Critical vulnerability archive — page 294

Fortinet1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2025-25256 · Fortinet FortiSIEM

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in For…

EPSS 65%public exploit CVSS 9.8

Microsoft3 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2025-50165 · Microsoft Windows 11 Version 24H2

Windows Graphics Component Remote Code Execution Vulnerability

EPSS 11%public exploit CVSS 9.8

CVE-2025-53766 · Microsoft Microsoft Office for Android

GDI+ Remote Code Execution Vulnerability

EPSS 8%CVSS 9.8

CVE-2025-50171 · Microsoft Windows 10 Version 21H2

Remote Desktop Spoofing Vulnerability

EPSS 1%CVSS 9.1

CherryHQ3 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-54382 · CherryHQ cherry-studio

Cherry Studio RCE Vulnerability Disclosure

EPSS 8%public exploit CVSS 9.7

CVE-2025-54074 · CherryHQ cherry-studio

Cherry Studio is Vulnerable to OS Command Injection during Connection with a Malicious MCP Server

EPSS 2%public exploit CVSS 9.8

CVE-2025-54063 · CherryHQ cherry-studio

Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling

EPSS 0.8%public exploit CVSS 9.6

LabRedesCefetRJ3 vulnerabilities on this pageMax CVSS 10.0Priority 56KEV 0

CVE-2025-55169 · LabRedesCefetRJ WeGIA

WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'

EPSS 2%public exploit CVSS 10.0

CVE-2025-55167 · LabRedesCefetRJ WeGIA

WeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php`

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-55168 · LabRedesCefetRJ WeGIA

WeGIA SQL Injection via id_fichamedica at endpoint `GET /html/saude/aplicar_medicamento.php`

EPSS 0.5%public exploit CVSS 9.8

Stirling-Tools3 vulnerabilities on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2025-55161 · Stirling-Tools Stirling-PDF

Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf

EPSS 2%public exploit CVSS 9.8

CVE-2025-55150 · Stirling-Tools Stirling-PDF

Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf

EPSS 2%public exploit CVSS 9.8

CVE-2025-55151 · Stirling-Tools Stirling-PDF

Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf

EPSS 0.4%public exploit CVSS 9.8

SAP_SE2 vulnerabilities on this pageMax CVSS 9.9Priority 55KEV 0

CVE-2025-42957 · SAP_SE SAP S/4HANA (Private Cloud or On-Premise)

Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

EPSS 2%public exploit CVSS 9.9

CVE-2025-42950 · SAP_SE SAP Landscape Transformation (Analysis Platform)

Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)

EPSS 0.7%CVSS 9.9

mitre7 vulnerabilities on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2025-52385 · mitre

An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process…

EPSS 1%public exploit CVSS 9.8

CVE-2025-50594 · mitre

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Manageme…

EPSS 0.4%public exploit CVSS 9.8

CVE-2025-50251 · mitre

Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.

EPSS 0.3%public exploit CVSS 9.1

CVE-2025-43986 · mitre

An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices.

EPSS 0.5%CVSS 9.8

CVE-2025-51451 · mitre

In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

EPSS 0.4%CVSS 9.8

CVE-2025-51452 · mitre

In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

EPSS 0.4%CVSS 9.8

CVE-2025-43982 · mitre

Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default.

EPSS 0.4%CVSS 9.8

Hyland Software1 vulnerability on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2025-34153 · Hyland Software OnBase

Hyland OnBase < 17.0.2.87 .NET Remoting TCP Channel Unauthenticated RCE

EPSS 0.7%public exploit CVSS 10.0

kanboard1 vulnerability on this pageMax CVSS 9.1Priority 50KEV 0

CVE-2025-55010 · kanboard kanboard

Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

EPSS 1%public exploit CVSS 9.1

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-6715 · Unknown LatePoint

Latepoint < 5.1.94 - Unauthenticated LFI

EPSS 0.6%public exploit CVSS 9.8

MasaCMS1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-32640 · MasaCMS MasaCMS

MasaCMS SQL Injection vulnerability

EPSS 78%CVSS 9.8

Spreecommerce1 vulnerability on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2011-10019 · Spreecommerce Spreecommerce

Spreecommerce < 0.60.2 Search Parameter RCE

EPSS 6%CVSS 10.0

WinterChenS1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-8838 · WinterChenS my-site

WinterChenS my-site Backend admin preHandle improper authentication

EPSS 0.6%public exploit CVSS 9.8

code-projects3 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-8921 · code-projects Job Diary

code-projects Job Diary user-apply.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-8922 · code-projects Job Diary

code-projects Job Diary admin-inbox.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-8923 · code-projects Job Diary

code-projects Job Diary edit-details.php sql injection

EPSS 0.5%public exploit CVSS 9.8

SourceCodester1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-8926 · SourceCodester COVID 19 Testing Management System

SourceCodester COVID 19 Testing Management System login.php sql injection

EPSS 0.5%public exploit CVSS 9.8

Synergetic Data Systems Inc.1 vulnerability on this pageMax CVSS 9.2Priority 48KEV 0

CVE-2025-34154 · Synergetic Data Systems Inc. UnForm Server Manager

UnForm Server Manager < 10.1.12 Unauthenticated Arbitrary File Read

EPSS 0.7%public exploit CVSS 9.2

itsourcecode1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-8925 · itsourcecode Sports Management System

itsourcecode Sports Management System match.php sql injection

EPSS 0.5%public exploit CVSS 9.8

Shanghai Lingdang Information Technology1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2025-8908 · Shanghai Lingdang Information Technology Lingdang CRM

Shanghai Lingdang Information Technology Lingdang CRM event.php sql injection

EPSS 0.4%public exploit CVSS 9.8

crmperks1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2025-7384 · crmperks Database for Contact Form 7, WPforms, Elementor forms

Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion

EPSS 1%CVSS 9.8

NVIDIA2 vulnerabilities on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-23304 · NVIDIA NVIDIA NeMo Framework

NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injecti…

EPSS 1%CVSS 9.8

CVE-2025-23303 · NVIDIA NVIDIA NeMo Framework

NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote c…

EPSS 0.6%CVSS 9.8

2100 Technology1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-8853 · 2100 Technology Official Document Management System

2100 Technology｜Official Document Management System - Authentication Bypass

EPSS 0.8%CVSS 9.8

INSTAR1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-8760 · INSTAR 2K+

INSTAR 2K+/4K fcgi_server base64_decode buffer overflow

EPSS 0.9%CVSS 9.8

ABB2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-53187 · ABB ASPECT

Unauthenticated RCE

EPSS 0.7%CVSS 9.8

CVE-2025-7679 · ABB Aspect

Session ID Basic Auth Bypass

EPSS 0.5%CVSS 9.2

WellChoose1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-8913 · WellChoose Organization Portal System

WellChoose｜Organization Portal System - Local File Inclusion

EPSS 0.7%CVSS 9.8

Siemens1 vulnerability on this pageMax CVSS 9.4Priority 39KEV 0

CVE-2025-40746 · Siemens SIMATIC RTLS Locating Manager

A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2).

EPSS 0.7%CVSS 9.4

Zoom Communications Inc1 vulnerability on this pageMax CVSS 9.6Priority 39KEV 0

CVE-2025-49457 · Zoom Communications Inc Zoom Clients for Windows

Zoom Clients for Windows - Untrusted Search Path

EPSS 0.7%CVSS 9.6

bplugins1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-8059 · bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection

B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function

EPSS 0.5%CVSS 9.8

Campcodes1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-8924 · Campcodes Online Water Billing System

Campcodes Online Water Billing System viewbill.php sql injection

EPSS 0.5%CVSS 9.8

checkpoint1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-3831 · checkpoint Check Point Harmony SASE

Exposed SFTP server

EPSS 0.4%CVSS 9.8

Amazon1 vulnerability on this pageMax CVSS 9.0Priority 34KEV 0

CVE-2025-8904 · Amazon EMR

Privilege escalation issue in Amazon EMR Secret Agent component

EPSS 0.4%CVSS 9.0

intel1 vulnerability on this pageMax CVSS 9.3Priority 29KEV 0

CVE-2025-24325 · intel

Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authen…

EPSS 0.2%CVSS 9.3

The archive.