Critical vulnerability archive — page 310

Hikvision1 vulnerability on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2025-34067 · Hikvision Integrated Security Management Platform

Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson

EPSS 22%public exploit CVSS 10.0

Stamparm1 vulnerability on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2025-34073 · Stamparm Maltrail

stamparm/maltrail <=0.54 Remote Command Execution

EPSS 5%public exploit CVSS 10.0

AVTECH3 vulnerabilities on this pageMax CVSS 10.0Priority 57KEV 0

CVE-2025-34054 · AVTECH IP camera, DVR, and NVR Devices

AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection

EPSS 3%public exploit CVSS 10.0

CVE-2025-34056 · AVTECH IP camera, DVR, and NVR Devices

AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution

EPSS 2%public exploit CVSS 9.4

CVE-2025-34055 · AVTECH IP camera, DVR, and NVR Devices

AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution

EPSS 2%public exploit CVSS 9.4

Lucee Association Switzerland1 vulnerability on this pageMax CVSS 9.4Priority 55KEV 0

CVE-2025-34074 · Lucee Association Switzerland Lucee

Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write

EPSS 2%public exploit CVSS 9.4

GFI Software3 vulnerabilities on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2025-34069 · GFI Software Kerio Control

GFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwarding

EPSS 0.8%public exploit CVSS 9.8

CVE-2025-34070 · GFI Software Kerio Control

GFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces

EPSS 0.8%public exploit CVSS 10.0

CVE-2025-34071 · GFI Software Kerio Control

GFI Kerio Control Unsigned System Image Upload Root Code Execution

EPSS 0.8%public exploit CVSS 9.8

Monero Project1 vulnerability on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2025-34060 · Monero Project Forum

Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery

EPSS 0.8%public exploit CVSS 10.0

Campcodes10 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2025-6959 · Campcodes Employee Management System

Campcodes Employee Management System eloginwel.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6960 · Campcodes Employee Management System

Campcodes Employee Management System empproject.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6957 · Campcodes Employee Management System

Campcodes Employee Management System eprocess.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6958 · Campcodes Employee Management System

Campcodes Employee Management System edit.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6961 · Campcodes Employee Management System

Campcodes Employee Management System mark.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6962 · Campcodes Employee Management System

Campcodes Employee Management System myprofileup.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6963 · Campcodes Employee Management System

Campcodes Employee Management System myprofile.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6954 · Campcodes Employee Management System

Campcodes Employee Management System applyleave.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-6955 · Campcodes Employee Management System

Campcodes Employee Management System aprocess.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-6956 · Campcodes Employee Management System

Campcodes Employee Management System changepassemp.php sql injection

EPSS 0.5%public exploit CVSS 9.8

One Identity2 vulnerabilities on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2025-34063 · One Identity OneLogin Active Directory Connector (ADC)

OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key

EPSS 0.6%public exploit CVSS 10.0

CVE-2025-34064 · One Identity OneLogin Active Directory Connector (ADC)

OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

EPSS 0.5%public exploit CVSS 9.0

code-projects3 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-6938 · code-projects Simple Pizza Ordering System

code-projects Simple Pizza Ordering System editcus.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6936 · code-projects Simple Pizza Ordering System

code-projects Simple Pizza Ordering System addpro.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-6937 · code-projects Simple Pizza Ordering System

code-projects Simple Pizza Ordering System large.php sql injection

EPSS 0.5%public exploit CVSS 9.8

dataease2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-53005 · dataease dataease

Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-53006 · dataease dataease

Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability

EPSS 0.6%public exploit CVSS 9.8

mitre5 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-45814 · mitre

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows at…

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-45813 · mitre

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-45872 · mitre

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-52101 · mitre

linjiashop <=0.9 is vulnerable to Incorrect Access Control.

EPSS 0.5%CVSS 9.8

CVE-2025-45006 · mitre

Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabli…

EPSS 0.5%CVSS 9.1

Pilz2 vulnerabilities on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2025-41656 · Pilz IndustrialPI 4 with Firmware Bullseye

Pilz: Missing Authentication in Node-RED integration

EPSS 12%CVSS 10.0

CVE-2025-41648 · Pilz IndustrialPI 4 with IndustrialPI webstatus

Pilz: Authentication Bypass in IndustrialPI Webstatus

EPSS 0.8%CVSS 9.8

scripteo2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-4380 · scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager

Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion

EPSS 43%CVSS 9.8

CVE-2025-4689 · scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager

Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution

EPSS 0.6%CVSS 9.8

wpopal1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-6934 · wpopal Opal Estate Pro – Property Management and Submission

Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'

EPSS 25%CVSS 9.8

Anthropic1 vulnerability on this pageMax CVSS 9.3Priority 45KEV 0

CVE-2025-34072 · Anthropic Slack MCP Server

Anthropic Slack MCP Server Data Exfiltration via Link Unfurling

EPSS 0.4%public exploit CVSS 9.3

bitto.kazi1 vulnerability on this pageMax CVSS 9.1Priority 44KEV 0

CVE-2025-49029 · bitto.kazi Custom Login And Signup Widget

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

EPSS 2%CVSS 9.1

Cisco1 vulnerability on this pageMax CVSS 10.0Priority 44KEV 0

CVE-2025-20309 · Cisco Cisco Unified Communications Manager

Cisco Unified Communications Manager Static SSH Credentials Vulnerability

EPSS 1%CVSS 10.0

gluestack1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2025-53104 · gluestack gluestack-ui

gluestack-ui Command Injection Vulnerability via discussion-to-slack GitHub Action Workflow

EPSS 1%CVSS 9.1

Hewlett Packard Enterprise1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-37099 · Hewlett Packard Enterprise Insight Remote Support

A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.

EPSS 0.8%CVSS 9.8

CodeDropz1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-5746 · CodeDropz Drag and Drop Multiple File Upload (Pro) - WooCommerce

Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload

EPSS 0.7%CVSS 9.8

ThemeREX1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-13786 · ThemeREX Education Center | LMS & Online Courses WordPress Theme

Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection

EPSS 0.6%CVSS 9.8

Linux3 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-38123 · Linux Linux

net: wwan: t7xx: Fix napi rx poll issue

EPSS 0.5%CVSS 9.8

CVE-2025-38120 · Linux Linux

netfilter: nf_set_pipapo_avx2: fix initial map fill

EPSS 0.5%CVSS 9.4

CVE-2025-38139 · Linux Linux

netfs: Fix oops in write-retry from mis-resetting the subreq iterator

EPSS 0.5%CVSS 9.8

ASR2 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2025-49492 · ASR Falcon_Linux、Kestrel、Lapwing_Linux

Out-of-bounds write in lte-telephony

EPSS 0.3%CVSS 9.8

CVE-2025-49480 · ASR Falcon_Linux、Kestrel、Lapwing_Linux

Out-of-bounds access in lte-telephony

EPSS 0.3%CVSS 9.1

LizardByte1 vulnerability on this pageMax CVSS 9.7Priority 32KEV 0

CVE-2025-53095 · LizardByte Sunshine

Sunshine application-wide CSRF in the UI leads to command injection as Administrator

EPSS 0.2%CVSS 9.7

The archive.