Critical vulnerability archive — page 303

CrushFTP1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-54309 · CrushFTP CrushFTP

CrushFTP Unprotected Alternate Channel Vulnerability

KEV · due 12 Aug EPSS 93%public exploit SSVC act CVSS 9.8

Fortinet1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-25257 · Fortinet FortiWeb

Fortinet FortiWeb SQL Injection Vulnerability

KEV · due 8 Aug EPSS 100%public exploit SSVC act CVSS 9.8

livewire1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2025-54068 · livewire livewire

Livewire vulnerable to remote command execution during property update hydration

KEV · due 3 Apr EPSS 96%public exploit SSVC act CVSS 9.8

mitre6 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2025-52046 · mitre

Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and…

EPSS 5%public exploit CVSS 9.8

CVE-2025-46001 · mitre

An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary…

EPSS 0.8%public exploit CVSS 9.8

CVE-2025-51630 · mitre

TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort parameter in the function setIpPortFilte…

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-53867 · mitre

Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.

EPSS 0.7%CVSS 9.8

CVE-2025-53964 · mitre

GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary…

EPSS 0.5%CVSS 9.6

CVE-2025-50240 · mitre

nbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds parameter at /sys/user/deleteRecycleBin.

EPSS 0.4%CVSS 9.8

harborist1 vulnerability on this pageMax CVSS 9.4Priority 54KEV 0

CVE-2025-7783 · harborist

Usage of unsafe random function in form-data for choosing boundary

EPSS 2%public exploit CVSS 9.4

code-projects8 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-7749 · code-projects Online Appointment Booking System

code-projects Online Appointment Booking System getmanagerregion.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-7750 · code-projects Online Appointment Booking System

code-projects Online Appointment Booking System adddoctorclinic.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-7751 · code-projects Online Appointment Booking System

code-projects Online Appointment Booking System addclinic.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-7752 · code-projects Online Appointment Booking System

code-projects Online Appointment Booking System deletedoctor.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-7753 · code-projects Online Appointment Booking System

code-projects Online Appointment Booking System adddoctor.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-7764 · code-projects Online Appointment Booking System

code-projects Online Appointment Booking System deletedoctorclinic.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-7765 · code-projects Online Appointment Booking System

code-projects Online Appointment Booking System addmanagerclinic.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-7814 · code-projects Food Ordering Review System

code-projects Food Ordering Review System signup_function.php sql injection

EPSS 0.5%public exploit CVSS 9.8

Jinher1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-7823 · Jinher OA

Jinher OA ProjectScheduleDelete.aspx xml external entity reference

EPSS 0.6%public exploit CVSS 9.8

PHPGurukul1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-7757 · PHPGurukul Land Record System

PHPGurukul Land Record System edit-property.php sql injection

EPSS 0.6%public exploit CVSS 9.8

1Panel-dev1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2025-53928 · 1Panel-dev MaxKB

MaxKB has RCE in MCP call

EPSS 0.5%public exploit CVSS 9.8

LabRedesCefetRJ6 vulnerabilities on this pageMax CVSS 9.4Priority 48KEV 0

CVE-2025-54058 · LabRedesCefetRJ WeGIA

WeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarEndereco.php Endpoint

EPSS 0.5%public exploit CVSS 9.4

CVE-2025-54060 · LabRedesCefetRJ WeGIA

WeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarInfoPessoal.php Endpoint

EPSS 0.5%public exploit CVSS 9.4

CVE-2025-54061 · LabRedesCefetRJ WeGIA

WeGIASQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarDoc.php Endpoint

EPSS 0.5%public exploit CVSS 9.4

CVE-2025-54062 · LabRedesCefetRJ WeGIA

WeGIA SQL Injection (Blind Time-Based) Vulnerability in id_dependente Parameter on profile_dependente.php Endpoint

EPSS 0.5%public exploit CVSS 9.4

CVE-2025-53946 · LabRedesCefetRJ WeGIA

WeGIA vulnerable to SQL Injection in endpoint profile_paciente.php parameter id_fichamedica

EPSS 0.4%public exploit CVSS 9.4

CVE-2025-54079 · LabRedesCefetRJ WeGIA

WeGIA vulnerable to SQL Injection (Blind Time-Based) in endpoint 'Profile_Atendido.php' parameter 'idatendido'

EPSS 0.4%public exploit CVSS 9.4

NVIDIA1 vulnerability on this pageMax CVSS 9.0Priority 45KEV 0

CVE-2025-23266 · NVIDIA Container Toolkit

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker cou…

EPSS 3%CVSS 9.0

crmperks2 vulnerabilities on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-7696 · crmperks Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms

Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.3 - Unauthenticated PHP Object Injection via verify_field_val Function

EPSS 1%CVSS 9.8

CVE-2025-7697 · crmperks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms

Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Function

EPSS 1%CVSS 9.8

Microsoft4 vulnerabilities on this pageMax CVSS 9.9Priority 42KEV 0

CVE-2025-49746 · Microsoft Azure Machine Learning

Azure Machine Learning Elevation of Privilege Vulnerability

EPSS 0.9%CVSS 9.9

CVE-2025-53762 · Microsoft Microsoft Purview

Microsoft Purview Elevation of Privilege Vulnerability

EPSS 0.9%CVSS 9.9

CVE-2025-49747 · Microsoft Azure Machine Learning

Azure Machine Learning Elevation of Privilege Vulnerability

EPSS 0.8%CVSS 9.9

CVE-2025-47158 · Microsoft Azure DevOps

Azure DevOps Server Elevation of Privilege Vulnerability

EPSS 0.8%CVSS 9.0

Bearsthemes1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-5396 · Bearsthemes Bears Backup

Bears Backup <= 2.0.0 - Unauthenticated Remote Code Execution

EPSS 0.9%CVSS 9.8

RIOT-OS1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-53888 · RIOT-OS RIOT

RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c

EPSS 0.9%CVSS 9.8

MangaBooth1 vulnerability on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2025-7712 · MangaBooth Madara - Core

Madara - Core <= 2.2.3 - Unauthenticated Arbitrary File Deletion

EPSS 1.0%CVSS 9.1

WP Swings1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-6222 · WP Swings WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet

WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload

EPSS 0.7%CVSS 9.8

aaroncampbell1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2025-7643 · aaroncampbell Attachment Manager

Attachment Manager <= 2.1.2 - Unauthenticated Arbitrary File Deletion

EPSS 0.9%CVSS 9.1

LoginPress1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-7444 · LoginPress LoginPress Pro

LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider

EPSS 0.6%CVSS 9.8

joomcar.net2 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-26854 · joomcar.net Articles Good Search extension for Joomla

Extension - joomcar.net - SQL injection in Articles Good Search 1.0.0 - 1.2.4.0011 for Joomla

EPSS 0.5%CVSS 9.8

CVE-2025-26855 · joomcar.net Articles Calendar extension for Joomla

Extension - joomcar.net - SQL injection in Articles Calendar 1.0.0 - 1.0.1.0007 for Joomla

EPSS 0.5%CVSS 9.8

opencv1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-53644 · opencv opencv

OpenCV contains a use after free buffer write due to an uninitialized pointer

EPSS 0.4%CVSS 9.8

wolfSSL2 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-7394 · wolfSSL wolfSSL

In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for…

EPSS 0.5%CVSS 9.8

CVE-2025-7395 · wolfSSL wolfSSL

Domain Name Validation Bypass with Apple Native Certificate Validation

EPSS 0.3%CVSS 9.2

Growatt1 vulnerability on this pageMax CVSS 9.4Priority 36KEV 0

CVE-2025-29757 · Growatt https://oss.growatt.com

An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a val…

EPSS 0.5%CVSS 9.4

mailcow1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2025-53909 · mailcow mailcow-dockerized

mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

EPSS 0.5%CVSS 9.1

Leviton1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2025-6185 · Leviton AcquiSuite

Leviton AcquiSuite and Energy Monitoring Hub Cross-site Scripting

EPSS 0.4%CVSS 9.3

Broadcom2 vulnerabilities on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2025-6391 · Broadcom Brocade ASCG

JSON Web Token (JWT) Exposure in Log Files

EPSS 0.3%CVSS 9.1

CVE-2025-7398 · Broadcom Brocade ASCG

Medium Strength Cipher Suites detected on port on ports 9000 and 8036

EPSS 0.2%CVSS 9.1

The archive.