Critical vulnerability archive — page 312

Vacron1 vulnerability on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2025-34043 · Vacron Network Video Recorder (NVR)

Vacron NVR Remote Command Execution

EPSS 8%public exploit CVSS 10.0

xiaoyunjie2 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2025-6775 · xiaoyunjie openvpn-cms-flask

xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injection

EPSS 3%public exploit CVSS 9.8

CVE-2025-6776 · xiaoyunjie openvpn-cms-flask

xiaoyunjie openvpn-cms-flask File Upload controller.py upload path traversal

EPSS 0.7%public exploit CVSS 9.8

TOTOLINK4 vulnerabilities on this pageMax CVSS 9.8Priority 56KEV 0

OptiLink1 vulnerability on this pageMax CVSS 9.4Priority 55KEV 0

CVE-2025-34049 · OptiLink ONT1GEW GPON

OptiLink ONT1GEW GPON Remote Code Execution

EPSS 2%public exploit CVSS 9.4

Beward1 vulnerability on this pageMax CVSS 9.4Priority 54KEV 0

CVE-2025-34042 · Beward N100 IP Camera

Beward N100 IP Camera Remote Command Execution

EPSS 2%public exploit CVSS 9.4

hiyouga1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2025-53002 · hiyouga LLaMA-Factory

LLaMA-Factory Remote Code Execution (RCE) Vulnerability

EPSS 1%public exploit CVSS 9.8

Comet System1 vulnerability on this pageMax CVSS 9.2Priority 52KEV 0

CVE-2025-6763 · Comet System T0510

Comet System H3531 Web-based Management setupA.cfg missing authentication

EPSS 1%public exploit CVSS 9.2

dataease1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2025-49003 · dataease dataease

Dataease H2 JDBC Connection Remote Code Execution

EPSS 0.9%public exploit CVSS 9.8

Shanghai Fanwei Network Technology1 vulnerability on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2025-34046 · Shanghai Fanwei Network Technology E-Office

Fanwei E-Office Unauthenticated File Upload

EPSS 0.9%public exploit CVSS 10.0

code-projects3 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-6777 · code-projects Food Distributor Site

code-projects Food Distributor Site process_login.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2025-6668 · code-projects Inventory Management System

code-projects Inventory Management System fetchSelectedBrand.php sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2025-6665 · code-projects Inventory Management System

code-projects Inventory Management System editBrand.php sql injection

EPSS 0.5%CVSS 9.8

IBM1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-36038 · IBM WebSphere Application Server

IBM WebSphere Application Server code execution

EPSS 13%CVSS 9.8

LabRedesCefetRJ1 vulnerability on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2025-53091 · LabRedesCefetRJ WeGIA

WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter

EPSS 0.5%public exploit CVSS 10.0

Pandora FMS1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2025-5306 · Pandora FMS Pandora FMS

Command Injection in Netflow path

EPSS 36%CVSS 9.8

nmedia1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2025-4334 · nmedia Simple User Registration

Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

EPSS 3%CVSS 9.8

Shenzhen Lingkong Technology1 vulnerability on this pageMax CVSS 9.4Priority 46KEV 0

CVE-2025-34044 · Shenzhen Lingkong Technology WIFISKY 7-layer flow control router

WIFISKY 7-Layer Flow Control Router Remote Command Execution

EPSS 4%CVSS 9.4

MIKO1 vulnerability on this pageMax CVSS 9.9Priority 45KEV 0

CVE-2025-52207 · MIKO MikoPBX

PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.

EPSS 2%CVSS 9.9

Mitsubishi Electric Corporation1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2025-3699 · Mitsubishi Electric Corporation G-50

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-5…

EPSS 1%CVSS 9.8

Dover Fueling Solutions1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2025-5310 · Dover Fueling Solutions ProGauge MagLink LX 4

Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical Function

EPSS 0.8%CVSS 9.8

mitre4 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2025-30131 · mitre

An issue was discovered on IROAD Dashcam FX2 devices.

EPSS 0.7%CVSS 9.8

CVE-2024-52928 · mitre

Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add ne…

EPSS 0.5%CVSS 9.6

CVE-2025-29331 · mitre

An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui pa…

EPSS 0.5%CVSS 9.8

CVE-2025-49603 · mitre

Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control.

EPSS 0.4%CVSS 9.1

Hunt Electronic1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-6561 · Hunt Electronic HBF-09KD

Hunt Electronic Hybrid DVR - Exposure of Sensitive System Information

EPSS 0.5%CVSS 9.8

pep.vn1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2025-28970 · pep.vn WP Optimize By xTraffic

WordPress WP Optimize By xTraffic plugin <= 5.1.6 - PHP Object Injection Vulnerability

EPSS 0.5%CVSS 9.8

goauthentik1 vulnerability on this pageMax CVSS 9.6Priority 38KEV 0

CVE-2025-52553 · goauthentik authentik

authentik has Insufficient Session verification for Remote Access Control endpoint access

EPSS 0.5%CVSS 9.6

idokd1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-6688 · idokd Simple Payment

Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin

EPSS 0.5%CVSS 9.8

pebas1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-52725 · pebas CouponXxL

WordPress CouponXxL theme <= 3.0.0 - PHP Object Injection Vulnerability

EPSS 0.5%CVSS 9.8

themehunk1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-52816 · themehunk Zita

WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability

EPSS 0.5%CVSS 9.8

BoldThemes1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-52724 · BoldThemes Amwerk

WordPress Amwerk theme <= 1.2.0 - PHP Object Injection Vulnerability

EPSS 0.4%CVSS 9.8

HaruTheme1 vulnerability on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2025-49885 · HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce

WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability

EPSS 0.4%CVSS 10.0

JuliaRegistries1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-52483 · JuliaRegistries Registrator.jl

Registrator.jl Vulnerable to Argument Injection and Command Injection

EPSS 0.4%CVSS 9.8

Mavi Yeşil Software1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-12364 · Mavi Yeşil Software Guest Tracking Software

SQLi in Mavi Yeşil Software's Guest Tracking Software

EPSS 0.4%CVSS 9.8

ThemeMove1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-39474 · ThemeMove Amely

WordPress Amely theme <= 3.1.4 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.8

Case Informatics1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-11739 · Case Informatics Case ERP

SQLi in Case Informatics' Case ERP

EPSS 0.4%CVSS 9.8

Eron Software1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-12150 · Eron Software Wowwo CRM

SQLi in Eron Software's Wowwo CRM

EPSS 0.4%CVSS 9.8

Mobilteg Mobile Informatics1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-12143 · Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB

SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB

EPSS 0.4%CVSS 9.8

scriptsbundle1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-12827 · scriptsbundle DWT - Directory & Listing WordPress Theme

DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset

EPSS 0.4%CVSS 9.8

chrisbadgett1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2025-52717 · chrisbadgett LifterLMS

WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability

EPSS 0.4%CVSS 9.8

wpopal1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2025-23967 · wpopal GG Bought Together for WooCommerce

WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability

EPSS 0.4%CVSS 9.3

getredhawkstudio1 vulnerability on this pageMax CVSS 9.1Priority 34KEV 0

CVE-2025-53260 · getredhawkstudio File Manager Plugin For Wordpress

WordPress File Manager Plugin For Wordpress plugin <= 7.5 - Arbitrary File Upload Vulnerability

EPSS 0.4%CVSS 9.1

DirectIQ1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2025-52829 · DirectIQ DirectIQ Email Marketing

WordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection Vulnerability

EPSS 0.3%CVSS 9.3

favethemes1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2025-52834 · favethemes Homey

WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability

EPSS 0.3%CVSS 9.3

JoinWebs1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2025-52722 · JoinWebs Classiera

WordPress Classiera theme <= 4.0.34 - SQL Injection Vulnerability

EPSS 0.3%CVSS 9.3

sh1zen1 vulnerability on this pageMax CVSS 9.6Priority 30KEV 0

CVE-2025-53314 · sh1zen WP Optimizer

WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability

EPSS 0.2%CVSS 9.6

The archive.