Critical vulnerability archive — page 297

nestjs1 vulnerability on this pageMax CVSS 9.4Priority 58KEV 0

CVE-2025-54782 · nestjs nest

@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

EPSS 47%public exploit CVSS 9.4

mitre5 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2025-50460 · mitre

A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py us…

EPSS 3%public exploit CVSS 9.8

CVE-2025-50472 · mitre

The modelscope/ms-swift library thru 2.6.1 is vulnerable to arbitrary code execution through deserialization of untrusted data within the…

EPSS 1%public exploit CVSS 9.8

CVE-2025-52390 · mitre

Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery…

EPSS 0.7%public exploit CVSS 9.1

CVE-2025-45150 · mitre

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supply…

EPSS 0.6%CVSS 9.8

CVE-2025-50870 · mitre

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint.

EPSS 0.4%CVSS 9.8

1Panel-dev1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2025-54424 · 1Panel-dev 1Panel

1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution

EPSS 1%public exploit CVSS 9.8

projectworlds3 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2025-8471 · projectworlds Online Admission System

projectworlds Online Admission System adminlogin.php sql injection

EPSS 0.8%public exploit CVSS 9.8

CVE-2025-8496 · projectworlds Online Admission System

projectworlds Online Admission System viewform.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8436 · projectworlds Online Admission System

projectworlds Online Admission System viewdoc.php sql injection

EPSS 0.5%public exploit CVSS 9.8

Campcodes1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-8378 · Campcodes Online Hotel Reservation System

Campcodes Online Hotel Reservation System Login index.php sql injection

EPSS 0.7%public exploit CVSS 9.8

code-projects17 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-8408 · code-projects Vehicle Management

code-projects Vehicle Management filter1.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8441 · code-projects Online Medicine Guide

code-projects Online Medicine Guide pharsignup.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8442 · code-projects Online Medicine Guide

code-projects Online Medicine Guide cussignup.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8437 · code-projects Kitchen Treasure

code-projects Kitchen Treasure userregistration.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8438 · code-projects Wazifa System

code-projects Wazifa System postpublish.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8439 · code-projects Wazifa System

code-projects Wazifa System updatesettings.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8443 · code-projects Online Medicine Guide

code-projects Online Medicine Guide login.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8467 · code-projects Wazifa System

code-projects Wazifa System regcontrol.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-8468 · code-projects Wazifa System

code-projects Wazifa System reset.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-8493 · code-projects Intern Membership Management System

code-projects Intern Membership Management System edit_student_query.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8494 · code-projects Intern Membership Management System

code-projects Intern Membership Management System delete_student.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8495 · code-projects Intern Membership Management System

code-projects Intern Membership Management System edit_admin_query.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8497 · code-projects Online Medicine Guide

code-projects Online Medicine Guide cusfindphar2.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8498 · code-projects Online Medicine Guide

code-projects Online Medicine Guide index.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8409 · code-projects Vehicle Management

code-projects Vehicle Management filter.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-8466 · code-projects Online Farm System

code-projects Online Farm System forgot_passfarmer.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-8407 · code-projects Vehicle Management

code-projects Vehicle Management filter2.php sql injection

EPSS 0.5%CVSS 9.8

PHPGurukul1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-8431 · PHPGurukul Boat Booking System

PHPGurukul Boat Booking System add-boat.php sql injection

EPSS 0.6%public exploit CVSS 9.8

SourceCodester2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-8469 · SourceCodester Online Hotel Reservation System

SourceCodester Online Hotel Reservation System deletegallery.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-8470 · SourceCodester Online Hotel Reservation System

SourceCodester Online Hotel Reservation System deleteroom.php sql injection

EPSS 0.6%public exploit CVSS 9.8

squid-cache1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-54574 · squid-cache squid

Squid's URN Handling can lead to Buffer Overflow

EPSS 22%CVSS 9.8

aonetheme2 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-5947 · aonetheme Service Finder Bookings

Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie

EPSS 5%CVSS 9.8

CVE-2025-5954 · aonetheme Service Finder SMS System

Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation

EPSS 0.5%CVSS 9.8

AcademySoftwareFoundation1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2025-48072 · AcademySoftwareFoundation openexr

OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap

EPSS 0.6%public exploit CVSS 9.1

traefik1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2025-54386 · traefik traefik

Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution

EPSS 1%CVSS 9.8

Güralp Systems1 vulnerability on this pageMax CVSS 9.3Priority 42KEV 0

CVE-2025-8286 · Güralp Systems Güralp FMUS Series

Güralp Systems FMUS Series and MIN Series Devices

EPSS 1%CVSS 9.3

localsend1 vulnerability on this pageMax CVSS 9.3Priority 42KEV 0

CVE-2025-54792 · localsend localsend

LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception

EPSS 0.3%public exploit CVSS 9.3

Marvell1 vulnerability on this pageMax CVSS 9.4Priority 42KEV 0

CVE-2025-8426 · Marvell QConvergeConsole

Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability

EPSS 1%CVSS 9.4

Brave1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-7710 · Brave Brave Conversion Engine (PRO)

Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator

EPSS 0.7%CVSS 9.8

HashiCorp1 vulnerability on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2025-6000 · HashiCorp Vault

Arbitrary Remote Code Execution via Plugin Catalog Abuse

EPSS 1.0%CVSS 9.1

LimeSurvey1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-41375 · LimeSurvey LimeSurvey

SQL Injection in Limesurvey

EPSS 0.7%CVSS 9.8

Partner Software1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-6077 · Partner Software Partner Web

CVE-2025-6077

EPSS 0.7%CVSS 9.8

TESI2 vulnerabilities on this pageMax CVSS 9.3Priority 39KEV 0

CVE-2025-41370 · TESI Gandia Integra Total

SQL injection vulnerability in Gandia Integra Total

EPSS 0.7%CVSS 9.3

CVE-2025-41371 · TESI Gandia Integra Total

SQL injection vulnerability in Gandia Integra Total

EPSS 0.7%CVSS 9.3

ES2 vulnerabilities on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2025-54349 · ES iperf3

In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.

EPSS 0.5%CVSS 10.0

CVE-2025-54351 · ES iperf3

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).

EPSS 0.5%CVSS 10.0

cursor1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2025-54133 · cursor cursor

Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog

EPSS 0.4%CVSS 9.6

humhub1 vulnerability on this pageMax CVSS 9.2Priority 34KEV 0

CVE-2025-54790 · humhub cfiles

Files: Potential for SQL Injection through File Browse and List Operations

EPSS 0.4%CVSS 9.2

Debian1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2025-8454 · Debian devscripts

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of…

EPSS 0.3%CVSS 9.8

The archive.