploit CVSS 9.8

CVE-2025-44033 · mitre

SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method decl…

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-46484 · mitre

TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component.

EPSS 1%CVSS 9.8

Hangzhou Shengqiao Technology Co. Ltd.1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-13979 · Hangzhou Shengqiao Technology Co. Ltd. St. Joe ERP System ("圣乔ERP系统")

St. Joe ERP System SingleRowQueryConverter SQL Injection

EPSS 3%public exploit CVSS 9.8

Tenda1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2025-9523 · Tenda AC1206

Tenda AC1206 GetParentControlInfo stack-based overflow

EPSS 1%public exploit CVSS 9.8

Fujian Apex Software Co. Ltd.1 vulnerability on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2024-13981 · Fujian Apex Software Co. Ltd. LiveBOS

LiveBos UploadFile.do Arbitrary File Upload

EPSS 0.9%public exploit CVSS 10.0

Qingdao Dongsheng Weiye Software Co., Ltd.1 vulnerability on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2025-34163 · Qingdao Dongsheng Weiye Software Co., Ltd. Dongsheng Logistics Software

Dongsheng Logistics Software Unauthenticated Arbitrary File Upload

EPSS 0.7%public exploit CVSS 10.0

PCRE2Project1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2025-58050 · PCRE2Project pcre2

PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS

EPSS 0.9%public exploit CVSS 9.1

Zhejiang Dahua Technology Co., Ltd.2 vulnerabilities on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2024-13985 · Zhejiang Dahua Technology Co., Ltd. EIMS

Dahua EIMS capture_handle.action RCE

EPSS 15%CVSS 10.0

CVE-2023-7309 · Zhejiang Dahua Technology Co., Ltd. Smart Park Integrated Management Platform

Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload

EPSS 0.8%CVSS 10.0

itsourcecode8 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-9592 · itsourcecode Apartment Management System

itsourcecode Apartment Management System bill_info.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-9593 · itsourcecode Apartment Management System

itsourcecode Apartment Management System unit_status_info.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-9594 · itsourcecode Apartment Management System

itsourcecode Apartment Management System complain_info.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-9596 · itsourcecode Sports Management System

itsourcecode Sports Management System login.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-9597 · itsourcecode Apartment Management System

itsourcecode Apartment Management System rented_all_info.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-9598 · itsourcecode Apartment Management System

itsourcecode Apartment Management System year_setup.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-9599 · itsourcecode Apartment Management System

itsourcecode Apartment Management System month_setup.php sql injection

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-9600 · itsourcecode Apartment Management System

itsourcecode Apartment Management System member_type_setup.php sql injection

EPSS 0.4%public exploit CVSS 9.8

kamleshyadav1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-49388 · kamleshyadav Miraculous Core Plugin

WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability

EPSS 7%CVSS 9.8

coolLabs Technologies3 vulnerabilities on this pageMax CVSS 9.4Priority 46KEV 0

CVE-2025-34161 · coolLabs Technologies Coolify

Coolify Git Repository Field Command Injection in Project Deployment Workflow

EPSS 3%CVSS 9.4

CVE-2025-34159 · coolLabs Technologies Coolify

Coolify Docker Compose Directive Injection in Application Deployment Workflow

EPSS 1.0%CVSS 9.4

CVE-2025-34157 · coolLabs Technologies Coolify

Coolify Stored Cross-Site Scripting (XSS) in Project Name Field

EPSS 0.5%CVSS 9.4

add-ons.org1 vulnerability on this pageMax CVSS 10.0Priority 45KEV 0

CVE-2025-49387 · add-ons.org Drag and Drop File Upload for Elementor Forms

WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability

EPSS 1%CVSS 10.0

H3C Group1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2024-13980 · H3C Group Intelligent Management Center (iMC)

H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE

EPSS 1.0%CVSS 10.0

Qi'anxin1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2024-13984 · Qi'anxin TianQing Management Center

Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload

EPSS 0.8%CVSS 10.0

Shanghai Aishu Information Technology Co., Ltd.1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2025-34160 · Shanghai Aishu Information Technology Co., Ltd. AnyShare

AnyShare ServiceAgent API Unauthenticated RCE

EPSS 0.8%CVSS 10.0

pbmacintyre1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-7955 · pbmacintyre RingCentral Communications Plugin – FREE

RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function

EPSS 0.7%CVSS 9.8

Arcserve3 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-34522 · Arcserve Unified Data Protection (UDP)

Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

EPSS 0.6%CVSS 9.8

CVE-2025-34523 · Arcserve Unified Data Protection (UDP)

Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

EPSS 0.5%CVSS 9.8

CVE-2025-34520 · Arcserve Unified Data Protection (UDP)

Arcserve UDP < 10.2 Authentication Bypass

EPSS 0.4%CVSS 9.8

CGM3 vulnerabilities on this pageMax CVSS 9.4Priority 39KEV 0

CVE-2025-30057 · CGM CGM CLININET

Authenticated RCE with uhcapache privileges in ConvertToPDF

EPSS 0.7%CVSS 9.4

CVE-2025-30056 · CGM CGM CLININET

Calling system commands via RunCommand

EPSS 0.2%CVSS 9.4

CVE-2025-30063 · CGM CGM CLININET

Excessive permissions on configuration files containing database logins and passwords

EPSS 0.1%CVSS 9.4

DOS Co., Ltd.2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-53970 · DOS Co., Ltd. SS1

SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and…

EPSS 0.5%CVSS 9.8

CVE-2025-54762 · DOS Co., Ltd. SS1

SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and…

EPSS 0.5%CVSS 9.8

Feijiu Medical Technology Co., Ltd.1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2025-34162 · Feijiu Medical Technology Co., Ltd. Bian Que Feijiu Intelligent Emergency and Quality Control System

Bian Que Feijiu Intelligent Emergency and Quality Control System SQL Injection via GetLyfsByParams

EPSS 0.6%CVSS 9.3

Paymenter1 vulnerability on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2025-58048 · Paymenter Paymenter

Paymenter Vulnerable to Remote Code Execution via Public File Uploads

EPSS 0.4%CVSS 10.0

manfcarlo1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-52761 · manfcarlo WP Funnel Manager

WordPress WP Funnel Manager Plugin <= 1.4.0 - PHP Object Injection Vulnerability

EPSS 0.4%CVSS 9.8

NooTheme1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-54738 · NooTheme Jobmonster

WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability

EPSS 0.4%CVSS 9.8

uxper1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-54725 · uxper Golo

WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability

EPSS 0.4%CVSS 9.8

Dell1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-43728 · Dell ThinOS 10

Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability.

EPSS 0.4%CVSS 9.8

Linux1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2024-58240 · Linux Linux

tls: separate no-async decryption request handling from async

EPSS 0.3%CVSS 9.8

extremeidea1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2025-48100 · extremeidea bidorbuy Store Integrator

WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability

EPSS 0.4%CVSS 9.1

valtimo-platform1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2025-58059 · valtimo-platform valtimo-backend-libraries

Valtimo scripting engine can be used to gain access to sensitive data or resources

EPSS 0.4%CVSS 9.1

WBW1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2025-39496 · WBW WooBeWoo Product Filter Pro

WordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

SteelThemes1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2025-54720 · SteelThemes Nest Addons

WordPress Nest Addons Plugin <= 1.6.3 - SQL Injection Vulnerability

EPSS 0.3%CVSS 9.3

The archive.